Same-Origin Policy

Overview

The same-origin policy (SOP) permits scripts contained in one web page to access data in another provided both have the same origin. An origin is defined as a combination of URI scheme, host, and port.

CORS

Cross-origin resource sharing (CORS) is a mechanism to safely bypass the SOP. A CORS-compatible browser can make cross-origin requests with headers indicating the type of request being made. The server then responds, indicating whether or not such an operation is permitted.

Preflight Requests

For non-"simple" requests, the CORS standard mandates the sending of a preflight request. This is an HTTP OPTIONS request with headers detailing the type of request to be made (e.g. Access-Control-Request-Method). Depending on the headers found in the server's response (e.g. Access-Control-Allow-Methods), the browser can then intiate the actual request.