<script>
var request = new XMLHttpRequest();
request.onreadystatechange = function () {
    if (this.readyState === 4)
        window.parent.postMessage(" iframe host: " + window.location.hostname + " credentials:" + this.responseText, "*");
};
request.open('GET', 'http://127.0.0.1:8000/security/resources/cors-basic-auth.php', true); // no credentials
request.send();
</script>