Skip to content
uencoder

Same-Origin Policy

The same-origin policy is the cornerstone of browser security, forbidding scripts from cross-origin reads/writes of DOM/cookies/storage, preventing malicious sites from manipulating another origin data.

Purpose

To keep malicious page scripts from accessing sensitive data of other origins; the foundational isolation mechanism of Web security.

Mechanism

Same origin = identical protocol + host + port. Scripts may read/write DOM only same-origin and send same-origin AJAX (reading responses). Cross-origin requires CORS approval. img/script can load cross-origin but their content is unreadable (img canvas is restricted).

Use cases

  • Web security foundation
  • Cross-origin isolation
  • CORS basis

Related tools

HTTP Status Codes
Reference table of common HTTP status codes (1xx-5xx) with names, categories, and descriptions. Free, private, and 100% client-side.
TOOL
URL Parser
Parse a URL into its components: protocol, host, path, query, hash, port, username, and password. Free, private, and 100% client-side.
TOOL

References