Web and protocol foundations
URLs, origins and sites
Similar addresses can have different security boundaries.
Understand the concept
A URL contains a scheme, host, port, path and optional query. A fragment is not sent in the HTTP request; it is handled by the browser. Secrets in queries can leak into logs and history.
An origin combines scheme, host and effective port. app.example.test and api.example.test are distinct origins. Same-site is a different cookie-related concept involving registrable domains and scheme; same-site does not mean same-origin.
443 and 80 are default HTTPS and HTTP ports, not security guarantees. Encode individual URL components correctly; indiscriminately encoding a whole URL can alter the meaning of path and query separators.
To separate CORS failures from cookie-policy failures.
Assuming subdomains do not change origin.
One topic. Three levels of depth.
https://app.example.test:443/blog?q=http#headersThe query is sent; the fragment is not.
This page does not send requests to external servers. Messages are readable HTTP/1.1 illustrations, not HTTP/2 or HTTP/3 wire dumps. example.test is reserved for examples. Run commands and JavaScript only in your own test environment; never publish real tokens or cookies.
Try it yourself first.
Are localhost:3000 and localhost:5048 the same origin?
Show the solution and explanation
http://localhost:3000 ≠ http://localhost:5048No: their ports differ.