This is wrong or awkward answer at best. Your session based generated HTML (i.e. Your Credit Card usage history) is safe against these kind of attacks, also gu

This is wrong or awkward answer at best. Your session based generated HTML (i.e. Your Credit Card usage history) is safe against these kind of attacks, also guess what your XML is safe as well and all other data formats that cannot be called and interpreted by JavaScript from another domain. Heck even session based generated images are safe and cannot be read from another domain, other than some rare bugs (they are security bugs and will be fixed, not design issues). Another format I can think of that cannot keep session based information safe is JavaScript. I wrote about a real world example of this before (a vulnerability in IntenseDebate) : http://www.mavitunasecurity.com/blog/javascript-scope-and-intensedebates-privacy-problems/ http://www.mavitunasecurity.com/blog/javascript-scope-and-in...