Return to topic cards

Understanding Same-Origin Policy

Web SecurityBrowser PolicySame-Origin PolicyCross-Site ScriptingCORS

The Same-Origin Policy (SOP) is a critical security measure that governs how web browsers interact between web pages. It ensures that a script on one web page can access data on another only if both pages share the same origin. This policy is fundamental for preventing malicious scripts from accessing sensitive data across different websites.

Key Points

  • Same-Origin Policy restricts how documents or scripts from one origin can interact with resources from another origin.
  • An origin is defined by the combination of the URI scheme, hostname, and port number.
  • This policy helps prevent Cross-Site Scripting (XSS) attacks and other security vulnerabilities.

What is an Origin?

An origin is a combination of the following elements:

  • URI Scheme: The protocol used (e.g., http, https).
  • Hostname: The domain name (e.g., example.com).
  • Port Number: The communication endpoint (e.g., 80, 443).

For example, the origin of https://example.com:443 is different from http://example.com:80 because the schemes and port numbers differ.

How SOP Works

  • Script Access: A script running on https://example.com can access data on https://example.com/page2 but not on https://another-site.com.
  • Security Implications: By enforcing SOP, browsers ensure that scripts from one site cannot read or manipulate data from another site without explicit permission.

Practical Example

Consider a scenario where a user is logged into their bank account on https://bank.com. If SOP were not enforced, a malicious script from https://malicious-site.com could potentially access the user's banking information. SOP prevents this by ensuring that scripts from https://malicious-site.com cannot interact with https://bank.com.

Learn More

For a deeper understanding of SOP and its implications, you can explore resources on web security, browser policies, and cross-origin resource sharing (CORS).