previous article, the origin is composed of the following:
As long as all three of these match, the browser considers the two URLs to be same-origin. If any of these aspects differ, the browser considers the two URLs to be cross-origin. It might be helpful to look at some examples of different origins to clarify:
It's also important to note that the path (everything that comes after the hostname) is not part of the origin. This means that
https://30secondsofcode.org/articles are considered to be the same origin.
When CORS (Cross-Origin Resource Sharing) is mentioned, it's usually in the context of Same-Origin Policy, a security feature implemented by web browsers. It blocks web pages from making cross-origin requests with the purpose of preventing malicious websites from making unauthorized requests to sensitive resources on other domains.
As this can be quite restrictive, CORS allows the server to specify which other domains are allowed to make requests to its resources. This is done through the use of CORS headers,
Origin in the request and
Access-Control-Allow-Origin in the response. This way, for example, API servers can allow requests from specific web pages, while still blocking requests from other domains.
If you want to keep in touch, follow me on GitHub.
Collection · 33 snippets
Learn the difference between cookies, local storage and session storage and start using the correct option for your needs.