CyberGuard dictionary / Web Application Security
Same Origin Policy
The same-origin policy is a browser rule that limits how scripts from one origin interact with content from another origin.
In simple terms
A script on one website generally cannot read private responses from a different website just because your browser can visit both.
Technical explanation
An origin is defined by scheme, host, and port. Browsers apply this boundary to many script reads; controlled mechanisms such as CORS can grant specific cross-origin access. It is a browser boundary, not a substitute for server-side authorization.
The policy limits one origin's script from reading many resources on another origin. It does not prevent a server from receiving requests, and exceptions must be designed carefully.
Examples in practice
JavaScript on an unrelated site cannot read a bank account response from another origin without that origin allowing the read.
A script on an unrelated page submits a request to the bank, but the browser will not expose the response body to that script. The bank still needs CSRF and authorization controls.
Why it matters
The policy helps keep data from one website out of scripts running on another.
VERIFY & LEARN MORE
Sources and further reading
Published 2026-10-15 · Last updated 2026-10-15 · CyberGuard editorial content. Source links provide context; they do not imply endorsement.