What does the same-origin policy primarily restrict?

Question

Accepted Answer

Scripts reading data from another origin — it blocks cross-origin access to responses and the DOM — SOP restricts one origin's script from reading another origin's data (responses, DOM, cookies). It does not stop requests from being sent (that is why CSRF works), does not block navigation, and is enforced by the browser, not the server.

Answer

Servers accepting requests from another origin — it rejects any inbound cross-site traffic

Answer

Browsers sending any request to another origin — it stops all cross-origin network calls

Answer

Users navigating links to another origin — it confines browsing to the initial site only

What does the same-origin policy primarily restrict?

Why this is the answer

More Web Security flashcards