Same-origin policy

The same-origin policy, or SOP, is a browser security rule. It restricts how a document or script can interact with resources from another origin. For ordinary web addresses, the origin is determined by scheme, hostname and port. This separates content belonging to different websites.

Distinguish a path change from an origin change

A fictional portal uses https://portal.example/overview and https://portal.example/settings. Both addresses have the same origin: only the path differs. The API at https://api.example/projects has a different hostname and therefore a different origin. No requests were sent to these example addresses.

Sharing an origin does not mean that every signed-in person may use all projects or settings. The application must still check that itself.

A request does not always mean read access

The SOP does not block every request to another origin. Depending on its type, a request can be sent while the script is not permitted to read the response. MDN therefore distinguishes sending, embedding and reading, among other interactions.

Through CORS, the target server can specify which other origins may access responses in the browser. This permission replaces neither authentication nor authorisation checks on the server. Browser isolation and access to business data remain different tasks.

Sources

• MDN — Same-origin policy