从 web 应用程序中使用 Javascript 打开 URL

Question

I have this code in my html javascript: window.location.assign('https://script.google.com/a/macros/smapostols.org/s/AKfycbz2BP0c6D7fdDDJUlRHcsCvNKoMuHW1_tN_wVy5iFs/dev?p=ok');

and it doesn't work, error: The page script.google.com refused connection .

This works fine with another URL (ie http://www.google.com ) and also works fine with: window.open('https://script.google.com/a/macros/smapostols.org/s/AKfycbz2BP0c6D7fdDDJUlRHcsCvNKoMuHW1_tN_wVy5iFs/dev?p=ok');

Does anybody know the problem?

Answer 1

Possible Answer:

Try setting the XFrameOptionsMode to ALLOWALL when serving your HTML.

More Information:

As per the developer documentation on XFrameOptionsMode :

An enum representing the X-Frame-Options modes that can be used for client-side HtmlService scripts. ... Setting `XFrameOptionsMode.ALLOWALL will let any site iframe the page, so the developer should implement their own protection against clickjacking.

Properties

Property	Type	Description
ALLOWALL	Enum	No X-Frame-Options header will be set. This will let any site iframe the page, so the developer should implement their own protection against clickjacking.
DEFAULT	Enum	Sets the default value for the X-Frame-Options header, which preserves normal security assumptions. If a script does not set an X-Frame-Options mode, Apps Script uses this mode as the default.

Example:

function doGet() {
  return HtmlService.createHtmlOutputFromFile('filename')
    .setSandboxMode(HtmlService.SandboxMode.IFRAME)
    .setXFrameOptionsMode(HtmlService.XFrameOptionsMode.ALLOWALL);
}

References:

• Enum XFrameOptionsMode | Apps Script | Google Developers