title: Why is there no same-origin policy for WebSockets? Why can I connect to ws://localhost?
body: <p>I'd like to use WebSockets for inter-process communication for my application (Daemon&lt;->WebGUI and Daemon&lt;->FatClient, etc.). During testing, I tried connecting to my locally running web socket server (ws://localhost:1234) via the JavaScript WebSocket client on websocket.org (<a href="http://www.websocket.org/echo.html" rel="noreferrer">http://www.websocket.org/echo.html</a>).</p>
  
  <p>My question now is:<br>
  <strong>Why is this possible?</strong> Is there no cross-origin policy implemented in the browsers (here: FF29 on Linux)? </p>
  
  <p>I am asking because if websocket.org was evil, it could try to communicate with my local WS server and redirect every message it receives from localhost to any other server:</p>
  
  <pre>
  Local WebSocket Server            Browser            Evil Web Server
  at ws://localhost:1234                               at http://evil.tld
          |                            |                       |
          |                            |------[GET /]---------&gt;|
          |                            |&lt;-----[HTML+EvilJS]----|
          |&lt;------[connect ws://..]----|                       |
          |&lt;----[some communication]--&gt;|                       |
          |                            |----[evil forward]----&gt;|
          |                            |                       |
  </pre>
  
  <p>I have not tested the entire use case, but the connect to ws://localhost from the JS delivered by websocket.org definitely works.</p>