Same-origin policy
lastmod 2026-04-20created 2026-04-201 edits
The same-origin policy (SOP) is an important security model for web applications.
Under the policy, a web browser permits scripts contained in a first web page to access data in a second web page, but only if both web pages have the same origin. An origin is defined as a combination of URI scheme, host name, and port number. This policy prevents a malicious script on one page from obtaining access to sensitive data on another web page through that page (DOM).
This mechanism is particularly important for modern web applications that rely extensively on HTTPScookies to maintain authenticated user sessions, as servers act based on HTTP cookie information to reveal sensitive information or take state-changing actions. A strict separation between content provided by unrelated sites must be maintained on the client side to prevent the loss of data confidentiality or integrity.
The same-origin policy applies mainly to data access from scripts. That is, embedding resources across origins, such as images, CSS, and scripts via the corresponding HTML tags, is not restricted. (Fonts are a well-known exception.) Attacks take advantage of the fact that the same-origin policy does not apply to HTML tags.