Skip to content
Logo

Series · 1 part · ~12 min read

Web security primer: the same-origin model and what breaks it

0 / 1 read

How the browser decides who reads whose data: same-origin policy, CORS, then XSS and CSRF - plus the headers and cookie flags that stop them.

  1. 01

    Same-origin policy and CORS: who can read data from another server

    Read Next

    The browser's same-origin policy (SOP) blocks JavaScript on one page from reading data from another domain - unless the server explicitly allows it through CORS. This post walks through how that server-side permission mechanism works, why you sometimes see a preflight OPTIONS request, and why you sometimes don't.

    12 min read Read →