`
`JavaScript Security: Same Origin
`
`You are currently viewing a snapshot of www.mozilla.org taken
`on April 21, 2008. Most of this content is highly out of date
`(some pages haven't been updated since the project began in
`1998) and exists for historical purposes only. If there are any
`pages on this archive site that you think should be added back
`to www.mozilla.org, please file a bug .
`
`Mozilla
`
`• About
`• Developers
`• Store
`• Support
`• Products
`
`search mozilla:
`
`- , ~
`The Same Origin Policy
`
`Page Maintained by .Jesse Ruderman (mailto:jruderman@hmc.edu)
`
`The same origin policy prevents document or script loaded from one origin from getting or
`setting properties of a document from a different origin. The policy dates from Netscape
`Navigator 2.0.
`
`Mozilla considers two pages to have the same origin if the protocol, port (if given), and
`host are the same for both pages. To illustrate, this table gives examples of origin
`comparisons to the URL http:/ /store.company.com/dir/page.html.
`
`URL
`
`https://store.company.com/secure.html
`
`Outcome Reason
`Success
`http://store.company.com/dir2/other.html
`http://store.company.com/dir/inner/another.html Success
`Failure
`Failure
`Failure
`
`http://store.company.com:81/dir/etc.html
`
`http://news.company.com/dir/other.html
`
`Different protocol
`Different port
`Different host
`
`There is one exception to the same origin rule. A script can set the value of
`document. domain to a suffix of the current domain. If it does so, the shorter domain is used
`for subsequent origin checks. For example, assume a script in the document at
`http: I /store. company. com/dir/other. html executes this statement:
`
`http://www-archive.mozilla.org/projects/security/components/same-origin.html
`
`1/2
`
`PALO ALTO NETWORKS Exhibit 1054 Page 1
`
`
`
`3/13/2015
`document.domain = "company.com";
`
`JavaScript Security: Same Origin
`
`After execution of that statement, the page would pass the origin check with
`http://company.com/dir/page.html.
`
`However, using the same reasoning, company. com could NOT set document . domain to
`othercompany.com.
`
`• Site Map
`• Security Updates
`• Contact Us
`• Donate
`
`Portions of this content are© 1998-2009 by individual mozilla.org contributors; content
`available under a Creative Commons license I Details .
`
`Last modified August 24, 2001 Document History
`
`http://www-archive.mozilla.org/projects/security/components/same-origin.html
`
`2/2
`
`PALO ALTO NETWORKS Exhibit 1054 Page 2