Unit 6: The browser security model · Lesson 1 of 5 · 14 min

Same origin

Scheme, host and port together decide what a page may read.

mission

You are
The analyst reviewing the shop.
Situation
Every browser rule in this unit starts from one question: do two URLs share an origin?
Goal
Learn the rule well enough to answer instantly.
Hand in
Correct answers for the shop's own addresses.

Origins as apartment blocks

An origin

https://shop.example.com:443/account
  1. 1httpsscheme
  2. 2shop.example.comhost
  3. 3443port, implied by https
  4. 4/accountpath, not part of the origin
All three parts must match. The path does not count.

Same origin or not?

Page origin http://127.0.0.1:8000

URLSchemeHostPortResult
http://127.0.0.1:8000/api/productshttp127.0.0.18000same origin
https://127.0.0.1:8443/shophttps127.0.0.18443cross origin
http://localhost:8000/shophttplocalhost8000cross origin
http://127.0.0.1:8001/http127.0.0.18001cross origin
https://shop.internal:8443/httpsshop.internal8443cross origin
Type your own URLs to test the rule.

What same origin protects

Allowed
page on http://127.0.0.1:8000
fetch("/api/orders")
reads the answer

Same origin: full access.

Blocked
page on https://other.example
fetch("http://127.0.0.1:8000/api/orders")
cannot read the answer

Different origin: the request may go, the answer stays hidden unless CORS allows it.

What a defender takes away

  1. 1An origin is scheme, host and port. Nothing else.
  2. 2localhost and 127.0.0.1 are different origins, even on the same machine.
  3. 3Same origin stops reading, not sending. That gap is why CSRF and CORS exist.

Questions

0 of 3 solved

Answer each one from what you find on your lab machine.