Web Resource - Origin

Javascript

You can get the origin value calculated by the browser

console.log('In this iframe, the `self.origin` value is '+self.origin);
console.log('In this iframe, the `window.origin` value is '+window.origin);
console.log('In this iframe, the `document.domain` domain has the `full qualified domain value (FQDN)` and is '+document.domain);

let pageUrl = new URL(parent.location.href)
console.log('In this iframe, the origin of the parent page is '+pageUrl.origin);
let ancestorsOrigins = location.ancestorOrigins;
console.log('In this iframe, the ancestors origin (all parent of parent) is '+location.ancestorOrigins[0].toString());

var frame = document.createElement("iframe")
frame.onload = function() {
  var frameWin = frame.contentWindow
  console.log(frameWin.location.origin) // "null"
  console.log(frameWin.origin) // "https://origin"
}
document.body.appendChild(frame)

Devtool

You can see how User agents categorize resource according to its “origin” with devtool and the Sources tab. URIs are grouped together into origins, which represent protection domains.

Is Equal

When each of the URIs has the same scheme, host, and port components, they are from the same-origin

Example: All of the following resources have the same origin

• http://example.com/
• http://example.com:80/
• http://example.com/path/file

Two origins are said to be the same origin if the algorithm returns true.

Is Not Equal

Each of the following resources has a different origin from the others. In each case, at least one of the scheme, host, and port component will differ from the others in the list.

• http://example.com/
• http://example.com:8080/
• http://www.example.com/
• https://example.com:80/
• https://example.com/
• http://example.org/
• http://ietf.org/

Authority

The privilege is mostly known as the authority (not to confound with authority of the URI. authority in the context of web security is a privilege that is granted or not by the user agent (browser).

Active content resources are granted the origin's full authority, whereas passive content are not.

User agents determine how much authority to grant a resource by examining its media type.

Ref

Same-origin

same-origin policy

• Two actors that share an origin are assumed to trust each other and to have the same authority.
• Actors with differing origins are considered potentially hostile versus each other, and are isolated from each other to varying degrees.

user agents isolate content retrieved from different origins and permit controlled communication between origins.

• user agents allow content retrieved from one origin to interact freely with other content retrieved from that origin,
• user agents restrict how that content can interact with content from another origin. implementation are application specific and are then defined in HTML and WebSockets RFC6455.