XSS

This should actually be renamed from “Cross Site Scripting” to “JavaScript Injection” and has to do with

When the Browser and the Server are in the same-origin — requests to an origin with a different schema, port or domain are blocked by default. To allow Client to get evil assets, Server would need to set a CORS headers — to allow t