Reputation: 141
This question concerns Microsoft Apps for Office.
We serve http responses with the X-Frame-Options: DENY header, which prevents browsers from iframing our app. Microsoft renders Apps for Office Online in iframes. Not many browsers support the ALLOW-FROM option.
Does Microsoft support some secure way to render Apps for Office in their web-based office apps? Is there another solution that doesn't compromise security?
Upvotes: 0
Views: 294
Reputation: 191
Office Add-in (former App for Office) requires iframe in Office Online. The reason is simple: the app is hosting in another server. So it needs an iframe to display it. This is different from Office Add-in under Win32 Office.
Therefore, I believe that it's impossible to make it without an iframe.
Some Microsoft first-party apps remove "X-Frame-Options: DENY" when porting to Office Online.
Upvotes: 1