在Excel的嵌入式浏览器中为Windows解锁CORS

Question

I'm developing an Excel add-in. I need to test the add-in in Excel for Windows in my virtual machine of Mac. Therefore, I use <AppDomain>https://192.168.1.1:8000</AppDomain> and eg, <SourceLocation DefaultValue="https://192.168.1.1:8000/#/app" /> in the manifest file.

I use this add-on in Microsoft Edge in the virtual machine, as a result, the add-in can be run in Excel Online in Edge without problem.

Then I try to run the add-in with the same manifest in Excel for Windows. Then it raises an error Access to XMLHttpRequest at 'https://www.backend.io/...' from origin 'https://192.168.1.1:8000' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.

I believe the browser embedded in Excel for Windows is Edge. I'm surprised that unblocking CORS in Edge does not unblock CORS in Excel for Windows. Is it an expected behavior?

Does anyone know how we could unblock CORS in the embedded browser of Excel for Windows?

Answer 1

There are several solutions for bridging the gap with CORS:

• Use JSONP for anonymous access
• Implement server-side code using a token-based authorization scheme
• Use cross-origin resource sharing (CORS)
• Build your own proxy using IFRAME and POST MESSAGE (Cross-Window Messaging)

Read more about possible solutions in the Addressing same-origin policy limitations in Office Add-ins article.