Origins and CORS — what the browser draws its lines around
This chapter defines an origin as the triple of scheme, host, and port, and explains that the same-origin policy blocks reading, not sending. It covers when preflight is triggered, why wildcard and credentials can't be combined, and why Vary is needed.