Same-Origin Policy
The browser rule isolating documents by scheme, host, and port, and the mechanisms for relaxing it.
The same-origin policy is the browser's fundamental isolation rule: a document may not read data from another origin, where an origin is the triple of scheme, host, and port. It is what stops a page from reading your mail in another tab.
Because real applications legitimately span origins, several mechanisms relax it. Cross-Origin Resource Sharing lets a server opt in to being read by named origins. Cookies have their own rules, keyed on domain rather than origin, so a cookie set for a parent domain is sent to subdomains — but scheme and port still matter for the origin check, which is why a subdomain can receive a cookie and still be refused. CSRF protections exist because cookies are sent automatically, so an authenticated state-changing request can be triggered from an unrelated page; the standard defense is a token the attacker cannot read, which is precisely why it fails when a request arrives from an origin not on the allowlist.
The recurring practical symptom is asymmetric: read requests succeed while writes fail with an authorization error, because reads pass the cookie check and writes hit the origin check. The cause is usually that the application is being driven at a URL that is not the one it was configured with — a bare hostname where a subdomain was expected, or the wrong port.
See also12
Multi-Tenancy
One deployment serving many isolated customers, with tenancy threaded through data, routing, and access.
Data & Content12 connections
eSIM
A SIM soldered into the device and provisioned over the air, with profiles downloaded rather than cards swapped.
Networks & Distribution12 connections
Caller ID Authentication
Cryptographic attestation of an originating telephone number, and why spoofed calls survive it.
Networks & Distribution17 connections
Domain Name System
The distributed directory translating names to addresses, and the layer where propagation delays live.
Systems & Tooling27 connections
Least Privilege
Granting only the permissions actually required, so a compromise has a small ceiling.
Systems & Tooling38 connections
Port
The numeric endpoint a network service listens on, and a scarce shared resource on a developer machine.
Systems & Tooling19 connections
Virtual Private Network
An encrypted tunnel that presents a remote network as local, and the narrow set of things a commercial one actually hides.
Networks & Distribution22 connections
Secret Management
Storing, distributing, and rotating credentials without embedding them in code or history.
Systems & Tooling33 connections
Referrer Policy
The rules for when a browser tells a site which page a visitor came from, a header misspelled in the 1990s that leaked private addresses for decades until browsers began trimming it by default.
Web Platform12 connections
Multi-Factor Authentication
Requiring a second kind of proof besides a password to sign in, such as a code, a phone prompt, or a hardware key, and why only the methods tied to the real website stop modern phishing.
Web Platform11 connections
Internationalized Domain Name
Domain names written in non-Latin scripts and accented letters, made to work in an ASCII-only DNS by encoding them as xn-- strings, and the browser rules that decide when to show the real characters and when to show the code to block lookalike attacks.
Web Platform10 connections
Open Redirect
A page that forwards visitors to whatever address a URL parameter names, letting attackers borrow a trusted domain to launch phishing or steal sign-in tokens, and the narrow ways to fix it.
Web Platform15 connections
Linked from24
- Browser ExtensionWeb Platform
Small programs that modify the browser and the pages it shows, from bookmarklets and userscripts to ad blockers, with access broad enough to make them a standing security risk.
- ClickjackingWeb Platform
Tricking a user into clicking something on another site by loading it invisibly in a frame beneath a decoy, and the headers that stop a page from being framed.
- Content Security PolicyWeb Platform
An HTTP header that tells the browser which sources of script, style, and other content a page is allowed to load.
- Cross-Origin Resource SharingWeb Platform
The mechanism by which a server opts in to letting scripts on other origins read its responses.
- Cross-Site Request ForgeryWeb Platform
Tricking a logged-in user's browser into sending a state-changing request to another site, which works because the browser attaches that site's cookies automatically.
- Cross-Site ScriptingWeb Platform
Injecting attacker-controlled script into a page that a victim's browser then executes with the victim's own privileges.
- Cross-Tab CommunicationWeb Platform
Keeping several open tabs of the same app consistent, best done by broadcasting small notifications and letting each tab re-read the truth.
- Data URIWeb Platform
A URL that carries its content inside the address itself, used to embed small images in pages and stylesheets without a separate request, and abused for phishing until browsers restricted it.
- Domain Name SystemSystems & Tooling
The distributed directory translating names to addresses, and the layer where propagation delays live.
- HotlinkingWeb Platform
Displaying an image or file on your page straight from someone else's server, so they pay for the traffic, which sites block by checking where requests come from and which courts have treated differently from copying.
- IframeWeb Platform
A whole web page embedded inside another, the web's main isolation boundary for ads, payments, and widgets, and the messaging and sandboxing rules that govern it.
- Internationalized Domain NameWeb Platform
Domain names written in non-Latin scripts and accented letters, made to work in an ASCII-only DNS by encoding them as xn-- strings, and the browser rules that decide when to show the real characters and when to show the code to block lookalike attacks.
- JSON Web TokenWeb Platform
A signed, self-contained token that carries claims a server can verify without a database lookup.
- Least PrivilegeSystems & Tooling
Granting only the permissions actually required, so a compromise has a small ceiling.
- LoopbackNetworks & Distribution
The network address a computer uses to talk to itself, where packets go out and come straight back without touching any hardware, the home of development servers and a recurring blind spot in security.
- Multi-Factor AuthenticationWeb Platform
Requiring a second kind of proof besides a password to sign in, such as a code, a phone prompt, or a hardware key, and why only the methods tied to the real website stop modern phishing.
- Multi-TenancyData & Content
One deployment serving many isolated customers, with tenancy threaded through data, routing, and access.
- OAuthWeb Platform
A protocol for granting one application limited access to a user's data on another, without handing over the user's password.
- PortSystems & Tooling
The numeric endpoint a network service listens on, and a scarce shared resource on a developer machine.
- Referrer PolicyWeb Platform
The rules for when a browser tells a site which page a visitor came from, a header misspelled in the 1990s that leaked private addresses for decades until browsers began trimming it by default.
- Shadow DOMWeb Platform
An encapsulated DOM subtree whose styles and structure are isolated from the rest of the page.
- URLWeb Platform
The address format that names every resource on the web, its parts from scheme to fragment, and why parsing one correctly is harder and more security-relevant than it looks.
- Web StorageWeb Platform
The browser's built-in ways to keep data on the user's device, from the simple string store localStorage to the transactional database IndexedDB, and their limits on size, persistence and security.
- WebSocketWeb Platform
A persistent, full-duplex connection between browser and server, replacing repeated request-response with an open channel.