CODEWITHSUNDEEP
httpoffice-jsoutlook-web-addinsoffice-store
Gags
Gags

Reputation: 41

outlook.office.com vs outlook.office365.com

We have configured our server to serve an Outlook Add-in using 

X-Frame-Options "ALLOW-FROM https://outlook.office.com"

Our app was rejected by Office Store because it's being tested on outlook.office365.com. We don't see a way to allow multiple domains (i.e. outlook.office.com and outlook.office365.com)

Could you please help us here?

PS: When will we completely migrate to one of these ?

Upvotes: 2

Views: 6440

Answers (1)

Marc LaFleur
Marc LaFleur

Reputation: 33124

The X-Frame-Options header can only support a single domain for ALLOW-FROM.

As for Outlook Web Add-ins specifically, it isn't safe to assume outlook.office.com as the host domain. The origin could be any number of known domains (outlook.office.com, outlook.office365.com, outlook.live.com, etc.) or even a custom domain (OWA with an on-prem Exchange Server for example).

It is also worth noting that X-Frame-Options isn't fully supported across browsers. Generally, unless you're looking to blanked DENY rendering in a frame X-Frame-Options isn't very robust. And given that Office Web Add-ins by definition run within an IFRAME within a browser, it is likely going to cause far more problems than it solves.

Upvotes: 0

Related Questions