2
votes

Is is possible to embed a HTMLService app in an iframe?

Embedded Example: http://jsbin.com/axesex/1/edit

The app can be embedded within Google Site but not into any other standard web page. The console throw the error...

Refused to display 'https://script.google.com/a/macros/netpremacy.com/s/AKfycbxITmxBMsHIh_u82tbvfICzNesEUJh2MRe7izyDE9cgvaLPCZI/exec' in a frame because it set 'X-Frame-Options' to 'SAMEORIGIN'.

If you need any more information please let me know.

3
Here is the Issue Tracker item that you can add your details to and star/follow for this feature request - code.google.com/p/google-apps-script-issues/issues/…Arun Nagarajan
Thanks for your commentElliott Shafii

3 Answers

3
votes

Updated 3/24/2017

Yes, but you need to set an extra flag on your output to allow it to be IFRAMEd:

// Serve HTML with no X-Frame-Options header (in Apps Script server-side code).
var output = HtmlService.createHtmlOutput('<b>Hello, world!</b>');
output.setXFrameOptionsMode(HtmlService.XFrameOptionsMode.ALLOWALL);
0
votes

It seems you can do that using setxframeoptionsmodemode:

//-- Serve HTML with no X-Frame-Options header (in Apps Script server side code).
var output = HtmlService.createHtmlOutput('<b>Hello, world!</b>');
output.setXFrameOptionsMode(HtmlService.XFrameOptionsMode.ALLOWALL);

Can read more about this in: https://developers.google.com/apps-script/reference/html/html-output#setxframeoptionsmodemode

-2
votes

A possible equivalent might be to use JSONP. Basically modify the Google Apps script to output JSON (of a text/javascript mime-type) that is passed as a parameter to a function (which you'll create on the client side. The output of the apps script will look like:

client_side_handler(JSON HERE...);

And in your client page you'll have a script with something like:

function client_side_handler(json){
    //make all my wildest dreams come true here.
}

To call the apps script, you'll have another script tag that specifies the apps script as a src. Thankfully, script tags don't have the cross-site limitation that iframes do.