JavaScript Interview Question #137
What is the same-origin policy?
Generators, Browser Storage, Security & Advanced Runtime Concepts Senior Advanced
Quick Interview Answer
The same-origin policy is a browser security boundary that restricts how a document or script from one origin can interact with resources from another origin. An origin is primarily defined by scheme, host, and port.
Detailed Explanation
The same-origin policy is a browser security boundary that restricts how a document or script from one origin can interact with resources from another origin. An origin is primarily defined by scheme, host, and port.
The policy helps prevent one website from freely reading sensitive data belonging to another website. Mechanisms such as CORS provide controlled exceptions for certain cross-origin network access.
Code Example
// These are different origins:
// https://example.com
// http://example.com
// https://api.example.com
// https://example.com:8443
// Cross-origin access is restricted unless an applicable
// browser mechanism and server policy permit it.