IPFYI
RFC 6454 Proposed Standard

The Web Origin Concept

A. Barth · 2011-12

Abstract

This document defines the concept of an 'origin', which is often used as the scope of authority or privilege by user agents. Typically, user agents isolate content retrieved from different origins to prevent malicious web site operators from interfering with the operation of benign web sites. In addition, this document defines how to serialize an origin into a string.

Why This RFC Matters

RFC 6454 formally specified the Same-Origin Policy concept that browsers have relied on since Netscape Navigator 2.0, providing a precise and implementable definition of what constitutes an 'origin' (scheme + host + port) and how origins should be compared. This formalization was essential for building secure web applications and served as the foundation for Cross-Origin Resource Sharing (CORS, RFC 6454-adjacent), Content Security Policy, and the Fetch standard. Every modern browser and web security model depends on the origin tuple defined here to isolate untrusted content and prevent cross-site scripting and request forgery attacks.

관련 프로토콜

HTTPS HTTP

관련 용어

ssl-tls authentication firewall hsts

Security에서 더 보기

RFC 2404 The Use of HMAC-SHA-1-96 within ESP and AH RFC 3602 The AES-CBC Cipher Algorithm and Its Use with IPsec RFC 4253 The Secure Shell (SSH) Transport Layer Protocol RFC 4254 The Secure Shell (SSH) Connection Protocol RFC 4301 Security Architecture for the Internet Protocol RFC 5246 The Transport Layer Security (TLS) Protocol Version 1.2 RFC 5280 Internet X.509 Public Key Infrastructure Certificate and CRL Profile RFC 6125 Representation and Verification of Domain-Based Application Service Identity within Internet Public Key Infrastructure Using X.509 (PKIX) Certificates in the Context of Transport Layer Security (TLS)