Office JS API pass OAuth token from host to dialog in Outlook Add-in

Question

I am currently struggling with security dilemma how to pass securely the OAuth token from parent page in Outlook O365 to dialog window. According to Microsoft documentation there are only two ways how to achieve that:

• localStorage
• query parameter

What I don't understand why Microsoft has a methods(*) for communication from dialog to parent page and not from parent page to dialog?

* from documentation:

dialog.addEventHandler(Office.EventType.DialogMessageReceived, processMessage); dialog.addEventHandler(Office.EventType.DialogEventReceived, processMessage);

So my questions are:

• Is there any way how to pass the OAuth token from parent page to dialog with the internal methods of Office JS?
• Why Microsoft has developed only one way communication between parent page and dialog?

Edit:

I refer the parent page as a New Meeting window in Outlook and as a dialog I refer the dialog as iFrame (Office.context.ui.displayDialogAsync()). I have skipped the taskpane step and firing up the dialog directly when the addin button is clicked. My intention is to send the OAuth (bearer) token from parent page (since user is already validated to access O365 mailbox) to dialog.

As Rick noted, the data can be passed from parent to dialog by localStorage or query parameter. But my question is why Office JS Api is missing the methods for communication from parent to dialog (when the opposite way has methods for that).

Answer 1

There are three actors that need to be kept distinct: The dialog, the parent page (usually in a taskpane), and the Office host application (e.g., Excel, Word, etc.). The current wording of your question makes it difficult to discern which two actors you are talking about. The parent page can pass things, including tokens if that's ever required, to a dialog with query parameters or local storage. But ordinarily you would use a dialog to get an access token and pass the token in the other direction, from dialog to parent page. You do this using the messageParent API.

When you refer to the "host" in your question are you talking about the parent page (probably in a taskpane)?

EDIT:

OK. I think I understand the question now. You are asking for an API in Office.JS that can be called in the parent page and sends info to a PREVIOUSLY OPENED dialog. We've gotten requests for that and you can vote up the request here on Office Developer User Voice. However, I can't give a timeline about when such an API will be available. In the meantime, the only way I know of to communicate from parent page to an already opened dialog is to use LocalStorage. Search for "how to communicate between windows using local storage?" and you'll find info on techniques for doing this.