A web application, identified by its Origin, such as , being given the right. When a user of the web application at a certain origin accesses the server, then the browser sets the Origin: header to warn that a possibly untrusted webapp is being used. Then, BOTH the user AND the origin must have the required access.