Same-Origin Policy

The same-origin policy is the browser's core isolation rule. An origin is the combination of scheme, host and port, for example https://app.example.com:443. Scripts from one origin cannot freely read responses, DOM content or storage belonging to a different origin.

Why it matters

Without it, any page you visit could use your logged-in session to read your webmail or bank pages. The policy limits what scripts can read, but it does not stop every cross-site action: browsers still allow cross-origin requests to be sent via forms, images and links, which is why CSRF protection is still needed.

Developers meet it mostly through errors. CORS is the opt-in mechanism a server uses to relax the policy for specific origins. Related controls include cookies' SameSite attribute and Cross-Origin-Opener-Policy.

Example

Compared to https://example.com:

• https://example.com/page2 is same-origin.
• http://example.com differs by scheme.
• https://www.example.com differs by host.
• https://example.com:8443 differs by port.

Only the first can be read by a script from https://example.com without CORS.

Common mistakes

• Thinking subdomains share an origin. They do not.
• Assuming the policy prevents sending cross-site requests.
• Setting Access-Control-Allow-Origin: * on endpoints that return private data.

Related

• CORS
• CSRF
• SameSite cookie
• Cookie

यह पेज सामान्य जानकारी है, जिसे हमारी संपादकीय टीम ने लिखा है और दस्तावेज़ीकरण बदलने पर अपडेट किया जाता है। सर्वर और प्रदाता अलग-अलग होते हैं, इसलिए बदलाव पहले सुरक्षित तरीके से जाँचें। देखें: संपादकीय नीति और अस्वीकरण.