English
Menu

What is Same-origin policy?

A browser rule that restricts scripts on a page loaded from one origin from reading the contents of resources from another origin. An origin is the combination of scheme, host name and port number, and two URLs have the same origin only when all three match. It prevents a malicious page's script from reading information from other sites where the user is logged in. Embedding, such as loading images or scripts, is allowed; when a page needs to read responses from another origin, CORS, which is based on the server's permission, is used.

Japanese name: 同一オリジンポリシー

Same-origin policy appears in 2 practice questions across 1 topic, including Web Technology Basics.

Field: Web Technology Basics

Try it: questions about Same-origin policy

Under the browser's same-origin policy, which of the following URLs is considered to have the same origin as https://www.example.com/app/index.html?

  1. Ahttps://www.example.com/data/list.json
  2. Bhttp://www.example.com/app/data.json
  3. Chttps://api.example.com/app/data.json
Show answer and explanation

Answer: A. https://www.example.com/data/list.json

An origin is determined by the combination of three things, the scheme, the host name and the port number, and two URLs have the same origin only when all three match. The path does not matter, so /data/list.json has the same origin. Under the same-origin policy, a page's JavaScript in principle cannot read the contents of responses received from other origins. This prevents a malicious page's script from reading information from other sites where the user is logged in.

Same-origin policy in the explanations

Questions that mention Same-origin policy (2)

  1. Under the browser's same-origin policy, which of the following URLs is considered to have the same origin as https://www.example.com/app/index.html?
  2. JavaScript on a page at https://app.example.com uses fetch to send a POST request with a body of Content-Type application/json to https://api.example.net/orders. Which of the following correctly describes how CORS behaves in this case?

Books on Web Technology Basics Ad

As an Amazon Associate I earn from qualifying purchases.

Related terms

Port number CORS (cross-origin resource sharing) Cookie (HTTP cookie) DOM (Document Object Model) Event loop HTTP (Hypertext Transfer Protocol) HTTP method HTTP status code JSON (JavaScript Object Notation) JWT (JSON Web Token)

Back to the glossary