What is the 'same-origin policy' (SOP) and what specific interactions does it restrict?

• A.The same-origin policy restricts JavaScript from sending cross-origin requests and from reading cross-origin cookies. It also prevents cross-origin form submissions, image/script/CSS loading (embedding), and preflight-less cross-origin requests. Origin is defined as scheme + host - the port is ignored, because browsers compare the host string alone
• B.Same-origin policy restricts servers from accepting cross-origin requests and from sharing cross-origin cookies (a CORS duty). It prevents image/script/CSS loading from other hosts, because embedding leaks data. Origin is defined as scheme + path - any difference means different origin
• C.Same-origin policy restricts JavaScript from reading responses to cross-origin requests and from accessing cross-origin DOM. It does NOT prevent cross-origin form submissions, image/script/CSS loading (embedding), or preflight-less cross-origin requests. Origin is defined as scheme + host + port - any difference means different origin