The Boundary That Holds the Web Together

If the browser will happily send a cross-origin request with the user's cookies attached, in what sense is the origin a security boundary at all?

An origin is the triple of scheme, host and port. Two documents share an origin only when all three match, and that comparison decides whether one may script the other, read its storage, or read the bytes of its responses. Everything else on the platform is layered on top of that single comparison.

The policy was never a restriction on *sending*. The web is built on cross-origin embedding: images, scripts, stylesheets, iframes and form submissions all cross origins by design, and removing that would remove the web. The boundary sits at readability instead, which is a narrower and stranger guarantee than most developers assume.

Finding 1. CORS relaxes the policy, it does not impose it. Developers routinely describe CORS as the thing blocking them. The block predates CORS by a decade; CORS is the server's mechanism for lifting it for named origins.

Finding 2. Cookies are a second, older axis. Ambient authority means a request carries credentials regardless of who initiated it. SameSite retrofits intent onto that model, and the ongoing removal of third-party cookies is the platform conceding that the original design cannot be secured by policy alone.

Finding 3. Embedding leaked more than anyone planned. Response sizes, load timings, and error behaviour are all observable across origins, which is why Cross-Origin Read Blocking, Cross-Origin-Resource-Policy and cross-origin isolation exist. Spectre turned a theoretical side channel into a reason to re-architect process isolation.

Finding 4. Most real breaches sidestep the boundary entirely. Cross-site scripting wins because injected code runs *inside* the origin, where the policy grants it everything. This is why Content-Security-Policy, trusted types and output encoding matter more to most applications than any CORS configuration.

The useful mental model is not a wall but a membrane: things pass through it constantly, and the rule governs what may be observed on the far side. Security work on the web is mostly about who is allowed to run code inside a given origin, and what that code can then reach.

This dossier describes the model, not any particular implementation. Browsers differ in their heuristics for private network access, opaque responses and storage partitioning, and the third-party cookie timeline has moved repeatedly. Treat the mechanism as stable and the specifics as perishable.