Same-Origin Policy (SOP)
SOP is a core browser security mechanism. It prevents scripts on domain A from reading data from domain B. Two URLs have the same origin if their protocol, host, and port are identical. SOP blocks malicious sites from reading your private session cookies or account details.
Cross-Origin Resource Sharing (CORS)
Sometimes, servers need to share APIs with other domains. CORS provides a secure opt-in. The server includes response headers allowing external domains to read its payloads.
HTTP Snippet
http
// Server response header allowing specific origins
Access-Control-Allow-Origin: https://app.example.com
Access-Control-Allow-Methods: GET, POST
Access-Control-Allow-Headers: Content-TypePreflight Requests
For requests with side effects (like POST or DELETE with custom headers), the browser sends an HTTP "OPTIONS" request (preflight) first. The server must approve the origin before the browser fires the actual payload request.