What Is the Same Origin Policy?

Same Origin Policy (SOP) is a security device for certain types of browser applications on the Internet. When using a computer on a large-scale network like the Internet, the possibility of suffering attack from hackers and other malicious entities is drastically increased compared to working on smaller, isolated networks. Same origin policy acts to validate scripts running on websites, preventing hackers from establishing a connection with a computer under fraudulent parameters. Scripts are simply programs or applications that the website requires to operate.

When connecting to a website, the connection occurs through "ports" on the computer. The name is fairly descriptive; ports are either open or closed depending on circumstance, with only open ports being vulnerable to attack. When a website requests a specific port connection to the computer, it exposes the computer to a degree of risk. So long as the port remains open, other individuals and programs online can attempt to "plug in" to the computer through the vulnerability. Other individuals and programs can also try posing as the website, requesting the computer to open other ports as well.

That is where same origin policy steps in. Think of same origin policy as a type of constant virtual interrogation between the website requesting the opened port and a computer. The website must constantly "prove" that it is who and what it says it is, preventing others from jumping in and taking advantage of the open connection on the computer. Same origin policy permits the running of scripts only so long as they originate from the intended website, satisfying the "questions" posed by SOP.

To verify this, same origin policy checks three things: the domain name, the application layer protocol, and the specific port numbers of the document or website running the script. The domain name is the specific name of the website. It is usually preceded by the prefix "www." The application layer protocol is the connection method; for example, HyperText Transfer Protocol (HTTP) or File Transfer Protocol (FTP). Finally, the port number is the specific number of the port through which the connection takes place. If these three things check out, the script runs; otherwise, SOP prevents it from operating.

Like anything involving computers, SOP is not infallible. Certain types of hacking attacks such as Domain Name Server Rebinding and proxies will allow a fraudulent site to pose as a legitimate one. That is why SOP should only be considered one line of defense against threats online.