title: How do CORS requests work from within an iframe?
body: <p>Using javascript, we can make a cross origin request using XMLHttpRequest.</p>
  
  <p>A cross origin request requires the requested host to give a response only to preapproved hosts.</p>
  
  <p>When making a XHR request from within an iframe (our content from host A makes a request to site C, but is loaded into an iframe on site B). Which host/origin(s) must be allowed on site C for the request to go through?</p>