Browser Trust Boundaries

A failed CORS check replaces the server's response with a network error before script sees it - type "error", status 0, an empty header list, a null body - so the call rejects with a bare TypeError that carries no protocol detail at all.

A CORS-preflight request: method OPTIONS, the calling page's Origin, Access-Control-Request-Method naming the method the real call will use, Access-Control-Request-Headers listing any CORS-unsafe request-header names, and Accept: /. It carries no body.

Access-Control-Expose-Headers, sent by the server on that response, names the extra fields script may read. Without it a cross-origin caller sees only seven names: Cache-Control, Content-Language, Content-Length, Content-Type, Expires, Last-Modified and Pragma.

The Origin request header carries only scheme, host and a non-default port: https://board.example.org. The path, the query, the fragment and any trailing slash are absent, and scheme and host are ASCII-lower-cased.

For two independent reasons. The preflight is sent in credentials mode "same-origin", so cross-origin it carries no cookie and no authentication entry and cannot meet the WWW-Authenticate challenge; and 401 is not an ok status, so the preflight fails regardless.

default-src supplies the source list for any fetch directive absent from the policy. A directive you do write takes nothing from it - the written list replaces the default wholly for that resource type, and an empty list blocks everything.

'self' matches the protected document's own origin - same scheme, host and port. 'none' matches nothing, so the directive carrying it permits no source at all. Both are keyword-sources, and the single quotes are part of the grammar.

The element needs a nonce content attribute holding exactly the base64-value from the policy: 'nonce-abc123' matches nonce="abc123". The comparison is a literal ASCII case-sensitive string match, with no base64 decoding and no normalisation.

Content-Security-Policy-Report-Only enforces nothing. A conforming browser loads and runs the resource the policy forbids, records the violation, and sends a report to the destination the policy names. It measures a policy; it does not apply one.

Subresource Integrity pins the bytes rather than the origin: a conforming browser digests the fetched file and refuses it unless a hash in the integrity attribute matches. An allowlist only settles where script may come from.

A browser attaches a stored cookie according to where a request is going, not according to which document caused it. The hostile page's form is addressed to the clinic, so the clinic's session cookie rides along and the request authenticates.

A CSRF token mismatch is a provenance failure, not a credential one: the session cookie was valid, so 403 Forbidden fits. A 401 Unauthorized tells the client its credential is bad, so it discards a good session and forces a needless login.

A conforming user agent, not page script, writes the Origin request header, so a value that is not yours means another document initiated the request. Its absence proves nothing, and a client that is not a browser can send any value.

A matching value proves the request was composed by a page this site served: the value is unpredictable and its authoritative copy lives in server-side session state, so a document from elsewhere can neither read nor guess it.

Plain markup can emit a GET through any subresource or navigation, and a form POST whose body is one of three encodings: application/x-www-form-urlencoded, multipart/form-data or text/plain. It cannot add a request header field of its own.