View source for Same-origin policy

In [[computing]], the '''same-origin policy''' is an important concept in the [[web application]] [[security model]].

== Description ==

Under the policy, a [[web browser]] permits scripts contained in a first web page to access data in a second web page, but only if both web pages have the same ''origin''.

An ''origin'' is defined as a combination of [[URI scheme]], [[hostname]], and [[port number]].

This policy prevents a [[malicious script]] on one page from obtaining access to sensitive data on another web page through that page's [[Document Object Model]].

== Cookies ==

This mechanism bears a particular significance for modern web applications that extensively depend on [[HTTP cookies]] to maintain authenticated user sessions, as servers act based on the HTTP cookie information to reveal sensitive information or take state-changing actions.

== Strict separation between unrelated sites ==

A strict separation between content provided by unrelated sites must be maintained on the [[Client-side|client]] side to prevent the loss of data confidentiality or integrity.

== See also ==

* [[Ajax (programming)]]
* [[Client-side scripting]]
* [[Computer security]]
* [[Cross-origin resource sharing]]
* [[Cross-site scripting]]
* [[Document Object Model]]
* [[Domain Name System]]
* [[Web application]]
* [[Web browser]]
* [[Web security]]
* [[Web service]]

== External links ==

* [http://en.wikipedia.org/wiki/Same-origin_policy Same-origin policy] @ Wikipedia

[[Category:Computer science]]
[[Category:Computing]]
[[Category:Internet security]]
[[Category:Web design and development]]