Sites, origins and "same site"

Think of a block of flats. The street address (example) is shared by everyone, so it tells you nothing about who lives where. The flat number plus the street (shopa.example) is one household. Rooms inside the flat (cdn.shopa.example, www.shopa.example) all belong to that same household. A browser wants the household.

Three words you need

The public suffix list

"Take the last two labels" works for shopa.example, but fails for practice-shop.co.uk: the last two labels are co.uk, which thousands of unrelated companies share. So browsers carry a public suffix list, a long file of endings under which anyone can register a name.

The list also holds "private" suffixes added by hosting services. github.io is on it, so alice.github.io and bob.github.io are two different sites, even though one company runs the servers. Without that entry, Alice's blog could set a cookie that Bob's blog receives. In our practice world, pages.example plays the same role.

The rules, as the browser applies them:

1. Lower-case the host, drop the port, and drop a trailing dot (shopa.example. is a legal way of writing shopa.example).
2. Find the longest ending of the host that is on the list. For a.b.practice-charity.org.uk, both uk and org.uk are listed; org.uk wins.
3. The site is that ending plus one label to its left.
4. If the host is a public suffix (such as plain github.io), the site is the host itself.
5. If no listed ending matches at all, treat the last label as the suffix. So dev.app.zz has site app.zz.

Real lists also have a few wildcard and exception rules, and an IP address is its own site. Engines handle those too; you can leave them out here.

Schemeful same-site

Older browsers compared only the registrable domain, so http://shopa.example and https://shopa.example were "same site". Today's web standards define same-site as schemeful: the scheme is part of the site, so the plain-http page counts as a different, untrusted site. That matters because anyone on your café Wi-Fi can tamper with an http page, and it should not be able to borrow the https site's SameSite cookies.

The Python you need

Beyond variables, if, lists and functions, you need four small tools. Each is shown here with what it prints.

from urllib.parse import urlsplit       # part of Python's standard library

parts = urlsplit("https://CDN.ShopA.example:8443/lib.js")
print(parts.scheme)      # https
print(parts.hostname)    # cdn.shopa.example   (already lower case, port removed)

labels = "cdn.shopa.example".split(".")   # cut a string at every dot
print(labels)            # ['cdn', 'shopa', 'example']
print(labels[1:])        # ['shopa', 'example']   (a slice: from position 1 to the end)
print(".".join(labels[1:]))   # shopa.example     (glue a list back together with dots)

print("shopa.example.".rstrip("."))   # shopa.example   (remove dots from the right end)
print("co.uk" in {"co.uk", "uk"})     # True   (a set answers "is this in it?" quickly)

for i in range(3):       # i takes the values 0, 1, 2
    print(i)

A neat trick: if you try the endings from the longest (labels[0:]) to the shortest, the first one you find on the list is automatically the longest match.

// JavaScript (the tldts package)
import { getDomain } from "tldts";
getDomain("https://cdn.shopa.co.uk/lib.js");   // "shopa.co.uk"
getDomain("alice.github.io", { allowPrivateDomains: true });   // "alice.github.io" (private suffixes are off by default)
new URL("https://CDN.ShopA.example:8443/").hostname;   // "cdn.shopa.example"

// Go (golang.org/x/net/publicsuffix)
site, err := publicsuffix.EffectiveTLDPlusOne("alice.github.io")   // "alice.github.io", nil

// Rust (the psl crate)
let site = psl::domain_str("www.shopa.co.uk");   // Some("shopa.co.uk")

// C# (built in: host only; use a public-suffix package such as Nager.PublicSuffix for the site)
var host = new Uri("https://CDN.ShopA.example:8443/").Host;   // "cdn.shopa.example"

A common misconception

"Same site means same origin, just looser wording." They are different boundaries. Origin is what JavaScript uses to keep pages apart (who may read whose data). Site is what privacy features use to decide what counts as one party (whose cookies travel, which jar an embed gets). www.shopa.example and shopa.example are different origins but one site.