same-origin policy
termweb devsecurity
The browser rule that script from one site cannot read responses from another, where a site means scheme, host and port together.
It is the foundation the entire web security model rests on: without it, any page could read your mail by requesting it with your cookies attached. Everything that looks like an exception is a deliberate opening of it - CORS is a server saying who may read its responses, and a cross-site scripting flaw matters precisely because injected code runs as the origin and the policy therefore protects the attacker.
Also known as: sop