---
# System prepended metadata

title: Same Origin Policy
tags: [CORS, SOP]

---

# Same Origin Policy

browser usage policy

1. CORS doesnt protect the server infomation



```
    Access-Control-Allow-Origin: This header controls which other domains should be allowed to access the resources. This can be a wildcard (*) to allow all other origins to access the resources but you could also lock it down to specific domains.
    Access-Control-Allow-Methods: This header controls which Http methods are supported - methods not specified here will yield to CORS errors.
    Access-Control-Allow-Headers: This header controls which extra headers the client (!) may send with its request. If other headers are added, the request will lead to a CORS error response.
```

2.  CORS error and cant be fixed by adding headers to the client-side request:
As written and explained above: The CORS headers need to be added to the response sent by the backend, not to the request sent by the client! cors 非設置在client request端,而是server回傳的response為了client web可使用
=> request 設置cors header無益於cors使用

As mentioned earlier: If you don't have access to the code behind an API that's giving you a CORS error, you'll have no way of fixing it. That API doesn't want you to send requests - it's as easy as that.

![](https://i.imgur.com/TeygfYF.png)

![](https://i.imgur.com/ghXy0Qc.png)


![](https://i.imgur.com/PfcINVS.png)

same origin => browser implement website protection



![](https://i.imgur.com/SUGzfTm.png)

![](https://i.imgur.com/CAu1OUl.png)

cross origin cant get the response
### anchor
![](https://i.imgur.com/A2ieYbE.png)

 response send to the new site(B), site(A) can't get the response
 
 ** the request can be sent to server, but the response will be blocked by browser.
=> the server should filter the malicious request. 

### form
![](https://i.imgur.com/IOHp7pW.png)

### script
![](https://i.imgur.com/JDJgvZp.png)

a. this is one type of XSS(cross-site scripting) or CSRF(cross-site request forgery) can happen

### jsonp: abuse  
![](https://i.imgur.com/TpGCovJ.png)


### web_storage

![](https://i.imgur.com/lVDm9Zx.png)

### cookie
:::info
![](https://i.imgur.com/kNWBzxm.png)
 by cookie jar, siteB send the request in siteA script (CSRF)
:::



![](https://i.imgur.com/WhyFnRD.png)

1. cookie broaden to parents/ subDomain 


![](https://i.imgur.com/YsknVjO.png)

![](https://i.imgur.com/T27gL6z.png)
** browser doesnt block request , only restrict the response send back to client

![](https://i.imgur.com/2urjFLz.png)


![](https://i.imgur.com/jA8GxcD.png)

![](https://i.imgur.com/fyA5Dvw.png)

![](https://i.imgur.com/hKIhmCR.png)
 
![](https://i.imgur.com/U0Jijxy.png)

request-> server -> response -> browser CORS policy determine show the response 

 ![](https://i.imgur.com/WLbItrX.png)
 
 
 ![](https://i.imgur.com/X8bjWFI.png)
 
 ![](https://i.imgur.com/61eQY0d.png)
 
 ![](https://i.imgur.com/FePsXCY.png)

![](https://i.imgur.com/9IM3SVL.png)

![](https://i.imgur.com/bn3jZuM.png)


###### tags: `CORS`,`SOP`













