# Same origin policy

> The idea is to organize content based on the origin from which it arrives at the browser, preventing outside interference.

**Wikidata**: [Q2031810](https://www.wikidata.org/wiki/Q2031810)  
**Wikipedia**: [English](https://en.wikipedia.org/wiki/Same-origin_policy)  
**Source**: https://4ort.xyz/entity/same-origin-policy

## Summary
The Same Origin Policy (SOP) is a computer security model that organizes web content based on its origin to prevent outside interference. It is a fundamental security mechanism implemented in web browsers to control how documents and scripts from one origin can interact with resources from another origin.

## Key Facts
- Instance of: computer security model
- Primary use: web application security
- Wikipedia title: Same-origin policy
- Described by: RFC 6454: The Web Origin Concept
- Mozilla Developer Network article: Web/Security/Same-origin_policy
- Aliases include: Same origin policy, Same Domain Policy, Politica del mismo origen, 同一オリジンポリシー, 同一起源ポリシー, セイムオリジンポリシー, Política de origem comum
- Wikipedia languages: ar, be, de, en, es, fi, fr, it, ja, ko
- Sitelink count: 17
- Freebase ID: /m/063j1q
- Microsoft Academic ID (discontinued): 175408996

## FAQs
### Q: What is the Same Origin Policy?
A: The Same Origin Policy is a computer security model that organizes web content based on its origin to prevent outside interference. It controls how documents and scripts from one origin can interact with resources from another origin.

### Q: Why is the Same Origin Policy important for web security?
A: The Same Origin Policy is crucial for web security because it prevents malicious scripts from one website from accessing sensitive data on another website. This isolation helps protect users from cross-site scripting attacks and data theft.

### Q: How does the Same Origin Policy determine if two origins are the same?
A: The Same Origin Policy determines if two origins are the same by comparing their scheme (protocol), host (domain), and port. If all three components match, the origins are considered the same; otherwise, they are treated as different origins.

## Why It Matters
The Same Origin Policy is a cornerstone of modern web security, serving as the primary defense mechanism against cross-site scripting (XSS) attacks and other malicious activities that could compromise user data. By enforcing strict boundaries between different web origins, SOP prevents unauthorized access to sensitive information and maintains the integrity of web applications. This policy enables the safe execution of third-party scripts and content while protecting users from potential threats. Without SOP, the modern web as we know it—with its rich ecosystem of interconnected services and applications—would be far too risky to use. The policy's implementation in browsers has been critical in building user trust in web applications and enabling the growth of e-commerce, online banking, and other sensitive online activities.

## Notable For
- Foundational security model for web browsers that prevents cross-site scripting attacks
- Described in RFC 6454, establishing a formal standard for the Web Origin Concept
- Implemented across all major web browsers as a core security feature
- Supports the safe execution of third-party content and scripts on websites
- Enables the modern web ecosystem by providing a secure framework for content isolation

## Body
### Technical Implementation
The Same Origin Policy operates by comparing the scheme, host, and port of web resources. When a web page attempts to make a request to another origin, the browser checks these three components. If any of them differ, the request is blocked unless explicitly permitted through mechanisms like CORS (Cross-Origin Resource Sharing).

### Security Mechanisms
SOP enforces several key security boundaries:
- Prevents scripts from one origin from reading the content of documents from another origin
- Blocks cross-origin requests for sensitive operations like XMLHttpRequest or fetch
- Restricts access to cookies, localStorage, and other client-side storage between different origins
- Controls the ability to embed resources from other origins in iframes

### Evolution and Extensions
While SOP provides strong security defaults, the web has evolved to include controlled ways to share resources across origins:
- CORS (Cross-Origin Resource Sharing) allows servers to specify which origins can access their resources
- PostMessage API enables secure cross-origin communication between windows
- WebSockets can be configured to work across origins with appropriate security measures
- Content Security Policy (CSP) provides additional fine-grained control over resource loading and execution

### Impact on Web Development
The Same Origin Policy has significantly influenced how web applications are designed and developed:
- Developers must implement proper authentication and authorization mechanisms
- APIs often require explicit CORS headers to be accessible from web applications
- Third-party integrations must be carefully managed to maintain security
- Modern web architectures often use proxy servers or API gateways to handle cross-origin requests

### Limitations and Workarounds
While SOP provides essential security, it can sometimes create challenges:
- Developers must implement workarounds for legitimate cross-origin scenarios
- The policy can interfere with testing and development workflows
- Some advanced features require careful configuration to work across origins
- Security-conscious developers must balance functionality with the principle of least privilege