Render AST: "SecurityError: Permission denied to access property ..."

[vstange]

@physikerwelt reported a CORS issue in HyPlag (https://github.com/ag-gipp/hyplag-frontend/issues/36) which occurs whenever we try to render a single AST. This also occurs on our own demo at https://vmext-demo.wmflabs.org.

To Reproduce
Steps to reproduce the behavior:

1. Go to https://vmext-demo.wmflabs.org
2. Click on "Render AST".
3. View the browser console for error message.

Expected behavior
Render AST should work in our demo.

Screenshots
Screenshot taken with firefox

Tested on:

• Firefox Quantum 60.x
• Chrome 60.x

Additional context
More detailed issue is a "Blocked a frame with origin from accessing a cross-origin frame"A gGood answer on SO was: https://stackoverflow.com/questions/25098021/securityerror-blocked-a-frame-with-origin-from-accessing-a-cross-origin-frame

We may need to change our setup a bit?

• Deploy vmext on a static server, so we a have no cross-sciptings?
• No redirect - instead masked pass-through? (Don't know how.)