CyberCertPrepWeb App FundamentalsBrowser SecurityEASYFree question
What is the same-origin policy's definition of 'origin' and when are two URLs considered same-origin?
- A.Same origin means same domain name regardless of protocol or port
- B.Origin is the combination of protocol (scheme), hostname, and port; two URLs are same-origin only if all three components match exactly - https://example.com:443 and http://example.com:80 are different origins despite the same domain
- C.Same origin means the same IP address regardless of hostname
- D.Origins are compared only by domain name without subdomain consideration
Why B is correct
Origin = scheme + host + port. https://example.com, http://example.com, and https://api.example.com are three different origins. Even https://example.com:443 and https://example.com (implicit port 443) are the same origin. Subdomains are different origins from parent domains - this is why CORS, postMessage origin checks, and cookie Domain attributes must be configured carefully for subdomain architectures.
Know someone studying for Web App Fundamentals? Send them this one.