What is the 'same-origin policy' (SOP) and what specific interactions does it restrict?

Question

Accepted Answer

Same-origin policy restricts JavaScript from reading responses to cross-origin requests and from accessing cross-origin DOM. It does NOT prevent cross-origin form submissions, image/script/CSS loading (embedding), or preflight-less cross-origin requests. Origin is defined as scheme + host + port - any difference means different origin

Answer

Same-origin policy is enforced by the web server, not the browser

Answer

Same-origin policy prevents loading resources from any origin other than the page's own origin; favicon requests bypass the same-origin policy entirely, executing any script the icon URL returns; X-Frame-Options: DENY prevents the page from framing others, not from being framed; HSTS is delivered through DNS TXT records, which is why it protects even the very first visit to a site; referrer-policy: no-referrer leaks the full URL to same-origin destinations, stripping it only cross-origin

Answer

Same-origin policy prevents all cross-origin network requests regardless of the resource type; the browser applies CSP only to same-origin scripts, with third-party scripts governed by their own site's policy; SameSite is a CSP directive, configured in the policy header rather than on the cookie itself; cross-origin reads of JSON are permitted by default, and CORS exists to restrict them rather than enable them

What is the 'same-origin policy' (SOP) and what specific interactions does it restrict?

Where this fits in the Web App Fundamentals exam

One question down. Thousands to go.

What is the 'same-origin policy' (SOP) and what specific interactions does it restrict?

Where this fits in the Web App Fundamentals exam

More free Browser Security questions

One question down. Thousands to go.