Origin

As explained in ASP.NET Core in Action, 3e

A web origin is the combination of a resource's scheme, domain, and port that determines its security boundary for browser access.

A web origin combines a resource’s scheme, domain, and port. Browsers use this combination as a security boundary when JavaScript requests another resource. section 29.3

Two URLs have the same origin only when all three parts match. Their paths may differ, so http://example.com/home and http://example.com/site.css remain same-origin. section 29.3

A URL becomes cross-origin when any required part changes:

• https://example.com uses a different scheme from http://example.com. section 29.3
• http://www.example.com uses a different domain, including a subdomain. section 29.3
• http://example.com:5000 uses a different port from HTTP’s default port 80. section 29.3

The browser’s same-origin policy blocks JavaScript from calling a different-origin API unless that API explicitly permits the request through CORS response headers. ASP.NET Core can define CORS policies globally or for selected endpoints. section 29.3 section 29.5

Shopping site and product API

An app at http://shopping.com requesting data from http://api.shopping.com is cross-origin because the domains differ. Without an appropriate CORS policy, the browser blocks the JavaScript request. section 29.3

Figure 29.6 The console log for a failed cross-origin request. Chrome has blocked a cross-origin request from the app http://shopping.com:6333 to the API at http://api.shopping.com:5111.

Inspect the browser console failure showing an app and API with different domains and ports. section 29.3

How ASP.NET Core in Action, 3e covers it

How deep it goes

Defines scheme, domain, and port with URL comparisons, then connects the boundary to CORS without detailing request headers.

Examples

Uses same-path and cross-origin URLs plus a shopping site calling a product API.

What it assumes

Assumes only familiarity with URLs, browsers, JavaScript requests, and web APIs.

What you can do after

Evaluate whether two URLs are same-origin and recognize when CORS configuration is required.

How it connects

Connects origins to the same-origin policy, CORS, browser security, and HTTP headers.

liveBookmanning.com

Read ASP.NET Core in Action, 3e on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Spring Security in Action, Second EditionAn origin is the scheme, host, and port tuple that identifies the security context of a web resource.
• 

  liveBookmanning.com
  Grokking Web Application SecurityA web origin is the combination of a resource's protocol, domain, and port that determines its browser security boundary.

Compare how 3 books explain origin →

Related concepts

• cross-origin policyconfigured by · The same-origin policy is a browser security restriction that limits scripts and documents from accessing resources associated with different origins unless explicitly permitted.
• domainhas part · A domain is a subject area or problem context with relevant concepts, rules, activities, and terminology that software represents or supports.
• local storageconfigured by · Local storage is a browser-provided, origin-scoped key-value storage mechanism that persistently stores string values across sessions.
• cross-origin requestcontrasts with · A cross-origin request is a network request from a webpage or script to a resource whose origin differs from the requester’s origin.

This explainer was generated by Manning's knowledge graph from the text of ASP.NET Core in Action, 3e. The section links point to the parts of the book it draws on.