intermediate

Same-origin policy

Know how scheme, host, and port define origin and how SOP restricts DOM, storage, and network reads.

Same-origin policy is a browser boundary based on scheme, host, and port. It limits how one origin can read another origin's document, storage, and many response bodies. It does not stop all cross-origin requests from being sent; it controls what the calling page can observe or manipulate.

					https://app.example.com:443
 scheme   host          port

Embedding (`<img>`, `<script>`) differs from reading cross-origin DOM or response bodies. SOP is isolation, not authentication.

On interviews: explain the difference between sending a request, reading a response, embedding assets, and DOM access.

Common pitfalls: SOP is not authentication. CORS relaxes selected reads; it does not protect your server from direct non-browser clients.

The trade-off is convenience versus control — pick the mechanism that matches your coupling and performance budget.

Checklist:

Define origin precisely.
Separate send from read permissions.
Know embed vs read rules.
Do not rely on SOP alone for auth.