In this case the application used websockets, which is supported by browsers natively - but another thing to keep in mind is that any website can send somewhat controlled HTTP requests (not subject to CORS/preflight) to just about anything, regardless of if that's an HTTP server or not. If the receiving side is permissive enough, things might happen. Possibly unwanted things.