Same-Origin Policy
Your fetch('https://api.example.com/data') fires and the server answers with a normal 200, yet the console shows a red error and your code cannot touch the body. The response arrived; the browser refused to let your script read it.
- ▸A
fetchto another site reaches the server and returns200; the browser blocks your read, not the request. - ▸
https://example.comandhttp://example.comcount as different sites; so dowww.example.comandapi.example.com. - ▸Links, form posts, and
<img>loads to another site all still work, only the read is sealed off.
Take a URL you have typed a hundred times: https://store.example.com/dir/page.html. The browser splits it into pieces, and three of them decide who this page is allowed to talk to: the scheme (https), the host (store.example.com), and the port (here unwritten, so 443, the default for https).
Those three together are the page's identity. Two URLs match only when all three agree. Change https to http and it is a different identity, even to the same host. Bump the port to :81 and it is different again. Swap store. for news. and, once more, different. The path (/dir/page.html) is the one piece that never counts: /page and /dir/other on the same three-part identity are treated as the same page's neighborhood.
The trap is the shared parent domain. www.example.com and api.example.com feel like the same website, and in casual speech they are. To the browser they are two different hosts, so two different identities, with no credit for the example.com they share. There is no "close enough" here, no partial match on a common suffix. Either all three slots are identical or they are not.