Skip to content
iframecheck

Origin

An origin is the scheme, host, and port of a URL. Two URLs have the same origin only when all three parts match.

Concept

Updated

On this page

How it works

The browser takes the origin from the URL of a page. For https://example.com:8080/app, the scheme is https, the host is example.com, and the port is 8080. The path /app is not part of the origin.

When a URL has no port, the browser uses the default port of the scheme. So http://example.com and http://example.com:80 have the same origin. Browsers use the origin for many security checks, such as the same-origin policy, CORS, and postMessage.

In an iframe

A page and its iframe can have different origins. Then a script in the page cannot read the content of the frame, and the frame cannot read the page. The two pages can send messages with postMessage and check event.origin.

The sandbox attribute without allow-same-origin gives the frame a special origin. This origin always fails the same-origin policy, even against the server that sent the page. The frame then often cannot use its cookies or storage.

Example

URLs
https://example.com/a  and  https://example.com/b       same origin
http://example.com     and  http://example.com:80       same origin
https://example.com    and  http://example.com          other scheme
https://example.com    and  https://www.example.com     other host
https://example.com    and  https://example.com:8080    other port

The path does not change the origin. Only the scheme, the host, and the port count.

How to use it

Read the origin in JavaScript. Compare the full origin string, not a part of the URL.

location.origin;
// "https://example.com"

new URL("https://example.com:8080/app").origin;
// "https://example.com:8080"

The origin string has no port when the URL uses the default port, for example 443 for https.

Learn more

Sources

Know before you embed.

Free, no sign-up, nothing stored. Paste a URL and get a verdict, a live preview, and the fix.

Test a URLBrowse guides