Same-Origin Policy (SOP).

Browser security rule that restricts how a document or script loaded from one origin can interact with a resource from a different origin. It belongs to the Application Security category of cybersecurity.

Browser security rule that restricts how a document or script loaded from one origin can interact with a resource from a different origin.

The Same-Origin Policy is the foundational isolation boundary of the web. Two URLs share an origin only when their scheme, host, and port all match; otherwise the browser blocks scripts from reading responses, accessing the DOM of cross-origin frames, or inspecting cookies that belong to another site. SOP prevents a malicious page from silently stealing the contents of a banking session opened in another tab. It is selectively relaxed by mechanisms such as CORS, postMessage, and JSONP. Misconfigured exceptions are a frequent root cause of cross-origin data leakage and authentication bypass bugs.

Defences for Same-Origin Policy (SOP) typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: SOP.