https://html.spec.whatwg.org/multipage/origin.html#origin

 

7.5 Origin

Origins are the fundamental currency of the web's security model. Two actors in the web platform that share an origin are assumed to trust each other and to have the same authority. Actors with differing origins are considered potentially hostile versus each other, and are isolated from each other to varying degrees.

For example, if Example Bank's web site, hosted at bank.example.com, tries to examine the DOM of Example Charity's web site, hosted at charity.example.org, a "SecurityError" DOMException will be raised.

---

An origin is one of the following:

An opaque origin

An internal value, with no serialization it can be recreated from (it is serialized as "null" per serialization of an origin), for which the only meaningful operation is testing for equality.

A tuple origin

A tuple consists of:

• A scheme (an ASCII string).
• A host (a host).
• A port (null or a 16-bit unsigned integer).
• A domain (null or a domain). Null unless stated otherwise.

Origins can be shared, e.g., among multiple Document objects. Furthermore, origins are generally immutable. Only the domain of a tuple origin can be changed, and only through the document.domain API.

The effective domain of an origin origin is computed as follows:

1. If origin is an opaque origin, then return null.

2. If origin's domain is non-null, then return origin's domain.

3. Return origin's host.

The serialization of an origin is the string obtained by applying the following algorithm to the given origin origin:

1. If origin is an opaque origin, then return "null".

2. Otherwise, let result be origin's scheme.

3. Append "://" to result.

4. Append origin's host, serialized, to result.

5. If origin's port is non-null, append a U+003A COLON character (:), and origin's port, serialized, to result.

6. Return result.

The serialization of ("https", "xn--maraa-rta.example", null, null) is "https://xn--maraa-rta.example".

There used to also be a Unicode serialization of an origin. However, it was never widely adopted.

---

Two origins, A and B, are said to be same origin if the following algorithm returns true:

1. If A and B are the same opaque origin, then return true.

2. If A and B are both tuple origins and their schemes, hosts, and port are identical, then return true.

3. Return false.

Two origins, A and B, are said to be same origin-domain if the following algorithm returns true:

1. If A and B are the same opaque origin, then return true.

2. If A and B are both tuple origins, run these substeps:

   1. If A and B's schemes are identical, and their domains are identical and non-null, then return true.

   2. Otherwise, if A and B are same origin and their domains are identical and null, then return true.

3. Return false.

A	B	same origin	same origin-domain
("https", "example.org", null, null)	("https", "example.org", null, null)	✅	✅
("https", "example.org", 314, null)	("https", "example.org", 420, null)	❌	❌
("https", "example.org", 314, "example.org")	("https", "example.org", 420, "example.org")	❌	✅
("https", "example.org", null, null)	("https", "example.org", null, "example.org")	✅	❌
("https", "example.org", null, "example.org")	("http", "example.org", null, "example.org")	❌	❌