title: How to safely host many "sites" on a single hostname with XSS protection
body: <p>I am building a distributed sharing protocol and part of it will be an HTTP/HTTPs proxy that users will run.  The proxy will allow them to access various sites written by other users.  The proxy will also allow the user to interact with those sites via a few API calls.  I expect the sites themselves to be mostly javascript.</p>
  
  <p>So it comes down to, the user has a cookie with:
  <a href="https://magic-proxy/" rel="nofollow noreferrer">https://magic-proxy/</a></p>
  
  <p>The various sites will be at URLs like:
  <a href="https://magic-proxy/site-a/" rel="nofollow noreferrer">https://magic-proxy/site-a/</a> (this will contain all the static content of site-a, include javascript, html, css, etc)
  and they will submit things to site-a via 
  POST <a href="https://magic-proxy/site-a/submit" rel="nofollow noreferrer">https://magic-proxy/site-a/submit</a></p>
  
  <p>I don't want and javascript on <a href="https://magic-proxy/site-b" rel="nofollow noreferrer">https://magic-proxy/site-b</a> to be able to send a submission to <a href="https://magic-proxy/site-a/submit" rel="nofollow noreferrer">https://magic-proxy/site-a/submit</a>.  Only javascript from site-a should be allowed to do that.</p>
  
  <p>Most of the things I've been reading about CORS and same-origin policies indicate that to browsers, these will be considered the same since they both start with <a href="https://magic-proxy" rel="nofollow noreferrer">https://magic-proxy</a></p>
  
  <p>The server answering the HTTP requests will be java and I can send any headers that make sense, but the javascript on these sites will be completely untrusted and probably terrible.</p>
  
  <p>Is there some way to tell the browser that these sites, though they are on the same protocol, port and hostname are really different entities and should be considered different origins?</p>