Custom URL Handler

[matthiasabele]

Steps to reproduce

Hello, we are facing issues with the new teams version. In the old version we were using url handlers in order to provide additional value to our customers in the teams app. With the new one this is not possible as the whitelist doesn't contain our handlers. After some discussion in the Teams dev forum we found out about this whitelist, which then brought us to this discussion in #9010

Expected behavior

Teams should open the custom url handler

Actual behavior

we get a security issue

Error details

Refused to frame '' because it violates the following Content Security Policy directive: "frame-src blob: data: https: acrobat2018: ales: arcb: blocked: bookmark: ciscotel: cloudya: com.bt.cloudwork.app: com.rainbowoffice.app: com.ringcentral.vodafonebusiness.app: companyportal: deltapath-engage: devtools: jamfselfservice: mailto: maxuccall: microsoft-edge: ms-access: ms-actioncenter: ms-appx-web: ms-excel: ms-infopath: ms-powerpoint: ms-project: ms-publisher: ms-settings: ms-spd: ms-teams: ms-visio: ms-whiteboard-preview: ms-word: msteams: notes: odopen: officeathand: onenote: openapp: opentouch: pdf: rcapp: rctelus: sebs: sip: sips: softwarecenter: suknil: tel: unifyoffice: vscode-insiders: vscode: vsls: wazo: webex: webextel: x-apple.systempreferences:".

[Prasad-MSFT]

@matthiasabele - Could you please provide us with the specific protocol that your app is using?

[matthiasabele]

@Prasad-MSFT Thanks for your quick reply! :)

We are using the following handlers:

eucc-phone eucc-chat eucc-audio eucc-video eucc-contactcard eucc-addfavourite eucc-collab

[Prasad-MSFT]

@matthiasabele - Thanks for sharing this. We are checking this with engineering team to add in whitelist. We will inform you once we hear any update.

[reiniersmit]

@Prasad-MSFT I'm a bit surprised by the approach to supporting custom protocol handlers in Teams Apps. Here's what we're working with:

Teams App Functionality: Our Teams App is designed to create dashboards. App Launcher: It includes an app launcher that allows customers to configure and list their own apps to launch from our solution. App Types: Typically, these are:

• Web apps
• Local applications like Word, Outlook, or other custom client applications installed on their desktop (whether Windows or Mac).

Given this functionality, it seems even more pertinent to have the ability to configure these protocol handlers directly within the app manifest or provide some mechanism for integration. Several others have also suggested the same solution. Since this is already an open ticket from someone else, would it be possible for us to kindly raise this question in this ticket as well? It could be beneficial to ensure our concerns are addressed collectively.

[Laho19]

@Prasad-MSFT We're experiencing the same for all of our customers who have moved/migrated towards the new Teams client. The integration with our local app launcher stopped working. We're using the following handler;

• "w365-launch"

Could you make sure to add this handler to the whitelist?