JavaScript establece una cookie a través de iFrame a través de CORS a través de PHP Permitir encabezado

So I thought this would be possible, but apparently not, so far at least:

I've got domainX trying to send a secure cookie to domainY.com/page.php. So, on domainX, I init a iframe to domainY.com/page.php with the following headers:

<?php
    $url = parse_url($_SERVER["HTTP_REFERER"]);
    $link = $url["scheme"]."://". $url["host"];

    header('P3P:CP="We do not have a P3P Policy"');
    header("Access-Control-Allow-Headers: *"); 
    header("Access-Control-Allow-Origin: " . $link);
    header("Access-Control-Allow-Credentials: true");
    header("Access-Control-Allow-Methods: GET, POST, OPTIONS");
?>

Assuming the headers were correct.. I thought the cookie set would work i.e:

document.cookie = X + "=" + Y + expires + "; path=/; domain=.domainY.com; secure";

It does not, nor do I get any errors. I alreaydy know my final option is postMensaje, but is there any other way around this that anyone is aware of?