web applications - Properly setting the XFrameOptionsMode for Google Apps Script Iframes - Stack Overflow

admin管理员组

文章数量:1397085

I'm reading through the Google Apps Script docs in order to get a grip. Below is my attempt in my .gs file to allow for my web app to be embedded as an Iframe...

function doGet(e) {

  //URI PARAMETER VALUE(S)
  let mpage = 'mapp';
  if ('page' in e.parameters) {
    mpage = e.parameters['page'][0]
  }

  try {

    //TRY TO ENABLE THE WEB APP WITH CUSTOM DATA USAGE
    let html = HtmlService.createTemplateFromFile(mpage);
    html.data = { title: mpage, e: e }
    
    //THE ONLY WAY I KNOW OF ADDING META TAGS TO THE APP
    let htmlOutput = HtmlService.createHtmlOutput(html.evaluate().setXFrameOptionsMode(HtmlService.XFrameOptionsMode.ALLOWALL));
    htmlOutput.addMetaTag('viewport', 'width=device-width, initial-scale=1, shrink-to-fit=no');
    return htmlOutput;
  }
  catch (err) {
    //IF THERE IS AN ERROR, DISPLAY THE ISSUE
    const html = HtmlService.createHtmlOutput('Page Not Found : ' + JSON.stringify(err));
    return html;
  }
}

Here is my html example of the actual embed....

 <iframe src="/.../exec?page=mapp-gallery" frameborder="0" width="100%" height="100%" scrolling="no">
 </iframe>

But when I attempt to embed this on any page, I get the following image...

My Apps Script is set to anyone can view. So I am assuming that within my .gs code, the HtmlService.XFrameOptionsMode.ALLOWALL is not set properly.

I can see my web app in Incognito mode if I go there directly through the browser. But how can I fix this situation so that my iframe properly reflects my web app?

I'm reading through the Google Apps Script docs in order to get a grip. Below is my attempt in my .gs file to allow for my web app to be embedded as an Iframe...

function doGet(e) {

  //URI PARAMETER VALUE(S)
  let mpage = 'mapp';
  if ('page' in e.parameters) {
    mpage = e.parameters['page'][0]
  }

  try {

    //TRY TO ENABLE THE WEB APP WITH CUSTOM DATA USAGE
    let html = HtmlService.createTemplateFromFile(mpage);
    html.data = { title: mpage, e: e }
    
    //THE ONLY WAY I KNOW OF ADDING META TAGS TO THE APP
    let htmlOutput = HtmlService.createHtmlOutput(html.evaluate().setXFrameOptionsMode(HtmlService.XFrameOptionsMode.ALLOWALL));
    htmlOutput.addMetaTag('viewport', 'width=device-width, initial-scale=1, shrink-to-fit=no');
    return htmlOutput;
  }
  catch (err) {
    //IF THERE IS AN ERROR, DISPLAY THE ISSUE
    const html = HtmlService.createHtmlOutput('Page Not Found : ' + JSON.stringify(err));
    return html;
  }
}

Here is my html example of the actual embed....

 <iframe src="https://script.google/a/macros/.../exec?page=mapp-gallery" frameborder="0" width="100%" height="100%" scrolling="no">
 </iframe>

But when I attempt to embed this on any page, I get the following image...

My Apps Script is set to anyone can view. So I am assuming that within my .gs code, the HtmlService.XFrameOptionsMode.ALLOWALL is not set properly.

I can see my web app in Incognito mode if I go there directly through the browser. But how can I fix this situation so that my iframe properly reflects my web app?

• google-apps-script
• web-applications

Share Improve this question Follow edited Mar 27 at 13:03 klewis asked Mar 27 at 12:56 klewisklewis 8,4081616 gold badges6969 silver badges112112 bronze badges

Add a comment  | 

1 Answer 1

Sorted by: Reset to default 1

let htmlOutput = HtmlService.createHtmlOutput(html.evaluate().setXFrameOptionsMode(HtmlService.XFrameOptionsMode.ALLOWALL));

HtmlTemplate.evaluate() already returns HtmlOutput. And you set ALLOWALL option on it. But, by feeding the HtmlOutput back to HtmlService.createHtmlOutput, you're creating a new HtmlOutput without a xframe option set on the new object. Fix it by removing redundant and buggy calls:

let htmlOutput = html.evaluate().setXFrameOptionsMode(HtmlService.XFrameOptionsMode.ALLOWALL);

Make sure to redeploy or create a new version on the existing deployment. You might also want to set the same on the catch block's HtmlOutput.

本文标签： web applicationsProperly setting the XFrameOptionsMode for Google Apps Script IframesStack Overflow