What is the 'same-origin policy' (SOP) and what specific interactions does it restrict?

• A.Same-origin policy prevents loading resources from any origin other than the page's own origin
• B.Same-origin policy is enforced by the web server, not the browser
• C.Same-origin policy prevents all cross-origin network requests regardless of the resource type
• D.Same-origin policy restricts JavaScript from reading responses to cross-origin requests and from accessing cross-origin DOM. It does NOT prevent cross-origin form submissions, image/script/CSS loading (embedding), or preflight-less cross-origin requests. Origin is defined as scheme + host + port - any difference means different origin