Compare all three parts
03Two triple origins match only when their schemes, hosts and ports are all identical. A parent domain or matching page path is insufficient.
Compare the reference with https://example.com/. The scheme and effective port differ. Isolating HTTP from HTTPS helps contain active network attackers.
Source for this drawing: RFC 6454 · Read RFC section 5 ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
A single different component makes the origins different.
- http://example.com/ and http://example.com:80/path/file have the same origin, as in §3.2.1.
- http://example.com:8080/ differs by port. http://www.example.com/ differs by host. https://example.com/ differs by scheme and default port.
- Use the fully qualified host, not just a registrable or top-level domain. Same-origin comparison is not the same as a same-site cookie decision.
Each step is an independent comparison with http://example.com/. A different origin means restrictions depend on the particular API; this comparison alone neither blocks every request nor grants server-side authorization.
Read the RFC section ↗