<commit_before>---
layout: post
title: What every web developer should know about same-origin policy
description: article describes what same-origin policy is, what it is for and how to use it to build robust web applications.
keywords: web, security, SOP, same-origin policy, origin, CORS, XMLHttpRequest, WebSocket
---

Every web-developer has ever met with the subject called Same Origin Policy (SOP) but even many web-professionals do not know what it exactly is, who is responsible for implementing it and how to use it to build modern secure web applications. Moreover, it is difficult to find good resources on this topic that describe it in simple words. At the same time, it is very important for every web-developer to grasp the concept 'cause it is the cornerstone of web application security model and many web resources rely upon it.

SOP is a big topic and I aren't gonna cope all the aspects and corner cases of it. What I'm actually gonna do is to help you to get your head around it, understand the basics and grasp the ideas behind it.

## What SOP is
Unfortunately there is no single and concise definition of the concept, that would cope all the aspects of its application.
To start explaining the topic I think it would be helpful to check the ideas behind the concept first.

## Ideas behind SOP
User can visit several websites with a single browser simultaneously by opening new tabs or windows.
Lets consider an example of logging into internet-bank account and having opened other website in a different tab. I'm sure that as a user you would not want to grant other websites access to your bank account - to read any info from it. So I think you'd like browsers to impose restrictions on what scripts from the document opened at one tab can do with the document, opened in other tab. And browsers actually do this thing and such sort of restrictions is called Same-Origin Policy.

Of course SOP scope is much bigger the case of two opened tab and covers a lot of other things.
But the mentioned case helps to understand the main idea behind SOP - restrict reading (stealing) confidential information.

The SOP was originally implemented in Netscape Navigator 2.0 and since then it was incorporated into other browsers.  

Nowadays, SOP's scope goes beyond inter-tab (windows) communications and is incorporated into many other schemes of communications.

## Who is responsible for imposing restrictions defined by SOP?
As it is became clear from the above it is browsers's responsibility to impose restrictions defined by SOP. It is your browser that restricts scripts from other tabs from reading information at tab with opened internet-bank account page.

The SOP topic is quite broad and there are some differences in implementation of SOP across browsers. But in general most things defined by SOP work in the same way across main browsers.

## Origin notion.<commit_msg>Add keywords to the post 'About same origin policy'.<commit_after>---
layout: post
title: What every web developer should know about same-origin policy
description: article describes what same-origin policy is, what it is for and how to use it to build robust web applications.
keywords: web, security, SOP, same-origin policy, origin, CORS, csrf, xss, XMLHttpRequest, WebSocket
---

Every web-developer has ever met with the subject called Same Origin Policy (SOP) but even many web-professionals do not know what it exactly is, who is responsible for implementing it and how to use it to build modern secure web applications. Moreover, it is difficult to find good resources on this topic that describe it in simple words. At the same time, it is very important for every web-developer to grasp the concept 'cause it is the cornerstone of web application security model and many web resources rely upon it.

SOP is a big topic and I aren't gonna cope all the aspects and corner cases of it. What I'm actually gonna do is to help you to get your head around it, understand the basics and grasp the ideas behind it.

## What SOP is
Unfortunately there is no single and concise definition of the concept, that would cope all the aspects of its application.
To start explaining the topic I think it would be helpful to check the ideas behind the concept first.

## Ideas behind SOP
User can visit several websites with a single browser simultaneously by opening new tabs or windows.
Lets consider an example of logging into internet-bank account and having opened other website in a different tab. I'm sure that as a user you would not want to grant other websites access to your bank account - to read any info from it. So I think you'd like browsers to impose restrictions on what scripts from the document opened at one tab can do with the document, opened in other tab. And browsers actually do this thing and such sort of restrictions is called Same-Origin Policy.

Of course SOP scope is much bigger the case of two opened tab and covers a lot of other things.
But the mentioned case helps to understand the main idea behind SOP - restrict reading (stealing) confidential information.

The SOP was originally implemented in Netscape Navigator 2.0 and since then it was incorporated into other browsers.  

Nowadays, SOP's scope goes beyond inter-tab (windows) communications and is incorporated into many other schemes of communications.

## Who is responsible for imposing restrictions defined by SOP?
As it is became clear from the above it is browsers's responsibility to impose restrictions defined by SOP. It is your browser that restricts scripts from other tabs from reading information at tab with opened internet-bank account page.

The SOP topic is quite broad and there are some differences in implementation of SOP across browsers. But in general most things defined by SOP work in the same way across main browsers.

## Origin notion.
{'fraction_non_alphanumeric': 0.029904306220095694, 'fraction_numerical': 0.000683526999316473, 'mean_word_length': 4.399446494464945, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '5831932', 'n_tokens_mistral': 1324, 'n_tokens_neox': 1270, 'n_words': 967}