Same-Origin Policy (SOP)
A fundamental browser security mechanism that restricts scripts loaded from one origin from inspecting or mutating the Document Object Model (DOM) and reading responses from another origin.
Entity Relationships (GEO Conceptual Hierarchy)
Taxonomy ModelTechnical Explanation & Operational Mechanics
The Same-Origin Policy enforces strict boundaries between different web applications running in the browser. Two URLs share the exact same origin only if their URI scheme (protocol), host (domain), and port are identical. Without SOP, a malicious script loaded from attacker.com could execute in your browser, query your online banking session, and read private user data, cookies, and account numbers. SOP permits cross-origin writes (like submitting a form or embedding an image) but strictly forbids cross-origin reads of response bodies unless explicitly relaxed by Cross-Origin Resource Sharing (CORS).
Technical Example & Practical Implementation
Evaluating origins against base reference: http://example.com/app/index.html (Port 80 default)
Base Origin: http://example.com:80
Comparison URL Outcome Reason
-------------------------------------------------------------------------------------
http://example.com/app/data.json MATCH Same scheme (http), host, and port
http://example.com:80/other/page.html MATCH Identical scheme, host, and port
https://example.com/app/data.json BLOCKED Scheme mismatch (https != http)
http://api.example.com/data.json BLOCKED Host mismatch (subdomain differs)
http://example.com:8080/data.json BLOCKED Port mismatch (8080 != 80)Related Topic Ecosystem & Next Steps
Related Technical Articles
What Is CORS (Cross-Origin Resource Sharing)?
The standard protocol enabling controlled cross-origin data access in modern browsers.
CSP vs CORS: Differences in Browser Defense Mechanisms
Distinguishing outbound resource loading restrictions from inbound server access control.
Troubleshooting: No Access-Control-Allow-Origin Header Present
Diagnose and fix the most common browser cross-origin blocking error with production configs.
Hands-On Diagnostic Labs
Developer References & Specifications
Continue Learning
CORS Policy & Preflight Handshake Lab
Simulate preflight OPTIONS probes and adjust Access-Control-Allow-* headers inside the browser sandbox.