A Header is a line of text in the form name:data found at the top (the head) of an e-mail message. The typical e-mail has many such headers indicating where the message came from, who sent it, when it was sent, and many other characteristics of the message. The typical e-mail client program will hide most of the headers from the user and display others (such as the From:) outside the body of the message. Some headers are added by computers that process the header between the sender and recipient. The contents of most headers can be forged by the sender of the message or an intermediary, and are not reliable.
The From: Header is the address displayed by the e-mail client. An example:
- From: <email@example.com>
The Sender: Header indicates the actual sender of the message. (You'd think the From: header would do this, but the system is designed so that the From: can be forged.) Sender is not usually displayed by mail clients.
The Same-Origin Policy is a security rule that goes back a long way, to Netscape Navigator 2.0. It states that one document may not get or set properties of another document that comes through a different TCP/IP port, a protocol (e.g. https vs. http), or from a different host (i.e. the domain).