This post represents a gross misunderstanding of origin security on the Web. Protection against a malicious client is an explicit non-goal of origin security, i

This post represents a gross misunderstanding of origin security on the Web. Protection against a malicious client is an explicit non-goal of origin security, if not an outright impossibility. To put it another way, if the client is already compromised, then what can you possibly do at the server to protect it anyway?