How can playcanvas editor forbidden XSS？

[Vicent_Karl]

var Follow = pc.createScript(‘follow’);
alert(document.cookie);

[Sanonz]

your token is pc_auth, it’s HttpOnly, that tell the browser not to display the cookie through client-side scripts (document.cookie and others).