Same-origin policy
The browser rule that script from one origin can read responses and data from another origin only when that origin allows it, for example through CORS or postMessage. It restricts reading, not sending: cross-origin form posts and image loads still go out, often with the user’s cookies, which is why CSRF defenses exist.
- Defined in
- RFC 6454
Covered in
Guide
Protect cookie-authenticated actions against CSRF
Make the server distinguish an intended action from a request another site caused the browser to send.
Guide
Configure CORS and CSP around the browser capabilities you need
Control who can read API responses and which resources a page may execute without confusing either control with authorization.
Practice: CSRF lab: Protect an account change from a forged request · CORS policy lab: Grant CORS to the right origins only · CSP builder lab: Build a strict Content-Security-Policy