Whose page is this? (the browser security model)

The places a website reads a stranger’s words. Every defence on its checklist (SameSite, HttpOnly, “check Origin”, a rule saying who may frame the page) is a rule the browser enforces, and this lesson is where those rules come from.

Before you start. Authentication gave you the session: after you log in, the site hands your browser a small pass (a cookie), and the browser shows it on every later request so the site knows it is still you. What a request actually says (HTTP) showed you what a request looks like on the wire, headers and all. This lesson explains why the browser, and not the server, decides which page gets to see what.

The idea in 30 seconds

An origin is a page’s scheme, host and port together; change any one and it is a different origin, even on the same machine.
The same-origin policy stops a page reading replies from another origin. It does not stop the request being sent, so a cross-origin request can still change things on the server.
CORS is a server writing on its reply which other origins may read it. It relaxes the browser’s rule; it never protects the server, which answered anyway.
For requests a plain form could not send, such as JSON bodies or DELETE, the browser asks first with an OPTIONS preflight, and sends nothing more if the answer is no.
Secure keeps a cookie off plain http, HttpOnly keeps it away from the page’s scripts, and SameSite keeps it off requests another site started.
Clickjacking hides a real page in an invisible frame under a fake button; the real page defends itself by refusing to be framed.

Read the story · Skip to the numbers