how to enable cross origin completely?

There’s an iframe in my local index.html,like this:

<iframe src="localhost:8888"></iframe>

I tried to add following code in both class IndexHandler and class WsockHandler:

def set_default_headers(self):
        self.set_header("Access-Control-Allow-Origin", "*")
        self.set_header("Access-Control-Allow-Headers", "x-requested-with")
        self.set_header('Access-Control-Allow-Methods', 'GET, PUT, DELETE, OPTIONS')
        self.set_header("Access-Control-Allow-Headers", "access-control-allow-origin,authorization,content-type")

but ajax_complete_callback still returned “XSRF cookie does not match POST argument”.

Help me please.

[huashengdun]

Updated: To disable xsrf protection by passing option --xsrf=False, To enable cross-origin websockets by passing option --origin='http://cross-domain.com'.

[huashengdun]

To disable xsrf protection, your can change xsrf_cookies=True to xsrf_cookies=False in settings.py. To allow cross-origin traffic, you need to define a method check_origin on WsockHandler.