Web security model is tightly connected to `Same-origin policy (SOP) <sop_>`__. In short: web pages cannot Read resources which origin doesn't match origin of requested page, but can Embed (or Execute) resources and have limited ability to Write resources.
Origin of a page is defined in the `Standard <cors_>`__ as tuple