Same-origin policy (SOP)
Summary: The same-origin policy is a browser security mechanism that restricts scripts on one origin from accessing data from another origin, where an origin is defined by URI scheme, domain, and port number. The policy generally permits cross-origin loading of resources such as images, video, and scripts, but prevents JavaScript on the page from reading the contents of those resources, and it is more relaxed for cookies, which are often accessible from all subdomains of a site.
Key Takeaway: Without the same-origin policy, a malicious website a user visits could read their Gmail emails or Facebook private messages, because cross-origin requests carry the user's authentication session cookies and the response is generated within that session.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026