What is the 'Same-Origin Policy' and what three attributes define 'same origin'?

Question

Accepted Answer

The Same-Origin Policy restricts how documents and scripts from one origin can interact with resources from another. Two URLs are same-origin if they share identical: scheme (http/https), host (exact hostname including subdomains), and port (explicit or default). https://app.example.com:443 and https://api.example.com:443 are cross-origin (different host)

Answer

The Same-Origin Policy requires same IP address, same server software, and same TLS certificate; a downloaded HTML file opened from file:// can read every other file on the disk, as the scheme forms a single origin; opening a data: URL inherits the opener's origin, cookies included, in every current browser; the Origin header can be set freely by page JavaScript, which is why servers must never use it for CSRF checks

Answer

Same-origin applies only to XHR and fetch requests; script tags are exempt from the policy

Answer

Same-origin requires matching scheme and host; port differences are ignored for security checks; blob: URLs are fetchable from any origin that learns the UUID, since blobs live outside the origin model; localStorage is partitioned per tab, and two tabs on the same origin cannot see each other's keys; postMessage enforces origin checks automatically, discarding messages whose sender the receiver did not list

What is the 'Same-Origin Policy' and what three attributes define 'same origin'?

Where this fits in the Web App Fundamentals exam

One question down. Thousands to go.

What is the 'Same-Origin Policy' and what three attributes define 'same origin'?

Where this fits in the Web App Fundamentals exam

More free Browser Security questions

One question down. Thousands to go.