How to dynamically set frames in Forge manifest?

Forge
1

Earlier in Forge, we could open any external website in an iframe by setting:
external:
frames:
- “*”
Now, the * wildcard no longer works, and we have to manually list each domain.

for example:
external:
frames:
- www.google.com
In my use case, the external link changes dynamically based on user actions, so I can’t always know the domain in advance.

Is there any way to dynamically set or update the frames in manifest.yml without hardcoding each link?

2

Hey @AyashaSikilkar,

I’m unable to find reference to changes which would have impacted this in the changelog - I’d recommend raising a developer support ticket to have this investigated by the owning team.

Looking forward, we are working on delivering Customer Managed Egress which would support the ability for customers to define which frames can be added, rather than having to declare *.

3

Hey @AyashaSikilkar

if you do

external:
  frames: ['*']

does this work for you?

4

Hey @LoganElliott,

The solution you suggested is working, but while deploying, I can see 2 warnings:

  1. Warning: Global URL usage detected for ‘external. frames’ permission in the manifest.yml file. We recommend using a more specific URL. valid-permissions-required.

  2. warning: There are deprecated egress permission entries for ‘frames’ in the manifest.yml file, valid-permissions-required

5

Hi @AyashaSikilkar

Warning 1 is expected because you are using a wildcard egress is not recommended.

Warning 2 is because the now recommended way to write egress is like so:

permissions:
   external:
      fetch:
         client:
            - address: '*.example-dev.com'
              category: analytics
              inScopeEUD: false

doing

permissions:
  external:
     fetch:
       client:
         - address: '*'

also works

see https://developer.atlassian.com/platform/forge/manifest-reference/permissions/#egress-permissions for details

6

Hi @Logan Elliott,

Thank you for the clarification.

7

I assume this structural change in how egress permissions are declared will result in a major version update, requiring a manual app update?

And the problem with that is ~90% of admins do not manually update apps. And the problem with that is you quickly end up with Forge apps where ~99% of installs are running outdated/broken app versions.

Meanwhile Atlassian just randomly makes these frivolous changes every few weeks with no regard to this versioning death spiral.

2 Likes