Origins and Same-Origin Policy

An origin is the combination of scheme, host, and port used by browser security checks.

Two URLs have the same origin only when all three components match. The Same-Origin Policy blocks many cross-origin reads unless a browser feature such as CORS grants access.

httpbrowsersecuritycors

Reference (http)

https://app.example.com:443
https://api.example.com:443  # different origin

Two URLs have the same origin only when all three components match. The Same-Origin Policy blocks many cross-origin reads unless a browser feature such as CORS grants access.

Common mistakes

Confusing a site, registrable domain, origin, and URL, or assuming CORS protects server-to-server requests.

Sources

MDN HTTP Reference
OWASP HTTP Headers Cheat Sheet
MDN CORS Guide