3 ms·

Since jsFiddles run user-generated code by design, I hope that they correctly sandbox and use HTTP-only cookies anyway.

• leokun 13y ago
  That's a great point. A restricted iframe on a separate domain + httpOnly session cookies just to be safe would do it.
  • mintplant 13y ago
    That's what they do already.