Deception is moving at machine speed. Learn to keep pace.
Portal LoginSupportBlogContact
Search
Portal LoginSupportBlogContact
Search
Get a Demo
Start for Free
HomeCybersecurity 101
Same Origin Policy

What Is Same Origin Policy

Written by: Lizzie Danielson

Published: 9/26/2025

woman at laptop
ChatGPT logoChatGPTOpens in new tabClaude logoClaudeOpens in new tabPerplexity logoPerplexityOpens in new tabGoogle Gemini logoGoogle AIOpens in new tab
On This Page

Ever wondered how your browser keeps you safe while surfing the web? Cue the same origin policy (SOP), one of the web's unsung heroes. This browser security model restricts interactions between different sites, shielding you from potential data breaches and bad actors. Think of it as your web guardian, ensuring that scripts from Site A can't mess with data from Site B.

This post dives deep into what the same origin policy is, how it works, its benefits, and the risks tied to bypassing it. We’ll also explore SOP’s relationship to CORS (Cross-Origin Resource Sharing), backed by real-world examples. Whether you're a developer looking to fortify your app or a budding cybersecurity enthusiast, this guide is your perfect starting point.

What is Same Origin Policy

The same-origin policy is a browser security feature that prevents scripts on one origin from accessing data on another origin.

First, we need to define “origin.” An origin is a unique combination of protocol (http or https), domain, and port number. If these three match, the two sites share the same origin. For example:

  • http://example.com/page1.html and http://example.com/page2.html are same-origin.

  • https://example.com and http://example.com are NOT same-origin because the protocol differs.

  • http://blog.example.com and http://example.com are NOT same-origin because the domains differ.

Without SOP, malicious sites could interact with sensitive sites (think online banking or email platforms), leading to disastrous outcomes.

Why same origin policy matters for web security

SOP is a shield against two of the most dangerous web attacks:

XSS occurs when attackers inject malicious scripts into a trusted webpage. SOP minimizes the extent of data theft by isolating these scripts. For instance, even if a rogue script runs on an online blog, it can’t access your email account cookies.

  • Cross-Site Request Forgery (CSRF)

CSRF tricks users into executing unintended actions, like transferring money, on authorized sites without their consent. SOP helps block unauthorized scripts from making these requests on your behalf.

Simply put, SOP creates a wall around each site’s data, preventing chaos.

How does same origin policy work

When your browser loads scripts from one origin, it applies SOP to restrict specific actions. Here’s how it works in practice:

  • Allowed: Embedding static resources like images, stylesheets, and JavaScript files from other origins.

  • Blocked: Dynamic interactions like reading cookies, accessing DOM structures, or running scripts from a different origin.

SOP in Action

Imagine you’re logged into your online banking account https://bank.com. Now, you unknowingly visit http://badsite.com. Without SOP:

  • badsite.com could send API requests to your bank account.

  • Worse, it could read sensitive data like account balances or credentials.

With SOP enforced, the offending scripts are blocked, keeping your data safe.

A Common Exception - CORS

Sometimes, sharing resources cross-origin is necessary. For instance, a web app hosted on api.example.com might need to interact with frontend.example.com. Enter Cross-Origin Resource Sharing (CORS). By setting specific headers, websites can whitelist trusted origins to bypass SOP restrictions.

Example of a CORS Header

To allow https://frontend.example.com to access resources from https://api.example.com, the server would include the following header in its response:

```

Access-Control-Allow-Origin: https://frontend.example.com

```

Common attacks prevented by same origin policy

Attackers can trick users into visiting malicious links to steal session cookies. Thanks to SOP, one site can’t “peek” into the session data of another origin.

  • Data Theft via Embedded Frames

Embedding iframes from sensitive sites was once a common method for attackers to extract data. With SOP, any attempt to access iframe details from a different origin is blocked outright.

SOP works in tandem with headers like X-Frame-Options to prevent clickjacking attacks, where users unknowingly click hidden elements embedded by attackers.

Same origin policy example

Allowed Scenario

A blog on http://example.com embeds an image from http://cdn.example.com. The browser allows this because it’s a passive request requiring no dynamic interaction.

Blocked Scenario

The same blog tries to read user cookies from http://bank.com. SOP blocks this outright, as the origins are different.

How to Bypass Same Origin Policy and Why Doing It Is Risky

Methods to bypass SOP

  • CORS Headers: Explicitly grant access by including Access-Control-Allow-Origin in server responses. Used to enable trusted cross-origin communication.

  • JSONP: This technique wraps cross-origin requests using JavaScript callbacks. It’s an older method and largely replaced by CORS.

  • document.domain Setter: Allows scripts from subdomains of the same root domain to communicate (e.g., login.example.com to example.com). However, this is deprecated and should be avoided.

Why bypassing SOP can be dangerous

While bypassing SOP may seem harmless for legitimate use cases, misconfigurations can make your systems vulnerable:

  • Overly permissive CORS policies (e.g., Access-Control-Allow-Origin: *) expose sensitive resources to all origins.

  • Attackers can leverage insecure bypasses like JSONP for XSS attacks or sensitive data interception.

  • Improper use of iframe embedding or window messaging APIs (postMessage) risks leaking confidential information.

If bypassing SOP is essential, ensure strict access control policies are in place to minimize risks.

SOP vs cross-origin resource sharing

While SOP focuses on restricting cross-origin actions for security, CORS provides a framework for safely enabling approved access. Think of SOP as a locked door and CORS as a customized key.

Key differences

Feature

Same Origin Policy

CORS

Purpose

Restricts cross-origin interactions

Enables safe cross-origin data sharing

Flexibility

Highly restrictive

Configurable via headers

Use Case Example

Blocking unauthorized scripts

Allowing a trusted front-end to fetch APIs

Practical tips for developers

  • Set Secure CORS Policies: Avoid setting Access-Control-Allow-Origin to *. Restrict access to trusted origins only.

  • Use HTTPS Everywhere: Accessing resources over HTTP is a security risk. Always use HTTPS for sensitive applications.

  • Sanitize Inputs: Validating data on both client and server sides reduces risks like XSS.

  • Monitor Headers: Implement headers like X-Frame-Options and Content-Security-Policy to guard against iframe abuse and unauthorized script injections.

Web Security Starts with Awareness

The Same-Origin Policy might not be the flashiest part of web security, but it’s undeniably one of the most important. By quietly blocking harmful cross-origin interactions, SOP keeps the internet a safer place for everyone.

Developers and security teams should treat SOP as a foundation, not a standalone solution. Combine its safeguards with modern defenses like CORS configurations, CSRF tokens, secure headers, and proactive threat monitoring to create a rock-solid security approach.

Now you know what SOP is and why it matters. The next step? Use this knowledge to build safer, smarter applications. The future of web security starts with you.

ChatGPT logoChatGPTOpens in new tabClaude logoClaudeOpens in new tabPerplexity logoPerplexityOpens in new tabGoogle Gemini logoGoogle AIOpens in new tab
On This Page

FAQs

The same-origin policy (SOP) is a web browser security feature that restricts how documents and scripts from one website (origin) can interact with resources on another. In simple terms, it prevents a malicious site from accessing data on another site through the browser, protecting users from threats like cross-site scripting (XSS) or data leaks. (It’s like a privacy fence between websites.)

SOP helps enforce web privacy and application isolation. Without it, any website could make unauthorized requests or read sensitive information from other websites you’re logged into, such as banking portals or email accounts. It’s a core defense against cross-origin attacks like CSRF and credential theft.

In the context of SOP, “origin” refers to a unique combination of protocol (HTTP/HTTPS), domain, and port. For two web pages to be considered of the same origin, all three elements must match exactly. For example, https://example.com and http://example.com are different origins due to the protocol.

Same-origin policy can be bypassed or relaxed under certain conditions, such as:

  • Using CORS (Cross-Origin Resource Sharing) headers from the server

  • PostMessage API for safe cross-origin communication

  • (Historically) using document.domain, although it’s now deprecated due to security risks Improper use of these methods can lead to vulnerabilities or unauthorized access.

The same-origin policy is a default browser-enforced restriction, while CORS is a way for servers to explicitly allow certain cross-origin requests using headers like Access-Control-Allow-Origin. SOP blocks by default; CORS provides controlled exceptions when configured securely.

To prevent cross-origin attacks:

  • Use strict and validated CORS policies

  • Avoid Access-Control-Allow-Origin: * unless absolutely necessary

  • Implement CSRF tokens

  • Sanitize and validate all inputs to prevent XSS Use security headers like Content-Security-Policy, X-Frame-Options, and SameSite cookies

    • These practices complement the same-origin policy to create layered browser security.

Additional Resources

Read more about What Is Debug Logging? Benefits & Best Practices
What Is Debug Logging? Benefits & Best Practices
Cybersecurity 101

What Is Debug Logging? Benefits & Best Practices

Learn what debug logging is, how it helps in cybersecurity, and key best practices to reduce risk and boost incident response

Read more about Vulnerability Management Lifecycle: Steps and Best Practices
Vulnerability Management Lifecycle: Steps and Best Practices
Cybersecurity 101

Vulnerability Management Lifecycle: Steps and Best Practices

Learn the steps in vulnerability management, how to assess and prioritize risks, the best tools, and tips for a strong vulnerability management lifecycle.

Read more about What is Fileless Malware? Detection & Prevention Guide
What is Fileless Malware? Detection & Prevention Guide
Cybersecurity 101

What is Fileless Malware? Detection & Prevention Guide

Learn how fileless malware works, why it's so effective, and essential strategies to detect and prevent these memory-based cyberattacks.

Protect What Matters

Secure endpoints, email, and employees with the power of our 24/7 SOC. Try Huntress for free and deploy in minutes to start fighting threats.
Try Huntress for Free