We have a "widget" that runs on 3rd party websites, that is, anyone who signs up with our service and embeds the JavaScript.

At the moment we use JSONP for all communication. We can securely sign people in and create accounts via the use of an iFrame and some magic with detecting load events on it. (Essentially, we wait until the iFrames source is pointing back to the clients domain before reading a success value out of the title of it).

Because we're running on JSONP, we can use the browsers HTTP cookies to detect if the user is logged in.

However, we're in the process of transitioning our system to run realtime and over web sockets. We will still have the same method for authentication but we won't necessarily be making other calls using JSONP. Instead those calls will occur over websockets (using the library Faye)

How can I secure this? The potential security holes is if someone copies the JavaScript off an existing site, alters it, then gets people to visit their site instead. I think this defeats my original idea of sending back a secure token on login as the malicious JavaScript would be able to read it then use it perform authenticated actions.

Am I better off keeping my secure actions running over regular JSONP and my updates over WebSockets?