Office Online Server editing doesn't work when Cloudflare DNS/WAF is used

Original Question

or Issue:

Environment:

• Product - Any
• Version - Any
• Platform - Any

Route the traffic to on-prem Office Online server via Cloudflare.

Defect or

Enhancement Number:

Resolution or

Workaround:

Checked Cloudflare for specific "Response Header Transform Rules" or "Managed Transforms" have "Add security headers" enabled. This needs to be overridden with some custom content security rules to allow cross scripting with FileCloud URL in your Cloudflare, based on your organizations Cloudflare policies.

This may not be caused by an issue at the FileCloud .htaccess file. If the browser console shows errors related to default-src or SAMEORIGIN, please make sure the Office Online server URL is added to default-src and frame-ancestors in the .htaccess file.

Example: 

Header set Content-Security-Policy: "default-src 'self' oos.filecloudlabs.com ........ \
    connect-src ............... \
    style-src ................. \
    script-src .................. \
    font-src ..................... \
    img-src ....................... \
    frame-ancestors 'self' oos.filecloudlabs.com ............ \
    worker-src ................."