javascript - When page is opened with window.open, how can the opened page allow the opener to access its contents? -

is possible page opened window.open allow examined cross-origin opener? (this use in internal applications, security not significant concern.) , if so, how? i've tried replacing of cors , same-origin policies can find , still access denied on properties child window.

in particular trying use internet explorer 11

headers

these of headers i've tried far

access-control-allow-origin: http://web1.corp.local access-control-allow-credentials: true access-control-expose-headers: cache-control,content-language,content-type,expires,last-modified,pragma access-control-expose-methods: get,post,option,put,delete,head x-content-security-policy: default-src *;script-src * content-security-policy: default-src *;script-src * x-xss-protection: 0 x-permitted-cross-domain-policies: 

what i'm trying do...

i want web1.corp.local execute javascript on page on web2.corp.local. control both domains; way web2 tell browser okay web1 read , execute things on web2.

request on http://web1.corp.local

i'm trying call javascript functions on opened window opener.

document.domain = "corp.local"; var web2 = window.open('http://web2.corp.local'); web2.document; //throw "access denied" web2.myapp; // undefined 

javascript on http://web2.corp.local

document.domain = "corp.local"; var myapp = window.myapp = {     dowork: function() {         alert('hello world!');     } }; 

note: have solution using iframe proxy , window.postmessage app hosted on web2 doesn't work correctly within iframe.

update: issue 2 pages not using document.domain , missed exception on opened window.

the issue document.domain. second site not in same domain first. changed fqdn of web1 , used document.domain = corp.local problem solved.

i missed exception being thrown 1 of javascript files on document.domain.