Connecting to a different domain is fine, that's what CORS is for. Letting any origin connect by default -- that's a problem. > Browsers set the "Origin" heade

Connecting to a different domain is fine, that's what CORS is for. Letting any origin connect by default -- that's a problem. > Browsers set the "Origin" header for ws:// calls, and the websocket servers are expected to check that. I know that, but as always insecure by default protocols are terrible, and are guaranteed to be exploited beyond recognition... The question is why not be secure by default and force servers to whitelist origins they expect to talk to?