// Serve HTML with no X-Frame-Options header (in Apps Script server-side code).constoutput=HtmlService.createHtmlOutput('<b>Hello, world!</b>');output.setXFrameOptionsMode(HtmlService.XFrameOptionsMode.ALLOWALL);
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["没有我需要的信息","missingTheInformationINeed","thumb-down"],["太复杂/步骤太多","tooComplicatedTooManySteps","thumb-down"],["内容需要更新","outOfDate","thumb-down"],["翻译问题","translationIssue","thumb-down"],["示例/代码问题","samplesCodeIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-07-26。"],[[["\u003cp\u003e\u003ccode\u003eXFrameOptionsMode\u003c/code\u003e is used to control how a client-side Apps Script HTML service can be embedded in iframes by other websites.\u003c/p\u003e\n"],["\u003cp\u003e\u003ccode\u003eALLOWALL\u003c/code\u003e permits any website to embed the page in an iframe while \u003ccode\u003eDEFAULT\u003c/code\u003e preserves the standard security behavior.\u003c/p\u003e\n"],["\u003cp\u003eIf you select \u003ccode\u003eALLOWALL\u003c/code\u003e, ensure to incorporate your own security measures against clickjacking.\u003c/p\u003e\n"],["\u003cp\u003eBy default, if \u003ccode\u003eX-Frame-Options\u003c/code\u003e mode isn't specifically set, Apps Script automatically applies the \u003ccode\u003eDEFAULT\u003c/code\u003e mode.\u003c/p\u003e\n"]]],["`XFrameOptionsMode` is an enum for setting `X-Frame-Options` in client-side HtmlService scripts. Accessed via `HtmlService.XFrameOptionsMode`, it's set using `HtmlOutput.setXFrameOptionsMode(mode)`. `ALLOWALL` removes the `X-Frame-Options` header, enabling any site to iframe the page, necessitating developer-implemented clickjacking protection. `DEFAULT` is the default mode if no mode is specified. The example shows how to set the mode to `ALLOWALL`.\n"],null,[]]
