Commit f61029b

The same-origin policy (SOP) is one of the most important mechanisms for browser security. Despite its widespread adoption by modern browsers, many developers experience a difficulty understanding precisely what the SOP provides, how to bypass it when necessary, and what its security implications are.

This chapter is soemwhat different from other chapters in this book. Instead of building a working implementation of a browser with the same origin policy, our goal is to construct a concrete, executable _model_ that serves as a simple yet precise documentation of the SOP. Like an implementation, this model can be executed to explore dynamic behaviors of the system; but unlike an implementation, the model omits low-level details that often get in the way of understanding the essential core of the SOP.