CORS issue/error with UI5 app that uses oData and running as an Office Add-in

Question

I need some advice/solutions.

We have an Excel Add-in written with officejs. It's an SAP UI5 (Fiori) app. We also use an OData service to retrieve data from the server. The app and the OData service are both on the same SAP Server (they have the same domain and port for clarity sake let's say they use https://test.sap.com:44320).

If I run this app standalone (in a browser) without Excel OR in Excel Desktop (sideloaded) then the data loads as expected.

However, if I run this app in Excel Online (sideloaded) then the data doesn't load and we get CORS issues. It seems to be with only POST calls as those are the ones that error (403) with the message being "Forbidden" (We are logged in and everything and it's not a permissions issue because it works in other scenarios).

If we look in the Network tab in dev tools for these calls the response headers have this warning "This Set-Cookie didn't specify a "SameSite" attribute...". I understand that I have to set the SameSite attribute to None (or my guess is that will solve the issue), however,

1. I don't understand why this isn't a problem when running the app in the above-mentioned scenarios
2. Or how to set the SameSite attribute in the OData service? (or if this will even solve the issue).

The only difference between the scenarios that work vs the one that doesn't is the iframe. I've also used this UI5 tool that runs the UI5 app in an iframe and I get the same issue there.

I've also tried adding the domain (https://test.sap.com:44320) in the manifest.xml file for Excel (the AppDomain property) and it didn't work.

Is there anyone else that encountered the same issue before that can assist or even point me in the right direction?

Answer 1

Sorry that I could not figure out a very clear way to solve your problem. But would you please try the ways in the following doc to see if it helps? Thank you!
https://learn.microsoft.com/en-us/office/dev/add-ins/develop/addressing-same-origin-policy-limitations