Origin (Scheme, Host, Port)

TL;DR: An origin is scheme + host + port. The browser compares origins to decide what one page may read from another, and sends the Origin header so servers can do the same.

An origin is the tuple of scheme, host and port taken from a URL. Browsers use it as the unit of trust for the same-origin policy: script running on one origin may send requests to another origin, but may not read the response unless that origin opts in through CORS.

Comparing origins

Against https://app.example.com (port 443 implied):

URL	Same origin?	Why
https://app.example.com/other/page	Yes	Path is not part of an origin
https://app.example.com:443/	Yes	443 is the default for https
http://app.example.com/	No	Scheme differs
https://api.example.com/	No	Host differs
https://app.example.com:8443/	No	Port differs

What it looks like on the wire

A cross-origin fetch from https://app.example.com sends:

GET /v1/orders HTTP/1.1
Host: api.example.com
Origin: https://app.example.com

The server answers with Access-Control-Allow-Origin: https://app.example.com or the browser blocks script access to the response. The Origin value has no path and no trailing slash.

Things that trip people up

• localhost:3000 and localhost:8080 are different origins. This is the usual cause of a CORS error in local development.
• Origin is not site. app.example.com and api.example.com are cross-origin but same-site. CORS follows origin; SameSite cookies follow site. See Same-Site vs Same-Origin.
• “Origin server” is a different use of the word. In RFC 9110 it means the server that holds the authoritative copy of a resource, as opposed to a proxy or cache.
• Origin is not sent on every request. Browsers send it on cross-origin requests and on same-origin requests that are not GET or HEAD, so its absence on a plain same-origin GET is normal.

Go deeper

• Origin header
• Access-Control-Allow-Origin
• CORS guide
• CORS error: no Access-Control-Allow-Origin header