Definition
The Same-Origin Policy (SOP) is a fundamental security mechanism in web browsers that restricts how a document or script loaded from one origin can interact with resources from another origin. An origin is defined by the combination of protocol, hostname, and port. In practice, this means JavaScript code running on a webpage can only access data and manipulate elements of the same origin from which it was loaded, preventing malicious scripts from reading sensitive information from other websites. This policy is crucial for protecting users from cross-site scripting (XSS) attacks and other forms of unauthorized data access. For example, a script on `www.example.com` cannot directly make an AJAX request to `www.another-site.com` to read its content. It is often confused with CORS (Cross-Origin Resource Sharing), which is a mechanism that allows servers to explicitly permit cross-origin requests. The Same-Origin Policy is a core concept tested on security certifications like CompTIA Security+ and CISSP.