Group resources, not paths
01An origin groups related addresses into a protection domain: a boundary used by the browser when deciding which content may interact.
A classic script fetched from https://tools.example/library.js executes with the importing document’s privileges. The script’s download address does not sandbox it into tools.example.
Source for this drawing: RFC 6454 · Read RFC section 3.2 ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
Paths do not separate origins; the scheme, full host and port do.
- RFC 6454 groups URIs by origin so an application can use several resources without treating every path as a separate principal.
- An HTML document carries its origin’s authority. A passive image does not receive the same authority just because its URI shares that origin.
- A classic script imported by a document executes with the document’s privileges, including when fetched from a different origin. Choosing an import is a trust decision.
These are security-model examples from §§3.1–3.4, not a complete current HTML policy. URI means Uniform Resource Identifier: an address or name. Origin is not an acronym. Same-origin does not establish that a document or its authors are trustworthy.
Read the RFC section ↗