Cybersecurity glossary
What is an Origin?
Learn what an origin is in web security—the scheme, host, and port tuple browsers use for same-origin checks—and how it differs from the Same-Origin Policy and CDN origin servers.
Definition
An origin is the security principal browsers derive from a URL’s scheme, host, and port. Two URLs share an origin only when all three match; origins define the boundary for cookies, storage, and most cross-document access rules enforced by the Same-Origin Policy.
Why the origin concept matters
Every tab in a browser may hold sessions for email, banking, and internal tools at once. The web needs a crisp answer to “who is this document?” That answer is the origin—not the company name, not the page path, but the scheme, host, and port extracted from the URL.
Origins are the currency of browser security. Cookies scope to them, localStorage partitions by them, and the Same-Origin Policy compares them before allowing cross-document access.
How browsers derive an origin
Parse the URL
Extract scheme (https), host (www.example.com), and port (explicit or default).
Normalize the tuple
Apply spec rules for default ports, IDNA/punycode hosts, and IPv6 literals.
Assign an origin
The tuple becomes the document’s security principal for SOP, cookies, and storage.
Compare on access
Before cross-origin reads, the browser checks whether source and target origins match.
Apply policy
SOP blocks or allows; CORS and other opt-in mechanisms may relax read restrictions.
Isolate sensitive contexts
COOP, COEP, and sandbox flags further segment browsing contexts beyond basic origin equality.
Origin components
Scheme
https vs http are different origins. Mixed scheme always means cross-origin.
Host
Includes subdomains. app.example.com and api.example.com are distinct origins.
Port
Non-default ports create separate origins even when scheme and host match.
Opaque origin
Special sandboxed or non-network contexts with restricted cross-origin privileges.
Origin vs Same-Origin Policy vs origin server
| Term | Meaning | Context |
|---|---|---|
| Origin | Scheme + host + port security identity of a URL | Browser security, cookies, storage, SOP comparisons |
| Same-Origin Policy (SOP) | Rule that blocks most cross-origin reads unless explicitly allowed | Uses origin equality; see /glossary/same-origin-policy-sop |
| Origin server | Authoritative backend a CDN or proxy fetches from | CDN/infrastructure; see /glossary/origin-server |
| Site (first-party set) | Broader registrable domain grouping used by some privacy features | Related but not identical to per-URL origin |
Practical origin checklist
- Treat different subdomains as different origins for cookies, storage, and postMessage unless you have an explicit, reviewed sharing design.
- Do not confuse browser origins with CDN ‘origin server’ hostnames—they solve different problems.
- Scope authentication cookies with appropriate Domain, Path, Secure, HttpOnly, and SameSite attributes per origin.
- Use CORS deliberately when one origin must read another’s API responses; SOP blocks by default.
- Avoid deprecated document.domain relaxation; prefer postMessage and explicit CORS.
- Test micro-frontends and iframe embeds for accidental cross-origin data leaks.
- Document which origins own which OAuth redirect URIs and CSP report endpoints.
- Plan staging vs production as separate origins; never share live session cookies across them unintentionally.
Limits and pitfalls
Path and query string are not part of the origin. https://example.com/a and https://example.com/b share an origin and therefore share cookies and storage for that host.
Site (eTLD+1) is a privacy concept used by third-party cookie partitioning—it is not the same as origin. Two subdomains on the same site remain different origins under SOP.
Infrastructure teams saying “hit the origin” mean the backend server. Security reviews asking “what’s the origin?” mean the browser tuple. Mixing the terms causes confused threat models.
The practical takeaway
An origin is the browser’s security identity for a URL: scheme, host, and port. It is the input to the Same-Origin Policy, not the policy itself, and not the CDN origin server that serves your files.
Get origins right in architecture reviews—cookie scope, CORS, iframe embedding, and OAuth redirects all depend on exact tuple matching. Assume different subdomains are different security principals until you prove otherwise.
Related security terms
Same-Origin Policy (SOP)
The browser rule that uses origins to restrict cross-origin reads and DOM access.
Cross-Origin Resource Sharing (CORS)
The mechanism servers use to opt into cross-origin response reads.
Cross-Site Request Forgery (CSRF)
A threat that persists because browsers still send cookies on cross-origin requests.
Origin Server
Infrastructure term for the authoritative backend behind a CDN—not the browser security origin.
Frequently asked questions
What is an origin in web security?
An origin is the combination of URL scheme (https), host (example.com), and port (443 by default). Browsers use it as the unit of trust for cookies, storage, and most isolation decisions.
How is an origin different from the Same-Origin Policy?
The origin is the identity tuple (scheme, host, port). The Same-Origin Policy (SOP) is the rule that compares origins and blocks most cross-origin reads unless CORS or another mechanism allows them.
Are https://app.example.com and https://api.example.com the same origin?
No. Different hosts mean different origins, even on the same registrable domain. They do not share cookies or DOM access under default SOP rules.
Is an origin the same as an origin server?
No. In CDN terminology, an origin server is the backend your edge fetches from. In browser security, an origin is the scheme-host-port identity of a URL, regardless of which physical server serves it.
What is a null or opaque origin?
Sandboxed iframes, data: URLs, and some file contexts receive special opaque origins that cannot access other origins’ data and have restricted privileges.
Does changing the port change the origin?
Yes. https://example.com:443 and https://example.com:8443 are different origins unless the port is the default for the scheme and omitted from comparison per spec rules.
References
Explore authoritative guidance and frameworks related to origin.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.