Same-origin policy

The rule that a document may not read data from a different origin unless that origin allows it. Note what it does not prevent: the request is often still sent, and side effects still happen, which is exactly why cross-site request forgery works. It is the default that CORS exists to relax, and the reason an iframe from another origin is an opaque box.