Same Origin Policy is a web security concept that allows browsers to prevent loading scripts from different sources or reading cookies and session data remotely. It helps to prevent basic XSS and CSRF attacks #websecurity #infosec 
An origin consists of a URI scheme://+host name + port number
Ex: example.com:8080
*If no port is given, it will be given the default port of the scheme. HTTP is 80 and HTTPS is 443
Ex: example.com:8080
*If no port is given, it will be given the default port of the scheme. HTTP is 80 and HTTPS is 443
This policy allows browsers to load and read data from the scope of the same origin only
Ex: company.com as an origin can load scripts and read data only from pages that have the same origin as http:// company.com or company.com/dir/
Ex: company.com as an origin can load scripts and read data only from pages that have the same origin as http:// company.com or company.com/dir/
SOP does not allow different:
1- schemes: (http is different https)
2- ports
3- hosts: (company.com and about.company.com are considered different hosts and cannot read data from each other) according to SOP policy
1- schemes: (http is different https)
2- ports
3- hosts: (company.com and about.company.com are considered different hosts and cannot read data from each other) according to SOP policy
@threadreaderapp unroll
