Top "Same-origin-policy" questions

The same origin policy, which is enforced by Web browsers, limits JavaScript in a document loaded from one origin from accessing data from another origin.

Is it possible to use HTML5 local storage to share data between pages from different sites?

I would like to create data on the user side and let javascript from another URL access it too. I …

javascript html local-storage same-origin-policy
Can a JavaScript hosted on different domain read/modify DOM of another domain?

I have a question regarding a potential security issue/limitation regarding JavaScript hosted on a domain (ex: domain of a …

javascript security xss same-origin-policy
Embedding Google Apps Script in an iFrame

I am trying to embed a page that is dynamically built using Javascript in Google Apps Script into my website …

javascript google-apps-script iframe web-applications same-origin-policy
Why Same-origin policy isn't enough to prevent CSRF attacks?

First of all, I assume a backend that control inputs to prevent XSS vulnerabilities. In this answer @Les Hazlewood explain …

cookies jwt cross-domain csrf same-origin-policy
What can cause a cookie not to be set on the client?

I have a web application that uses jQuery.ajax to perform a request to another host (right now actually the …

ajax http cookies cross-domain same-origin-policy
Disable the Same Origin Policy / making cross domain XMLHttpRequests in WebKit WebViews?

I would like to disable the same origin policy on XMLHttpRequests in my own embedded WebViews. I have control over …

javascript webkit xmlhttprequest webview same-origin-policy
Blocked a frame with origin "http://localhost"

i have working on idx plugin for property search.its a http link given to search property but i want …

jquery html iframe same-origin-policy idx
When should I really set "Access-Control-Allow-Credentials" to "true" in my response headers?

MDN says, when the credentials like cookies, authorisation header or TLS client certificates has to be exchanged between sites Access-Control-Allow-Crendentials …

http cors httpresponse same-origin-policy fetch-api
How can I prevent an iframe from accessing parent frame?

I've got a page with an iframe. The page and the source of the iframe are in different domains. Inside …

javascript iframe parent same-origin-policy
JavaScript to detect if the parent frame is of the same origin?

I'm looking for a cross-browser way to detect whether the parent frame is the same origin as my frame, preferably …

javascript browser same-origin-policy