Overview: Browser security boundaries
Browser security boundaries govern when a page can request or read resources from another connection or origin.
Mixed-content rules concern insecure resources in a secure-page context. Same-origin policy and CORS concern a different relationship: which responses the page is allowed to read. Their pages explain those gates without assuming that browser permission also authorizes the operation on the server.
Mixed content in browsers
Mixed-content processing governs insecure subrequests made by a secure browser page, with request type, upgrade policy and local-network features separate from CORS and server reachability.Same-origin policy and CORS
The same-origin policy and CORS govern script access across browser origins, with preflight, credentials and allowed responses separate from the server’s authentication and authorization.