search

OfficeDev / office-js-docs

[ARCHIVED] Microsoft Office Add-ins API Reference Documentation
https://docs.microsoft.com/javascript/api/overview/office
398 stars 247 forks source link

AppDomains not needed in Office add-in manifest for external links? #1491

Closed stowellt closed 5 years ago

stowellt commented 6 years ago

I posted this question on StackOverflow, but am now posting here because it seems like a documentation bug. I created a simple Office add-in with a manifest that has no <AppDomains> section. I then added the following link to the add-in .html file:

<a href="https://www.tutorialrepublic.com">Test</a>

When I load the add-in in either Office Online or desktop MS Word and click the link, the addin frame loads the html from www.tutorialrepublic.com.

I would have expected that this would be blocked according to the description here: https://docs.microsoft.com/en-us/office/dev/add-ins/develop/add-in-manifests?tabs=tabid-1#specify-domains-you-want-to-open-in-the-add-in-window

Can anyone explain the discrepancy? I found I can also submit to a form and set window.location.href to external domains and they open in the addin iframe, not in a separate window as expected.

Rick-Kirkham commented 6 years ago

I think the documentation is wrong. I think it is only http sites that need to be listed in AppDomains, not https sites. I asked the product team a few weeks ago when you posted your SO question. I'll ping them again.

ElizabethSamuel-MSFT commented 5 years ago

@Rick-Kirkham: Can you provide current status on this? Thanks.

Rick-Kirkham commented 5 years ago

This was answered on the user's SO question. https://stackoverflow.com/questions/50847163/appdomains-not-needed-in-office-add-in-manifest-for-external-links