What is the critical point of web application security described by the Same Origin Policy?

• A. It prevents cross-origin resource sharing
• B. It prevents JavaScript from getting or setting properties on a resource coming from a different origin
• C. It prohibits any cross-origin requests
• D. It blocks all cookies from different origins

Answer: (B)

Same Origin Policy exists to stop code running on one site from reading or altering data on another site in the same browser. The important rule is that an origin is defined by the combination of scheme, host, and port, and JavaScript from one origin cannot access the properties of a resource that comes from a different origin. This safeguards user data by preventing cross-origin data leaks or tampering through client-side scripts. It does allow cross-origin requests to be made in some cases (for example, images or requests allowed by CORS), but the response content isn’t readable by the requesting script unless the target server explicitly permits it. That restriction—preventing JavaScript from getting or setting properties on a resource from a different origin—captures the core behavior described by the Same Origin Policy.