Comment by atdt

Could someone explain how re-directing from a subdomain (chess.com.foo.bar) somehow got past some same-origin check?