Search code examples
google-apps-scriptweb-applicationsx-frame-options

HtmlService.XFrameOptionsMode.ALLOWALL not working


Having set the XframeOptionMode, the doPost still doesn't redirect:

var REDIRECT_URL = "https://stackoverflow.com";

function doGet() {
  var template = HtmlService.createTemplateFromFile("CForm.html");
  template.pubUrl = ScriptApp.getService().getUrl();
  var html = template.evaluate();
  html.setTitle('ABCD');
  return HtmlService.createHtmlOutput(html).setXFrameOptionsMode(HtmlService.XFrameOptionsMode.ALLOWALL);
}

function doPost(e){
  SendHtmlMail(e);
  return redirect().setXFrameOptionsMode(HtmlService.XFrameOptionsMode.ALLOWALL);
}

function redirect() {
  return HtmlService.createHtmlOutput(
    "<script>window.top.location.href=\"" + REDIRECT_URL + "\";</script>"
  );
}

The console error still remains

Refused to display 'https://script.google.com/macros/s/AKfycbyb3wh57wgW30KV8faQNqNXSDQ_zu8w3BR-_8kVwUbI/dev' in a frame because it set 'X-Frame-Options' to 'sameorigin'.

Relevant part of the HTML

        <form class="container" id="main_form" method="post" action="<?= pubUrl ?>">
    
            <div class="form-group">
                <label>Business Name</label>
                <input type="text" class="form-control" name="BusinessName" id="name" placeholder="Name of Upload" readonly>
            </div>
    
            <div class="form-group">
                <label>Month and Year of Incorporation</label>
                <input type="date" class="form-control" name="MonthandYearofIncorporation">
            </div>
            <input class="btn btn-md btn-success" type="submit" value="Apply for Carbon"/>
        </form>


Solution

  • Though, manually pasting (hardcoding) the /exec url version of the script seems to alleviate the issue, I prefer not to.
    I dropped the doPost and redirect function. Now my html now has script like:

    <html>
        ...
        <body>
            ... First page ...
            ... Second page ...
            <form class="container d-none" id="main_form" method="post" action="<?pubUrl?>" onsubmit="submitter(this);">
        
                <div class="form-group">
                    <label>Business Name</label>
                    <input type="text" class="form-control" name="BusinessName" id="name" placeholder="Name of Upload" readonly>
                </div>
        
                <div class="form-group">
                    <label>Month and Year of Incorporation</label>
                    <input type="date" class="form-control" name="MonthandYearofIncorporation" required>
                </div>
                ... A very long form
                <input class="btn btn-md btn-success" type="submit" value="Apply for Carbon"/>
            </form>
           ...
        </body>
        <script>
          //...
          function submitter(data_process){
            // Run server-side function when submitted.
            google.script.run
                .withSuccessHandler(function(){
                  //alert('Thank You!!! Your application has been received');
                  window.top.location.replace("https://stackoverflow.com");
                })
                .withFailureHandler(function(e){
                  alert("Unable to submit your application. Please contact us.");
                  })
                .SendHtmlMail(data_process); // Server-side form processing     
          }
        </script>
    </html>