title: iframe not active unless receives user interaction
body: <p>I've been working on a requirement that involves a website fetching/manipulating data stored on a different domain. There didn't seem a way except for enabling CORS on the other server to allow me to get and modify data from a different domain. However, that caused some issues with Office 365 apps and I had to take a different approach.</p>
  
  <p>The approach is to use <code>postMessage</code> to talk to a hidden <code>iframe</code> (not a good approach, but I was insisted to use it) on the page that is running on the target domain. The source page posts message along with information about the REST call to the hidden <code>iframe</code> which makes a requests on behalf of the parent page and uses <code>postMessage</code> to return back the results.</p>
  
  <p>Everything works fine except for when the website is being used on an iPhone. Turned out placing <code>alert</code> calls in the script running inside the target <code>iframe</code> makes it to work but removing the <code>alert</code> calls sort of disables the target <code>iframe</code> from making those cross-origin network calls.</p>
  
  <p>My theory is that it is due to the security of mobile Safari that in order to make cross-origin calls from an <code>iframe</code> running on a different domain, the user needs to provide their consent by interacting at least once with the embedded <code>iframe</code>. Does that sound correct?</p>