It seems the internet is divided about the correct way.
Up until 2014, both W3C and WHATWG seemed to agree on the following:
Attribution for the quotation, if any, must be placed outside the blockquote element.
For example, here the attribution is given in a paragraph after the quote:
<blockquote>
<p>I contend that we are both atheists. I just believe in one fewer
god than you do. When you understand why you dismiss all the other
possible gods, you will understand why I dismiss yours.</p>
</blockquote>
<p>— Stephen Roberts</p>
The other examples below show other ways of showing attribution.
And for the cite element:
A person's name is not the title of a work — even if people call that person a piece of work — and the element must therefore not be used to mark up people's names. (In some cases, the b element might be appropriate for names; e.g. in a gossip article where the names of famous people are keywords rendered with a different style to draw attention to them. In other cases, if an element is really needed, the span element can be used.)
The rest of the examples mentioned make use of other elements such as cite and figcaption, but all of them demonstrate these elements being placed somewhere outside the blockquote element in question.
Since 2014, however, W3C HTML5 was changed to match HTML 4 again, allowing the use of cite for marking up the author name in a blockquote. The text in WHATWG HTML remains unchanged, so now not only is the rest of the internet divided about it, but so are the two standards bodies. But perhaps what's most amusing about all this is that the definition in WHATWG HTML (and W3C HTML5 before 2014) actually matches that of HTML 3.2, even though the current W3C HTML5 definition matches that of HTML 4.
Then again, since HTML 4 is the mainstream version of HTML that everyone is familiar with, perhaps it's OK to just stick to its more permissive definition.
