Search code examples
office-js

List of CORS domains for Office Online - Custom functions not loading


We are continuing to hit validation issues caused by our functions.json not loading due to a CORS issue, even though it works for us with every browser supported by Excel Online.

Support has been mostly unhelpful, sending us here and being unable to supply us with a list of CORS origins to whitelist on our server.

So far we have been able to deduce the following origins:

But even with these whitelisted domains, this is what the Microsoft testing team continues to send us:

internal team error report

We absolutely cannot reproduce the issue. Any help appreciated!


Solution

  • Found the issue - my CDN was caching the Access-Control-Allow-Origin header response regardless of the origin being sent in the request.

    Fixed it by duplicating my CORS rules in the CDN as described here: https://learn.microsoft.com/en-us/azure/cdn/cdn-cors#one-regular-expression-with-all-valid-origins