CODEWITHSUNDEEP
fetchoffice-scripts
sutan
sutan

Reputation: 454

Office Script Fetch HTTP without HTTPS

I've been trying to use office API to fetch some data on office VPN. The fetch method is GET over HTTP protocol in the VPN. It fails. After some debugging, I've come to a question:

We don't have HTTPS and SSL as it is VPN so there is no encription needed. The only encryption that exists is between this office and the cloud via VPN client. My suspicion is that Microsoft feels this as unsafe and reject all HTTP protocol without SSL. Is this true?

What I've tried:

async function main(workbook: ExcelScript.Workbook) {
    // Office Script fetch

    // this is the official test url
    const url0 = 'https://jsonplaceholder.typicode.com/todos/1'

    // this is the FAIL fetch test (is it because HTTP?)
    const urlFAIL = 'http://<localip>/api/collections/public/records';

    // localhost works
    const urlLocalhost = 'http://127.0.0.1/api/collections/public/records'

    // this is SUCCESSFUL with the same API software! but this one is over internet with HTTPS
    const urlSUCCESS = 'https://<someDNS>/api/collections/public/records';
    console.log(url)

    let fetchResult = await fetch(url0);

    let json: object = await fetchResult.json();

    console.log(JSON.stringify(json));
}

another thing is that I also tested in browser's fetch to the local IP: Everything works! even in HTTP. Somehow the HTTP does not work in office fetch.

Upvotes: 0

Views: 648

Answers (1)

Yutao Huang
Yutao Huang

Reputation: 1581

This is actually not an Office Scripts specific problem, but rather a browser security restriction.

You are seeing this issue because Excel for the web is running over HTTPS, which is treated as a secured context/origin. When Office Scripts is running inside Excel for the web, inheritably it is also expected to only access (fetch) network resources from a secured context/origin - HTTPS. Therefore, any access to unsecured origin (HTTP) will be blocked. I believe this is the default security setting for most modern browsers (Chrome, Edge, etc.).

However, if you trust the network resources you are trying to access, you can probably try bypassing this browser security setting:

Upvotes: 2

Related Questions