Beginner LevelWeb Security & Cyber Defense
What is the Same-Origin Policy (SOP) and how does CORS grant selective cross-domain access?
❓ Interview Prompt: Explain Same-Origin Policy (Protocol + Domain + Port), CORS headers, preflight requests, and cross-origin isolation.
The Same-Origin Policy (SOP) is a fundamental browser security boundary:
Same-Origin Rule:
A web page running at Origin A ('https://example.com:443') CANNOT read response data fetched from Origin B ('https://api.other.com:443') unless Origin B explicitly grants permission using CORS (Cross-Origin Resource Sharing) headers!
•
Origin Definition: Must match Protocol + Domain + Port exactly ('http' vs 'https' or port '80' vs '8080' are DIFFERENT origins!).
Code Implementation Example
http
// Request from https://app.example.com -> https://api.service.com
GET /api/v1/user HTTP/1.1
Host: api.service.com
Origin: https://app.example.com
// Response from Server granting access:
HTTP/1.1 200 OK
Access-Control-Allow-Origin: https://app.example.com
Access-Control-Allow-Credentials: true💡CORS header grant allowing cross-origin response reading.
🎯 Interview Key Takeaway
Same-Origin Policy blocks cross-origin data reads by default; CORS response headers selectively grant access.
#SOP#CORS#Browser Security#Beginner
Back to all Web Security & Cyber Defense Questions→