Same-origin policy nuances

Summary

Origin = scheme + host + port. Documents iframes cross-origin can't read DOM; postMessage with origin check for communication. CORS relaxes reading cross-origin responses, not sending. Cookies scoped by domain/path/SameSite — different from SOP. document.domain is legacy — don't use.

Code example

iframe.contentWindow.postMessage({ type: 'PING' }, 'https://trusted.example.com');

window.addEventListener('message', (event) => {
  if (event.origin !== 'https://trusted.example.com') return;
  handleMessage(event.data);
});

Key points

• Origin = scheme + host + port.
• Documents iframes cross-origin can't read DOM; postMessage with origin check for communication.
• CORS relaxes reading cross-origin responses, not sending.
• Cookies scoped by domain/path/SameSite — different from SOP.
• document.domain is legacy — don't use.

Further reading

• Same-origin policy
• Window.postMessage

Related concepts

• Prototype pollution
• Service Worker lifecycle traps