What is the Same-Origin Policy?
PICTURE THIS: DOM IS A TREE
Simple meaning
A page can freely read data only from the same scheme, host, and port.
WHY — Browser instead of guessing?
Why interviewers care about Browser:
who only read docs from people who shipped.
and tied to Frontend work.
Name the idea, why it exists, then one short example.
End with when you use it and one common pitfall.
STEPS — What happens step by step?
Before you speak the answer, walk the interviewer through these steps:
- 1A page can freely
read data only from the same scheme, host, and port.
- 2It is why document.cookie
from another origin is blocked and why we need CORS for APIs.
- 3Opening a child window
does not give you its DOM if origins differ.
- 4Give an example
One tiny concrete case you can say aloud.
- 5Common mistake
What juniors usually get wrong.
- 6Close
When you pick this over the alternative.
EXAMPLE — See it in action
Here's a short line you can speak, broken into clear beats:
Note: Adapt this scaffold to your own project — keep it under 60–90 seconds.
Key takeaway
A page can freely read data only from the same scheme, host, and port. It is why document.cookie from another origin is blocked and why we need CORS for APIs.