To determine if JS can access a resource, which attributes must match?

To determine if JS can access a resource, which attributes must match?

• A. Hostname must match
• B. Protocol must match
• C. Hostname, port, and protocol must match
• D. All of the above

Answer: (C)

The same-origin policy governs whether JavaScript can access a resource, and the origin is defined by three parts: the protocol, the host (hostname), and the port. For a script to access a resource with no cross-origin restrictions, all three of these attributes must match between the page and the resource. That means the hostname must be the same, the protocol must be the same, and the port must be the same (keeping in mind that default ports count when not explicitly specified, e.g., http uses port 80, https uses 443). Because all three components must align, the option that lists hostname, port, and protocol must match is the correct one. If any of them differ, the browser treats the request as cross-origin and access is restricted unless the server explicitly allows it via CORS.

The same-origin policy governs whether JavaScript can access a resource, and the origin is defined by three parts: the protocol, the host (hostname), and the port. For a script to access a resource with no cross-origin restrictions, all three of these attributes must match between the page and the resource. That means the hostname must be the same, the protocol must be the same, and the port must be the same (keeping in mind that default ports count when not explicitly specified, e.g., http uses port 80, https uses 443). Because all three components must align, the option that lists hostname, port, and protocol must match is the correct one. If any of them differ, the browser treats the request as cross-origin and access is restricted unless the server explicitly allows it via CORS.