Origin
A browser security boundary defined by a URL’s scheme, host and port (RFC 6454). Different paths on one origin do not create separate origins.
- Defined in
- RFC 6454
Covered in
Protect cookie-authenticated actions against CSRF
Make the server distinguish an intended action from a request another site caused the browser to send.
Configure CORS and CSP around the browser capabilities you need
Control who can read API responses and which resources a page may execute without confusing either control with authorization.
Prevent shared-cache poisoning and private-response deception
Define lookup and storage policy, trace cache/origin interpretation differences and verify both public reuse and private isolation.
Keep HTTP request boundaries consistent across intermediaries
Trace framing disagreements, reject ambiguous requests and verify what reaches the origin with a real loopback proxy project.
Prevent DOM XSS, postMessage abuse and client-side injection
Trace attacker-controlled values from the URL, messages and storage to the browser APIs that parse HTML or run code, then close those sinks with safe APIs, a sanitizer, Trusted Types and strict message checks.
Keep HTTP services up under application-layer DDoS
Bound every phase of an HTTP request, patch for the HTTP/2 attack classes, rate limit at the edge and the origin, and shed load deliberately, with nginx, Envoy and Node.js settings tested against slow clients and bursts.
All 18 pages that cover Origin in the library
Practice: CSRF lab: Protect an account change from a forged request · CORS policy lab: Grant CORS to the right origins only · CSP builder lab: Build a strict Content-Security-Policy · Local project: Repair a real proxy and shared cache