Same-origin policy: the browser's boundary between sites

Why origin matters

The same-origin policy restricts how scripts from one origin interact with resources from another. An origin is defined by the scheme, host and port. Changing a path normally leaves the origin unchanged; changing a host or protocol does not.

This prevents an unrelated page from freely reading another site's authenticated data simply because the same browser has both open. Cross-origin embedding and sending requests are not identical to permission to read the response.

The boundary can be weakened

CORS provides a controlled way for servers to allow certain cross-origin reads. A permissive response must be assessed with the endpoint's data and credential handling. A configuration that is reasonable for public assets may be inappropriate for private account data.

The boundary also does not protect an application from scripts it deliberately loads into its own page. A third-party script can become part of the trusted execution environment. Review who can change those dependencies. Connect this to Content Security Policy and wallet-facing page content.

Quellen und Originale

• MDN: Same-origin policy