Access-Control-Allow-Origin not working for iframe withing the same domain

Access-Control-Allow-Origin is used only for XHR.

What you need is called Same Origin Policy.

You have to add document.domain = 'example.com' to your pages.