SOP
InformationalSame-Origin Policy
Definition
The Same-Origin Policy (SOP) is a fundamental security mechanism implemented in web browsers that restricts how scripts from one origin can interact with resources from another origin. Two URLs have the same origin if they share protocol, host and port. SOP prevents a malicious site from reading data from another site where the user is authenticated.
Impact
The security foundation of the entire modern webPrevents data theft between websitesLimits which cross-origin requests scripts can makeThe basis on which CORS, CSP and other mechanisms are built
Examples
What SOP allows and blocks
SOP compares protocol + host + port. If any of the three differs, the browser blocks scripts from reading the response. However, SOP does not block sending requests (which is why CSRF is possible), only reading the responses.
// Origin: https://example.com:443 // SAME ORIGIN (allowed): https://example.com/page2 // ✅ same protocol, host, port https://example.com/api/data // ✅ // DIFFERENT ORIGIN (blocked for reading): http://example.com/api // ❌ different protocol https://sub.example.com/api // ❌ different host https://example.com:8080/api // ❌ different port https://other.com/api // ❌ different host