title: javascript : Permission denied to access property on cross-origin object despite having cors enables
body: <p>I have a website "mydomain.com" including an iframe on from a different subdomain "sub.mydomain.com" containt a wordpress page. Some js in the page hooks some buttons of the iframe :</p>
  
  <pre><code>        var target_height = parseInt(obj.contentWindow.document.body.scrollHeight);
      obj.style.height = target_height + 'px'; 
      var iframeOffset = $(obj).offset();
  </code></pre>
  
  <p>I have configured nginx on "sub.mydomain.com" to include CORS headers this way : </p>
  
  <pre><code>    location ^~ /wordpress {
              add_header 'Access-Control-Allow-Origin' "*" always;
              add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS, DELETE, PUT, HEAD';
              add_header 'Access-Control-Allow-Credentials' 'true' always;
              add_header 'Access-Control-Allow-Headers' 'User-Agent,Keep-Alive,Content-Type,Authorization,Origin,X-Requested-With,Accept,DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range' always;
  
  
              index index.php;
              alias /usr/share/webapps/wordpress/;
  
              if (!-e $request_filename) { rewrite ^ /wordpress/index.php last; }
  
              location ~ \.php$ {
                      if (!-f $request_filename) { return 404; }
                      include fastcgi.conf;
                      include fastcgi_params;
                      #fastcgi_intercept_errors on;
                      #fastcgi_buffers 16 16k;
                      #fastcgi_buffer_size 32k;
                      fastcgi_index index.php;
  
                      fastcgi_param SCRIPT_FILENAME $request_filename;
                      fastcgi_pass php;
  
              }
  
              location ~ \.(js|css|png|jpg|jpeg|gif|ico)$ {
                      expires max;
              }
      }
  </code></pre>
  
  <p>And with curl I can see the CORS header is included : </p>
  
  <pre><code>curl https://sub.mydomain.com/wordpress/ -svo.
  
  { [5 bytes data]
  &lt; HTTP/1.1 200 OK
  &lt; Server: nginx/1.14.0
  &lt; Date: Wed, 22 May 2019 14:51:55 GMT
  &lt; Content-Type: text/html; charset=UTF-8
  &lt; Transfer-Encoding: chunked
  &lt; Connection: keep-alive
  &lt; X-Powered-By: PHP/7.2.9
  &lt; Link: &lt;https://sub.mydomain.com/wordpress/wp-json/&gt;; rel="https://api.w.org/"
  &lt; Link: &lt;https://sub.mydomain.com/wordpress/&gt;; rel=shortlink
  &lt; Access-Control-Allow-Origin: *
  &lt; Access-Control-Allow-Methods: GET, POST, OPTIONS, DELETE, PUT, HEAD
  &lt; Access-Control-Allow-Credentials: true
  &lt; Access-Control-Allow-Headers: User-Agent,Keep-Alive,Content-Type,Authorization,Origin,X-Requested-With,Accept,DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
  &lt; 
  { [15703 bytes data]
  * Failed writing body (0 != 7952)
  * Failed writing data
  * Closing connection 0
  } [5 bytes data]
  * TLSv1.2 (OUT), TLS alert, close notify (256):
  } [2 bytes data]
  </code></pre>
  
  <p>Despite all this i still have a javascript error concerning the JS code : </p>
  
  <pre><code>SecurityError: Permission denied to access property "document" on cross-origin object line:84 
  </code></pre>
  
  <p>which corresponds to </p>
  
  <pre><code>var target_height = parseInt(obj.contentWindow.document.body.scrollHeight);
  </code></pre>
  
  <p>EDIT : 
  here is the output of <code>curl -i -X OPTIONS https://sub.mydomain.com/wordpress/</code> : </p>
  
  <pre><code>HTTP/1.1 200 Connection established
  Set-Cookie: IPOCDSERVERID=id_srv-01; path=/
  
  HTTP/1.1 405 Not Allowed
  Server: nginx/1.14.0
  Date: Wed, 22 May 2019 15:43:49 GMT
  Content-Type: text/html
  Content-Length: 173
  Connection: keep-alive
  Access-Control-Allow-Origin: *
  Access-Control-Allow-Credentials: true
  Access-Control-Allow-Headers: User-Agent,Keep-Alive,Content-Type,Authorization,Origin,X-Requested-With,Accept,DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
  
  &lt;html&gt;
  &lt;head&gt;&lt;title&gt;405 Not Allowed&lt;/title&gt;&lt;/head&gt;
  &lt;body bgcolor="white"&gt;
  &lt;center&gt;&lt;h1&gt;405 Not Allowed&lt;/h1&gt;&lt;/center&gt;
  &lt;hr&gt;&lt;center&gt;nginx/1.14.0&lt;/center&gt;
  &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>