`CORS` is an appropriate choice for cross domain sharing, access must be however restricted to authorized domains only, particularly if `Access-Control-Allow-Credentials` is enabled.

All unauthorized domains must be restricted in addition to domains that allows running untrusted code like `jsfiddle.com`.