JavaScript Internals (521 Qs)•Part 2: Promises, Callbacks, Async & Strict Mode (54 - 103)
What is same-origin policy
The same-origin policy is a policy that prevents JavaScript from making requests across domain boundaries. An origin is defined as a combination of URI scheme, hostname, and port number. If you enable this policy then it prevents a malicious script on one page from obtaining access to sensitive data on another web page using Document Object Model(DOM).
Practical Code Example
javascript
// Same-Origin Policy requires Protocol, Host, and Port to match:
// Page origin: https://example.com:443
// Allowed:
// https://example.com/api/data (Same origin)
// Blocked by Browser SOP unless CORS headers are present:
// http://example.com/api/data (Different protocol: HTTP != HTTPS)
// https://api.example.com/data (Different subdomain/host)
// https://example.com:8080/data (Different port)