Your React app is one XSS away from a full account takeover

There's a 60-page IETF spec that explains exactly why. And a pattern that makes token theft...