Separate isolation from permission
07Different origins restrict many reads and object accesses, but do not mean every cross-origin request is blocked. Trusted imports and injected scripts can carry the document’s authority.
Separate cross-site scripting example: attacker code injected into an HTML document runs with that document’s origin authority. The boundary remains in place but does not isolate the injected script from the document.
Source for this drawing: RFC 6454 · Read RFC section 3.4 ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
Isolation is one part of security; it is not a substitute for server-side defenses.
- Many object accesses and cross-origin reads are restricted; limited exceptions and controlled opt-ins exist. Some cross-origin sends and embeddings are permitted, so preventing a read does not prevent every request or CSRF attack.
- The origin concept depends on naming and protocol security. HTTPS certificate verification helps resist DNS compromise; dropping the scheme or using only a registry-controlled domain weakens boundaries.
- Cookies may use different isolation units. Imported or injected active script can inherit a document’s authority, so origin grouping does not remove cross-site scripting risks. Media-type confusion and IDNA changes can also redraw trust boundaries.
The scenes distinguish read blocking, sending, and authority delegation; they are separate examples, not a complete CORS, cookie, CSP, TLS, HTML or CSRF implementation. No universal allowlist, authentication guarantee or current browser support claim follows from an Origin string.
Read the RFC section ↗