Same-Origin Policy

Updated 18 Sep 2026

•
What it is
- •
  a browser security model restricting how scripts from one origin interact with resources from another
•
Origin
- •
  for ordinary HTTP URLs, determined by scheme, host, and port
- •
  different paths alone do not create different origins
•
Example
- •
  https://example.com/a and https://example.com/b share an origin
- •
  changing to http://example.com changes the origin
•
Caution
- •
  the policy is not a blanket ban on sending every cross-origin request
- •
  scripts can sometimes trigger a request while being prevented from reading its response
•
Related
- •
  Cross-Origin Resource Sharing (CORS)
•

Linked references 2