Storage and browser security
What is an origin
Identify an origin from its scheme, host, and port and understand why paths do not create separate origins.
8 minute lesson
An origin is the combination of a URL’s scheme, host, and port. All three parts must match.
For this URL:
https://shop.example.com:8443/account?tab=ordersthe origin is:
https://shop.example.com:8443The path, query string, and fragment do not participate. These pages therefore share an origin:
https://example.com/account
https://example.com/shopThese do not:
http://example.com
https://example.com
https://app.example.com
https://example.com:8443Browsers use this boundary for DOM access, network response access, and storage. A subdomain is not automatically trusted merely because it belongs to the same parent domain.
Open the Console on any page and run:
location.originThen compare it with the origin of an API, iframe, or asset the page uses. Asking “do scheme, host, and port match?” is the first step in explaining many CORS and cross-window errors.
Lesson completed