RFC 6454 / START HERE
Web origins, before the details
The Web Origin Concept is a descriptive name, not an acronym. An origin is a security grouping used by a browser or other user agent.
A browser groups ordinary web addresses by scheme, full host name and port. This lets related pages work together while restricting many interactions with content from other origins.
Why it exists
RFC 6454 explains the principles behind these boundaries, computes and compares origins, serializes them into strings, and defines the HTTP Origin request field. It does not define every same-origin policy or all current browser API behavior.
A familiar example
A shop’s /menu and /cart can share an origin, while its payment subdomain has a different origin. A permitted request can still cross that boundary: origin isolation neither authenticates the customer nor replaces the payment server’s permission checks.
Helpful background
You can start here without reading another RFC. If these ideas are unfamiliar, these short introductions may help.
What you’ll learn next
Begin with chapter one, or choose a topic.
- Group resources, not pathsAn origin groups related addresses into a protection domain: a boundary used by the browser when deciding which content may interact.→
- Compute the origin tripleFor a supported HTTP or HTTPS URI, lowercase the scheme and host, use the explicit or default port, and keep those three values.→
- Compare all three partsTwo triple origins match only when their schemes, hosts and ports are all identical. A parent domain or matching page path is insufficient.→
- Keep unique origins distinctSome inputs receive a fresh unique origin rather than a triple. Turning that origin into the text null loses its identity.→
- Serialize without a pathSerialization turns an origin into text. Default ports disappear; non-default ports remain. ASCII and Unicode forms differ for international host labels.→
- Describe what caused a requestAn Origin request field describes the origin context that caused a request. It is not the destination URI, a username, or a standalone authorization decision.→
- Separate isolation from permissionDifferent origins restrict many reads and object accesses, but do not mean every cross-origin request is blocked. Trusted imports and injected scripts can carry the document’s authority.→
This introduction explains RFC 6454 (2011). Read the original RFC ↗