Browser & Web Performance · Junior · Question 53 of 75

What does the same-origin policy prevent by default?

✓Correct answer: A script from one origin reading responses or DOM from another origin
2Submitting forms to other domains
3Loading images from other domains

Explanation

Embedding cross-origin images, scripts and form submissions is allowed; reading the data back from script is not.

Further reading

MDN: Same-origin policy ↗

Test yourself

Take the Browser & Web Performance · Junior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.