Xss headers

_trip · 2018-03-12 21:52:50

I tried setting these in apache vhost.d file:

Header always set Access-Control-Allow-Origin "*"
Header always set Access-Control-Allow Credentials true
Header always set Access-Control-Allow-Methods "POST, GET, OPTIONS, PUT, DELETE"
Header always set Access-Control-Max-Age "1000"
Header always set Access-Control-Allow-Headers "x-request-with, content-type, authorization, accept, client-security-token"
Header always set Var "Accept-Encoding, Origin"

But CORS is not working still. When trying to get contentWindow.document in javascript i receive "SecurityError: Premission denied to access property "document" on cross-origin object.
I'm using the widget embed code feature, and would like to set the username manually using the user from a site on the same server are livehelperchat.

Any help would be greatly appreciated.
Thank you glasses