Until now I though same-origin policy applied to AJAX requests using either fetch or xmlHttpRequest, but I just learned that media objects also use this policy.

Are there other things that use the same-origin policy? Might it be better to think of it as "Anything but script tags use same-origin policy"?

1 Answer 1


Are there other things that use the same-origin policy?

All cross-origin access is subject to the same-origin policy. But there isn't one single rule that is equally applied to all methods of interaction. You might find the distinction betwen cross-origin writes, reads and embedding useful.

Cross-origin network access

The same-origin policy controls interactions between two different origins, such as when you use XMLHttpRequest or an <img> element. These interactions are typically placed in three categories:

  • Cross-origin writes are typically allowed. Examples are links, redirects and form submissions. Certain rarely used HTTP requests require preflight.
  • Cross-origin embedding is typically allowed. Examples are listed below.
  • Cross-origin reads are typically not allowed, but read access is often leaked by embedding. For example you can read the width and height of an embedded image, the actions of an embedded script, or the availability of an embedded resource.

Here are some examples of resources which may be embedded cross-origin:

  • JavaScript with <script src="..."></script>. Error messages for syntax errors are only available for same-origin scripts.
  • CSS with <link rel="stylesheet" href="...">. Due to the relaxed syntax rules of CSS, cross-origin CSS requires a correct Content-Type header. [...]


Cross-origin embedding is the most awkward interaction to control. You want to keep the origins separate but you also want to give the users a seamless browsing experience. That's why embedded cross-origin images inevitably leak their dimensions and cross-origin frames are potentially vulnerable to clickjacking.

Might it be better to think of it as "Anything but script tags use same-origin policy"?

As you can see, the same-origin policy also applies to scripts. A document can embed a cross-origin script and work with its global functions and variables but it cannot read the entire source code of the script or catch its errors. The ability to embed cross-origin scripts and stylesheets has given birth to vulnerabilities like cross-site script inclusion (XSSI).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .