Same-origin policy

`https://example.com/a` and `https://example.com/b` are the same origin: paths do not matter.

`https://example.com` and `http://example.com` are different: the scheme differs.

`https://example.com` and `https://www.example.com` are different: the host differs, and a subdomain is a different host.

`https://example.com` and `https://example.com:8443` are different: the port differs, with the default port implied by the scheme.

The related but distinct concept of a site groups an origin with its subdomains under the registrable domain, and it is what the `SameSite` cookie attribute uses.

Reading the DOM of a document from another origin, including one loaded in an iframe.

Reading the response body of a network request to another origin, unless that origin opts in through CORS.

Reading cookies, local storage and IndexedDB belonging to another origin.

Reading pixel data from a canvas that has been tainted by an image from another origin.

Reading the contents of a cross-origin stylesheet through the CSS object model, which would otherwise disclose rules a page was never meant to inspect.

Sending requests. A page may load images, scripts, stylesheets and fonts from anywhere, and may submit a form to anywhere. It simply cannot read the result in most cases.

That asymmetry is why cross-site request forgery exists: the request is sent with the victim's cookies and has its effect, even though the attacking page never sees the response.

Navigation. A page may navigate the top-level window anywhere.

Embedding. Unless a site refuses with `X-Frame-Options` or a frame-ancestors policy, any page may be framed by any other.

CORS relaxes it, letting a server opt in to its responses being readable by named origins.

`SameSite` cookies address the request-sending gap by limiting when cookies accompany cross-site requests.

Cross-Origin-Opener-Policy and Cross-Origin-Resource-Policy reinforce it, closing side channels the original policy left open.

A Content Security Policy constrains what a document may load and execute, which is a different axis from what it may read.

`document.domain` was a historical escape hatch allowing two pages sharing a parent domain to declare themselves same-origin. Browsers have deprecated and restricted it, and new code should treat it as unavailable.

The practical consequence worth remembering is that the policy governs the browser's behaviour and nothing else: every restriction it imposes disappears the moment the same request is made by a server.