CyberCertPrepWeb App FundamentalsBrowser SecurityEASYFree question
What is the 'origin' of a URL according to the Same-Origin Policy? Give the origin of https://app.example.com:443/path?query
- A.https://example.com - the origin is just the base domain; the browser applies CSP only to same-origin scripts, with third-party scripts governed by their own site's policy; history.pushState allows changing the displayed origin in the address bar, a capability gated behind HTTPS
- B.app.example.com - the origin is just the hostname
- C.https://app.example.com:443/path
- D.https://app.example.com:443 - an origin is the combination of scheme (https), host (app.example.com), and port (443); the path and query are NOT part of the origin
Why D is correct
An origin is precisely scheme + host + port. https://app.example.com:443 is different from: http://app.example.com:443 (different scheme), https://other.example.com:443 (different host), https://app.example.com:8443 (different port). The path, query string, and fragment are NOT part of the origin. This precision matters for SOP enforcement and CORS configuration.
Know someone studying for Web App Fundamentals? Send them this one.