title: Work around cross domain restriction
body: <p>I am creating a webapp interacting with two hosts, both under my management.  The main UI is served by one host one.xyz.com,  the UI has an iframe which points to another host (two.xyz.com).  The main UI needs to retrieve the web content from the iframe and do some processing.  But because they (the main UI and the iframe) point to different hosts, cross-domain security protection prevents me from getting the content by using the following code snippet</p>
  
  <pre><code>let iframe = document.querySelector('#dataIFrame');
  let content = iframe.contentDocument.children[0].innerHTML
  </code></pre>
  
  <p>Wonder if there is anything I can do to two.xyz.com and so that its response has some special headers that says, for javascript from one.xyz.com can retrieve the content from iframe pointing to two.xyz.com? </p>
  
  <p><strong>Update1</strong>
  Forgot to mention that iframe content has HTML/CSS/images, but no javascript.  </p>