A reliable way to get the origin of an Office add-in

Question

I am currently implementing an Outlook add-in. It shows the user a pop-up window whenever the user is about to perform a potentially dangerous action, to protect against clickjacking attacks .

I was hoping not to show the user a popup every time they use the add-in - only the first time they use it from a new host source. Is there a way to get the proven origin of the Office add-in host, so I can remember that the user trusts him next time?

Now I am listening postMessagefrom the host (e.g. https://outlook.office.com ) in the Office.js SDK and looking originat MessageEvents, but it seems very fragile.

Answer 1

I am interested in learning more about the attack vector that you describe here. This is someone creating https: // evilspoof / and placing your web application inside an iframe. Then, so that the end user goes to https: // evilspoof / and clicks some things inside your add-in?

Do you authenticate your users somehow? And they were worried that if they log into your site legally ... then when they go to the malicious site, they are already logged in, and thus the clicks / actions on your page will work, since they have already been authenticated?

: https://dev.outlook.com/reference/add-ins/Office.context.mailbox.html#getUserIdentityTokenAsync

. Exchange Server , . OWA/Outlook, . , getUserIdentityToken, . . , . , - ( ), ... ... ?

Answer 2

. , , .