Origin
A web origin is the security identity defined by a resource's scheme, host, and port.
ASP.NET Core in Action, 3e
A web origin is the combination of a resource's scheme, domain, and port that determines its security boundary for browser access.
- How it is used
- Explains when browser JavaScript may access resources and when an API must explicitly allow cross-origin requests.
- How deep it goes
- Defines scheme, domain, and port with URL comparisons, then connects the boundary to CORS without detailing request headers.
- Examples
- Uses same-path and cross-origin URLs plus a shopping site calling a product API.
- What you can do after
- Evaluate whether two URLs are same-origin and recognize when CORS configuration is required.
Spring Security in Action, Second Edition
An origin is the scheme, host, and port tuple that identifies the security context of a web resource.
- How it is used
- Governs whether browsers accept responses to requests made between different web origins.
- How deep it goes
- Explains origin-based browser enforcement and simple versus preflighted requests, but does not detail origin parsing internals.
- Examples
- Uses localhost versus 127.0.0.1, XMLHttpRequest, Access-Control-Allow-Origin, and a Spring controller endpoint.
- What you can do after
- Evaluate why a browser blocks a response and identify which origin a CORS policy must permit.
Read how Spring Security in Action, Second Edition explains origin →
Grokking Web Application Security
A web origin is the combination of a resource's protocol, domain, and port that determines its browser security boundary.
- How it is used
- Defines the browser boundary for window interaction, JavaScript reads, and WebStorage access.
- How deep it goes
- Defines protocol-domain-port matching and applies it to windows, requests, CORS headers, and storage isolation.
- Examples
- Compares example URLs and uses Fetch, XMLHttpRequest, CORS headers, and a localStorage shopping cart.
- What you can do after
- Operate/configure cross-origin data access by recognizing origin mismatches and limiting CORS permissions to trusted origins.
Read how Grokking Web Application Security explains origin →
Related concepts
- cross-origin policyconfigured by · The same-origin policy is a browser security restriction that limits scripts and documents from accessing resources associated with different origins unless explicitly permitted.
- domainhas part · A domain is a subject area or problem context with relevant concepts, rules, activities, and terminology that software represents or supports.
- local storageconfigured by · Local storage is a browser-provided, origin-scoped key-value storage mechanism that persistently stores string values across sessions.
- cross-origin requestcontrasts with · A cross-origin request is a network request from a webpage or script to a resource whose origin differs from the requester’s origin.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.