2

We have configured our server to serve an Outlook Add-in using 

X-Frame-Options "ALLOW-FROM https://outlook.office.com"

Our app was rejected by Office Store because it's being tested on outlook.office365.com. We don't see a way to allow multiple domains (i.e. outlook.office.com and outlook.office365.com)

Could you please help us here?

PS: When will we completely migrate to one of these ?

Marc LaFleur
  • 31,987
  • 4
  • 37
  • 63
Gags
  • 41
  • 1
  • 5

1 Answers1

0

The X-Frame-Options header can only support a single domain for ALLOW-FROM.

As for Outlook Web Add-ins specifically, it isn't safe to assume outlook.office.com as the host domain. The origin could be any number of known domains (outlook.office.com, outlook.office365.com, outlook.live.com, etc.) or even a custom domain (OWA with an on-prem Exchange Server for example).

It is also worth noting that X-Frame-Options isn't fully supported across browsers. Generally, unless you're looking to blanked DENY rendering in a frame X-Frame-Options isn't very robust. And given that Office Web Add-ins by definition run within an IFRAME within a browser, it is likely going to cause far more problems than it solves.

Marc LaFleur
  • 31,987
  • 4
  • 37
  • 63
  • this is pretty much the same as https://stackoverflow.com/questions/48334839/x-frame-options-for-outlook-web-add-ins – Outlook Add-ins Team - MSFT Jan 29 '18 at 18:54
  • @OutlookAdd-insTeam-MSFT What is the suggested way to get it working in iframe and take care of clickjacking too? – Mukesh Soni Jan 30 '18 at 08:09
  • 1
    Given that preventing clickjacking means preventing another site/app from framing your app, there isn't a good option here. After all, the entire point of your add-in is that you _need_ it to be framed by another app. – Marc LaFleur Jan 30 '18 at 18:23