title: Cross Origin Resource Sharing with Greasemonkey & Child Window
body: <p>I have a 100% client-side solution. I make a request for a web page. A Greasemonkey (GM) script is inserted into the page &amp; reorganizes the page (which contains a table). The table now has buttons with javascript to launch a window that relates to each row as follows:</p>
  
  <p>// In parent page:</p>
  
  <pre><code>var companyTable = data; // a table acquired with XMLHTTPRequest
  var chartCode = chartGenFunct.toString(); // funct to gen a chart inserted by GM
  var win = window.open('data:text/html;base64,'+ window.btoa(childWindow), '_blank');
  </code></pre>
  
  <p>where the childWindow string contains:</p>
  
  <pre><code>&lt;html xmlns="http://www.w3.org/1999/xhtml"&gt;
  &lt;head&gt;
      &lt;title&gt;GM Script Info&lt;/title&gt;
          &lt;style type="text/css"&gt;&lt;/style&gt;
  &lt;/head&gt;
  &lt;body bgcolor="#FFFFFF"&gt;
  
  
  &lt;div id="companyTableDiv"&gt;&lt;/div&gt;
  &lt;div id="companyChartDiv"&gt;&lt;/div&gt;
  
  &lt;script type="text/javascript" src="http://www.google.com/jsapi"&gt;&lt;/script&gt;
  
  &lt;script id="XXswScriptInitXX" type="application/javascript"&gt;
  document.getElementById("companyTableDiv").innerHTML = window.opener.companyTable;
  eval(window.opener.chartCode +"showTimeLine()"); // fills CompanyChartDiv
  
  &lt;/script&gt;
  &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  
  <p>From the above parent &amp; child code, you can see the idea is to pass window.opener.chartCode and window.opener.companyTable to the opened child window. The omnibox of the child window looks like:</p>
  
  <pre><code>data:text/html;base64,PCFET0NUWVBFIGh0bWwgU...
  </code></pre>
  
  <p>where the parent window's omnibox holds:</p>
  
  <pre><code>http://somewebsite.com/table
  </code></pre>
  
  <p>Here is the point where I say 'everything works in Firefox'. This does not work on Chrome with Tampermonkey (TM). The reason it does not work is that Chrome blocks it per as what seems to be a Cross Origin Resource Sharing issue per the error console logging:</p>
  
  <blockquote>
    <p>Uncaught SecurityError: Blocked a frame with origin "null" from
    accessing a frame with origin "<a href="http://somewebsite.com" rel="nofollow">http://somewebsite.com</a>".  The frame
    requesting access has a protocol of "data", the frame being accessed
    has a protocol of "http". Protocols must match.</p>
  </blockquote>
  
  <p>at line:</p>
  
  <pre><code>document.getElementById("companyTableDiv").innerHTML = window.opener.companyTable;
  </code></pre>
  
  <p>Bear in mind that this is a 100% client-side solution. How can I trick Chrome into allowing the child to see the opener's (parent's) data? (I already tried inserting document.domain = <a href="http://somewebsite.com" rel="nofollow">http://somewebsite.com</a> and this does not work.)</p>