3 ms·

That's a great point. A restricted iframe on a separate domain + httpOnly session cookies just to be safe would do it.

• mintplant 13y ago
  That's what they do already.