For WebSockets? Maybe there isn't. It's not really the browsers fault necessarily, W3C takes many, many years to ratify standards so they go ahead an implement

For WebSockets? Maybe there isn't. It's not really the browsers fault necessarily, W3C takes many, many years to ratify standards so they go ahead an implement things themselves causing incompatibilities and, in the case of WebSockets, for them to provide features they now have to take away again. For cross-site scripting, there are many ways this could be enabled. Like the way Flash does it, for example, by placing a file at the root of a domain which specifies all the other domains it is allowed to talk to. Providing a manifest like this is likely the simplest solution to a problem that makes designing thick-clients quite annoying.