title: When page is opened with window.open, how can the opened page allow the opener to access its contents?
body: <p>Is it possible for a page opened with <code>window.open</code> to allow itself to be examined by a cross-origin opener? (This is for use in internal applications, so security is not a significant concern.) And if so, how?  I've tried replacing all of the CORS and Same-Origin policies I can find and I still get <code>Access Denied</code> on all properties for a child window.  </p>
  
  <p>In particular I am trying to use <code>Internet Explorer 11</code></p>
  
  <p><strong>Headers</strong></p>
  
  <p><em>These are all of the headers I've tried so far</em></p>
  
  <pre><code>Access-Control-Allow-Origin: http://web1.corp.local
  Access-Control-Allow-Credentials: true
  Access-Control-Expose-Headers: Cache-Control,Content-Language,Content-Type,Expires,Last-Modified,Pragma
  Access-Control-Expose-Methods: GET,POST,OPTION,PUT,DELETE,HEAD
  X-Content-Security-Policy: default-src *;script-src *
  Content-Security-Policy: default-src *;script-src *
  X-XSS-Protection: 0
  X-Permitted-Cross-Domain-Policies: all
  </code></pre>
  
  <p><strong>What I'm trying to do...</strong></p>
  
  <p>I want <code>web1.corp.local</code> to execute some JavaScript on a page on <code>web2.corp.local</code>. I control both domains; I just some way for <code>web2</code> to tell the browser its okay for <code>web1</code> to read and execute things on <code>web2</code>.</p>
  
  <p><em>Request on <code>http://web1.corp.local</code></em> </p>
  
  <p>I'm trying to call javascript functions on the opened window from the opener.  </p>
  
  <pre><code>document.domain = "corp.local";
  var web2 = window.open('http://web2.corp.local');
  web2.document; //Throw "Access Denied"
  web2.MyApp; // undefined
  </code></pre>
  
  <p><em>Javascript on <code>http://web2.corp.local</code></em></p>
  
  <pre><code>document.domain = "corp.local";
  var myapp = window.MyApp = {
      doWork: function() {
          alert('Hello World!');
      }
  };
  </code></pre>
  
  <p><strong>Note:</strong> I have a solution using an iframe proxy and <code>window.postMessage</code> but the app hosted on <code>web2</code> doesn't work correctly from within an iframe.</p>
  
  <p><strong>Update:</strong> The issue was the two pages were not using the <code>document.domain</code> and I missed the exception on the opened window.</p>