There are known mechanisms to prevent leaks/exploits of this sort by sending some additional headers[0], on most of the modern browsers. Apart from that, the co

There are known mechanisms to prevent leaks/exploits of this sort by sending some additional headers[0], on most of the modern browsers. Apart from that, the cookies should be strict for such a service. I logged in to my friends account to find neither implemented. They better act quick about "ensuring it doesn't happen" or I will distrust them completely. [0]: Content-Security-Policy (setting at least connect-src) and X-XSS-Protection to start with. More here: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Co...