HTTP fetch from within Outlook add-ins

Question

I need to call an external web service so that my add-in communicates with our company's Java servlets. I tried using JavaScript's XMLHttpRequest:

var http = new XMLHttpRequest();
http.open( "GET", url2, true );
http.onreadystatechange = function(){
    console.log( 'Data: ' + http.responseText + '\nStatus: ' + http.status );
}

and specifying Google's main site as whitelisted:

<AppDomains>
    <AppDomain>https://www.google.com/</AppDomain>
</AppDomains>

to try if it works, but every time I run it this is what I get:

Failed to load https://www.google.com/: Redirect from 'https://www.google.com/' to
'https://www.google.es/?gfe_rd=cr&dcr=0&ei=TFjDWub9No-aX5TXg7AK' has been blocked
by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested
resource. Origin 'https://localhost:3000' is therefore not allowed access.

Data: attachmentsSelectionScreen.html?recordName=A:223
Status: 0

I searched how to make an cross-origin HTTP request specifically for Outlook add-ins and came to Call web services from an Outlook add-in, given how closely its name resembles what I needed, but only found there information about how to interact with Outlook itself (create folder, mark as junk, etc.).

How can I, for instance, make a simple request to https://www.google.com from my add-in and fetch the response?

Thank you so so much!

Answer 1

You are on the right direction, indeed. To retrieve information from 3rd party web service, you would need:

• Make request with XMLHttpRequest or $ajax, etc.
• Add the service URL into manifest's AppDomains list
• Use only services which are under SSL connection (https://)

Basically you are done, you should be able to get the information from the service. All other issues you may experience related to the service itself, not your calls from inside of the add-in. For example: google redirects you to the https://www.google.es which is not declared under your AppDomains list. The service itself may not be available to provide with any information and you may get 403 response. The service may not allow CORS requests or may allow it under certain authorization via tokens, licenses, etc. The following sources may help you to get more on the topic:

• Addressing same-origin policy limitations in Office Add-ins
• Authorize external services in your Office Add-in

Basically this is up to the service. This is the reason why ppl are usually write their own service, which will allow the add-in request, because they have full control over it. This service in the same time may do certain sub-requests to other services to get required information.