FrontendHaltBrowser internals·Intermediate·Conceptual·1 min read
What does the same-origin policy actually restrict?
Short interview answer
It restricts a document's script from reading data from a different origin — a different scheme, host, or port — by default. It does not by itself prevent a request from being sent; many cross-origin requests still leave the browser and reach the server.
Key takeaway
Explain the underlying mental model clearly, then support it with a concrete example and its trade-offs.