What Is an Origin? Scheme, Host, Port and Site
By Ankit Jain · Updated
Compare origins precisely, understand localhost mismatches, and separate same-origin checks from cookie same-site rules.
An origin is a URL’s scheme, hostname, and effective port. Paths, query strings, and fragments do not change it.
Compare with https://app.example.com
| URL | Same origin? | Why |
|---|---|---|
| https://app.example.com/settings | Yes | Only the path differs |
| https://app.example.com:443/ | Yes | 443 is HTTPS’s default port |
| http://app.example.com/ | No | Scheme differs |
| https://api.example.com/ | No | Host differs |
| https://app.example.com:8443/ | No | Port differs |
http://localhost:3000 also differs from http://localhost:5173 and http://127.0.0.1:3000. Put the frontend’s actual origin in your API allowlist.
new URL('https://app.example.com/settings?q=1').origin
// "https://app.example.com"Origin is not site
Cookie same-site rules use a different boundary: broadly, the scheme and registrable domain. Two HTTPS subdomains can be same-site while still being cross-origin. That means they can need CORS even when SameSite does not prevent their cookies. Cookie domain, path, and other restrictions still apply.
Why Origin can be null
Some documents have opaque origins, including certain sandboxed frames and file contexts. Their request Origin can serialize to null. It is not one trusted website. Do not broadly allow null for a sensitive API. Serve local development pages through an HTTP development server so they have an ordinary origin.
Next: same-origin policy. If a request fails, compare the exact origins.