Same-Origin Policy

The Same-Origin Policy establishes an isolation boundary inside web browsers. For typical HTTP and HTTPS URLs, an origin consists of the scheme, hostname, and effective port; paths do not participate. For example, https://app.example.com/dashboard and https://app.example.com/settings share an origin, but https://api.example.com, http://app.example.com, and https://app.example.com:8443 are different origins. Explicitly specifying the default HTTPS port, 443, does not create a different origin.

The policy primarily restricts cross-origin reading and interaction, not every cross-origin network request. A page can often submit a form to another origin or embed cross-origin images and scripts, subject to other browser controls. However, its JavaScript generally cannot read another origin's documents or fetch responses unless an applicable mechanism permits access. Consequently, a browser can send a request that changes server state even when it refuses to expose the response to the calling script.

CORS is the standard HTTP mechanism for allowing selected cross-origin response access. Suppose a frontend at https://app.example.com fetches a JSON object from an Amazon S3 endpoint. The browser sends an Origin header, and the server must return an appropriate Access-Control-Allow-Origin value for JavaScript to read the response. An S3 CORS rule can allow the frontend's exact origin, required methods, and request headers. Access-Control-Expose-Headers makes selected response headers readable by JavaScript; it does not grant access to objects.

Some cross-origin requests require an OPTIONS preflight before the browser sends the actual request. For example, a request with an Authorization header normally triggers preflight. The server must approve the requested method and headers. S3 evaluates preflight against its configured CORS rules; OPTIONS itself is not an AllowedMethods entry in an S3 CORS rule. Requests that do not require preflight may reach the server even when the browser ultimately blocks response access.

Credentialed browser requests need particular care. If a cross-origin fetch uses credentials mode include, the response must identify the allowed origin explicitly and include Access-Control-Allow-Credentials: true; Access-Control-Allow-Origin: * is not valid for that credentialed response. Browser cookie restrictions, including SameSite and third-party-cookie controls, still apply. Never blindly reflect arbitrary Origin values while enabling credentials, because doing so can expose authenticated responses to hostile websites.

Cloud deployments often introduce separate frontend, API, and object-storage origins. Serving the frontend and routing API paths through one public origin can reduce CORS complexity, although it adds routing and caching responsibilities. When using Amazon CloudFront, configure response headers consistently and forward the Origin and preflight request headers when the backend needs them. If responses vary by requesting origin or preflight parameters, configure the cache key accordingly or avoid caching those responses. Do not assume Vary alone configures CloudFront's cache key.

For troubleshooting, inspect the browser's network panel for the Origin header, any OPTIONS exchange, and the actual response headers and status. A backend authorization failure can appear to JavaScript as a CORS error if the error response lacks suitable CORS headers. Successful curl requests do not prove that browser access will work, because curl does not enforce the Same-Origin Policy.

The policy and CORS are not substitutes for IAM permissions, bucket policies, API authorization, or CSRF defenses. A private S3 object remains private when CORS permits an origin. AWS WAF can filter application attacks, Shield Advanced addresses DDoS protection, and AWS IoT policies authorize supported device actions; none implements the browser's same-origin boundary. Likewise, the Same-Origin Policy does not stop same-origin malicious scripts introduced through cross-site scripting. Use output encoding and a carefully designed Content Security Policy alongside these controls.