Considering the origin of entities

Access to DOM elements is allowed only when the request scheme, hostname, and port number match those of the current URI. A subdomain cannot share DOM elements with the parent domain.

• Scheme in web applications is typically http:// or https://
• Hostname is typically the domain name plus TLD, or the unique IP address
• Port number:
  • Typically, port 80 is implicit in http://
  • 443 for SSL over https://

If the Scheme, Hostname, and port number do not match the DOM element, then resource sharing is prohibited as they do not share the same origin. Considering the domain http://www.example.com, the following table provides various combinations of matching and mismatching origins:

URI	Match?	Reason
http://www.example.com/dir1/page1.html	Match	Same protocol and host
http://username:[email protected]/dir2/otherpage.html	Match	Same protocol and host
http://example.com/dir/page1.html	Mismatch	Different host (www is a subdomain)
https://www.example.com/dir/page1html	Mismatch	Different protocol(https://)
http://www.example.com:81/dir/page1.html	Mismatch	Same protocol and host but different port (81)
http://en.example.com/dir/page1.html	Mismatch	Different host (en is a subdomain)

Internet Explorer exception policy

Internet Explorer (IE) implements two major differences when it comes to the same-origin policy:

• IE Trust Zones allow different domains: If both domains are in a highly trusted zone, then the same-origin policy limitations are not applied.
• Port is ignored: IE ignores the port in same origin components. These URIs are considered from the same origin:
  • http://www.example.com:80/dir/page1.html
  • http://www.example.com:81/dir/page1.html

    Tip

    These exceptions in Internet Explorer are non-standard and are not supported in other browsers. If an application is only viewed in Windows RT mobile or Internet Explorer, then these exceptions could be useful.