Interesting points. I'd thought of these issues but hadn't heard them so clearly stated. I don't know if this situation would be common but I have an idea of w

Interesting points. I'd thought of these issues but hadn't heard them so clearly stated. I don't know if this situation would be common but I have an idea of where it could work. Perhaps a web app you completely trust could talk to an API you don't trust over CORS. The web app you completely trust would only talk to the api you don't trust over XHR and wouldn't eval anything it got back.