It's also specific to jsbin, so it wouldn't work if another site using
jsbin wanted to turn on the security. I'll have a think about this.

On Monday, July 1, 2013, Tom Ashworth wrote:

> In public/js/render/live.js:
>
> >
> > -  var run = function () {
> > -    var jsbinConsole = jsbin.panels.panels.console.visible ? 'window.jsbinWindow._console' : false;
> > +  /**
> > +   * Store what runner origin *should* be
> > +   * TODO this should allow anything if x-origin protection should be disabled
> > +   */
> > +  renderer.runner = {};
> > +  renderer.runner.origin = jsbin.root.replace('jsbin', 'run.jsbin');
>
> Not sure about this – seems hacky, but it seems too much to parse the URL
> and add to the host.
>
> —
> Reply to this email directly or view it on GitHub<https://github.com/remy/jsbin/pull/652/files#r4965595>
> .
>


-- 
— Remy