CyberCertPrepWeb App FundamentalsBrowser SecurityEASYFree question
What is the 'origin' of a URL according to the Same-Origin Policy? Give the origin of https://app.example.com:443/path?query
- A.https://app.example.com/path - an origin is the combination of scheme (https), host (app.example.com), and path (/path); the query is not part of the origin
- B.app.example.com:443 - an origin is the combination of host (app.example.com), and port (443); the scheme and the path are not part of the origin
- C.https://example.com:443 - an origin is the combination of scheme (https), registrable domain (example.com), and port (443); subdomains are not part of the origin
- D.https://app.example.com:443 - an origin is the combination of scheme (https), host (app.example.com), and port (443); the path and query are NOT part of the origin
Why D is correct
An origin is precisely scheme + host + port. https://app.example.com:443 is different from: http://app.example.com:443 (different scheme), https://other.example.com:443 (different host), https://app.example.com:8443 (different port). The path, query string, and fragment are NOT part of the origin. This precision matters for SOP enforcement and CORS configuration.
Know someone studying for Web App Fundamentals? Send them this one.