Stealing secrets from developers using WebSockets
>  browsers allow websockets from public origins to open websockets connections to localhost without many protectionsExcuse me, but what in the world? XHR has all kinds of cross-site request protections that even make developing apps locally a pain. How come websockets don't come with such protections?Are there apps that take over this responsibility?