Stealing secrets from developers using WebSockets
>  browsers allow websockets from public origins to open websockets connections to localhost without many protections<p>Excuse me, but what in the world? XHR has all kinds of cross-site request protections that even make developing apps locally a pain. How come websockets don't come with such protections?<p>Are there apps that take over this responsibility?