I have an Excel365 add-in that allows importing and exporting data from an online application to Excel. However, I'm facing problems when trying to connect to a local server. The problem happens when the add-in sends the initial GET command to the REST API. The error message I see is:
Error: Request has been terminated Possible causes: the network is offline, Origin is not allowed by Access-Control-Allow-Origin, the page is being unloaded, etc. at q.crossDomainError
OK
However, if I send the same GET command manually, it works fine. Any ideas why my GET command from Excel does not work, but from any other application (VsCode, Postman, etc.) if works as expected? Thanks in advance.
The cause of the problem is CORS.
The same-origin policy enforced by the browser prevents a script loaded from one domain from getting or manipulating properties of a webpage from another domain. This means that, by default, the domain of a requested URL must be the same as the domain of the current webpage. For example, this policy will prevent a webpage in one domain from making XmlHttpRequest web-service calls to a domain other than the one where it is hosted.
Because Office Add-ins are hosted in a browser control, the same-origin policy applies to script running in their web pages as well.
The same-origin policy can be an unnecessary handicap in many situations, such as when a web application hosts content and APIs across multiple subdomains. There are a few common techniques for securely overcoming same-origin policy enforcement.
Read more about that and find possible solutions in the Addressing same-origin policy limitations in Office Add-ins article.