0

I have a Manifest that points to home.html hosted in some web server. It also has X-Frame-Options as SAMEORIGIN. For security reasons I can't change this configuration. I believe due to this SAMEORIGIN configuration in word online addin fails to load. It works fine though in Windows and MAC native version of word. It is a taskpane addin. I don't have a requirement to support word online but seems to validate the addin it must work in word online also. Any suggestion how can I load home.html in word online when X-FRAME-OPTIONS is set to SAMEORIGIN.

Load Error in word online

Here is how I refer home.html in manifest.xml This server will always return x-frame-options: sameorigin with all responce header.

<Hosts>
    <Host Name="Document" />
</Hosts>
<DefaultSettings>
        <SourceLocation DefaultValue="https://<somedomain>.com//App/Home.html" />
</DefaultSettings>
Rajesh Raushan
  • 41
  • 9

1 Answers1

1

It seems that your browser just respects X-Frame-Options: sameorigin header and saying I'm not going to load your Task pane iframe because it is not from the same domain as office online application. You can minimize your security risk by making exception for this rule in a web proxy (if you are using one or install and configure one) for requests coming from your office online domain.

Dalibor Grudenic
  • 395
  • 3
  • 10
  • Thanks Dalibor, Perhaps it can work that way to some extent. There are two problems with that. First - after home page it will redirect to different page and domain also. Practically it is impossible add office online domain to all those for security reasons. Second - as per this [stackoverflow thread](https://stackoverflow.com/questions/48334839/x-frame-options-for-outlook-web-add-ins) allow-from is not preferable way of configuring office online domains. – Rajesh Raushan Dec 03 '18 at 10:05