> browsers allow websockets from public origins to open websockets connections to localhost without many protections Excuse me, but what in the world? XHR has

> browsers allow websockets from public origins to open websockets connections to localhost without many protections Excuse me, but what in the world? XHR has all kinds of cross-site request protections that even make developing apps locally a pain. How come websockets don't come with such protections? Are there apps that take over this responsibility?