Ok, so this is weird.

I already know what on origin is (https://developer.mozilla.org/en-US/docs/Glossary/Origin), how to correctly use the "Access-Control-Allow-Origin" header, and so on, but this is something never view before.

I have a "father" window. This window is opening a "child" window through the window.open(url) method. the url provided is the same url of the father window:

var childWindow = window.open(window.location.href);

When the father window try to access to a property of the childWindow, it obtains the cross-origin error:

childWindow.data;
> Uncaught DOMException: Blocked a frame with origin XXXXXXXXXXXXX from accessing a cross-origin frame.

Interesting thing is: in the browser developer console of "father" window, typing

window.location.origin;

prints the origin (something like http://a.b.c)

and in the browser developer console of "child" window, typing

window.location.origin;

prints esactly the same origin (something like http://a.b.c)

Notes: there are no iframes involved here. The window.location.href URL is responding with 200 OK (not 302 or other things) and a simple page html with some css and scripts.

Note #2: the two instructions are executed sequentially. In the middle there are no other codes.

Note #3: obviously XXXXXXXXXXX is not the real origin, I omitted it for privacy concerns. But it is something like http://a.b.c (implicit port 80)

Note #4: is not relevant here because it should also work without it, but the window.location.href URL is responding with the response header "Access-Control-Allow-Origin": *

Any thought?