Comparison
OriginvsSame-origin policy
Origin
the request counted as cross-origin because the port was different, even though the hostname matched.
The triple of scheme, host and port that the browser uses as its unit of trust. Two URLs are same-origin only if all three match exactly, so `http` and `https`, or `example.com` and `api.example.com`, are different origins. Almost every browser security rule is expressed in terms of this, which makes it the definition worth being pedantic about.
Full entry →Same-origin policy
the script could send the request but was not allowed to read what came back.
The rule that a document may not read data from a different origin unless that origin allows it. Note what it does not prevent: the request is often still sent, and side effects still happen, which is exactly why cross-site request forgery works. It is the default that CORS exists to relax, and the reason an iframe from another origin is an opaque box.
Full entry →