CyberCertPrepWeb App FundamentalsBrowser SecurityEASYFree question
What is the 'origin' of a URL according to the Same-Origin Policy? Give the origin of https://app.example.com:443/path?query
- A.https://app.example.com:443/path
- B.https://app.example.com:443 - an origin is the combination of scheme (https), host (app.example.com), and port (443); the path and query are NOT part of the origin
- C.https://example.com - the origin is just the base domain
- D.app.example.com - the origin is just the hostname
Why B is correct
An origin is precisely scheme + host + port. https://app.example.com:443 is different from: http://app.example.com:443 (different scheme), https://other.example.com:443 (different host), https://app.example.com:8443 (different port). The path, query string, and fragment are NOT part of the origin. This precision matters for SOP enforcement and CORS configuration.
Know someone studying for Web App Fundamentals? Send them this one.