script.google.com拒绝连接排查：Google Apps Script菜单点击异常

我正在从ColdFusion转用Google Apps Script，想复刻之前CF里的菜单系统。代码能运行，但点击页面内的菜单链接时会出现「script.google.com refused to connect」错误。复制链接到新窗口打开却能正常访问，这和常见的accounts.google.com相关问题不一样。

这次是第二次尝试，已经根据之前的建议重写了代码，现在全是gs文件，没有HTML模板。系统会根据用户邮箱从Google Sheet拉取数据，生成用户有权访问的菜单HTML表格，这部分逻辑是正常的，就是直接点击链接报错。怀疑问题不在代码本身，求排查思路。

代码文件 #

Code.gs #

/*

* * Created by Jukebox

* * 

* * Response handler based on a template example by Rafael Vidal

* * 

*/

// These are the entry points, just two lines of code to anchor them
// All the rest is run from the handleResponse() function
// It sends the get and post requests to the same function
// Parameters can have the same name in either Get or Post
// A response may need to check that it is Get or Post and throw the other out
// There is no point processing a form if doGet was used (no form!)
// That's all folks

function doGet(e)  {return handleResponse(e,'doGet'); }
function doPost(e) {return handleResponse(e,'doPost'); }

responsehandler.gs #

// This function will fire when a raw page request comes in
//    and also in the case of Get or Post. 
// All calls to the web site are handled here. 
// There are no other html pages in the system, 
//    as all the work is done by functions. 
// The parameter ActionCode is used to control which functions are used. 

function handleResponse(e,fromGetOrPost)
  {
// Firstly extract the elements that will be added to the log
    var thisCurrentUser = Session.getActiveUser().getEmail();
    var thisCallType    = fromGetOrPost;
    var thisActionCode  = e.parameter.actioncode;
  
// Then log them in the spreadsheet for future reference
    var spreadsheet = SpreadsheetApp.openByUrl(getSheetUrl());
    var sheet       = spreadsheet.getSheetByName('logit');
        sheet.appendRow([thisCurrentUser, new Date(), thisCallType, thisActionCode]);

// Identify the web page location        
    var thisWebAddress  = getHtmlUrl();

// Now build up the html page in modules
    var HTMLString = "<html>";
        HTMLString = "<head><title>My first world</title></head>";
        HTMLString = HTMLString + "<body>";
    var menublock = interogatemenu(thisCurrentUser,thisActionCode,thisWebAddress);
        HTMLString = HTMLString + menublock;
        HTMLString = HTMLString + fwc();
        HTMLString = HTMLString + swc();
        HTMLString = HTMLString + "</body></html>";

        HTMLOutput = HtmlService.createHtmlOutput(HTMLString);
    return HTMLOutput
  }

staticdata.gs #

// function to return the URL of the spreadsheet
function getSheetUrl()
  {
    var    sheetRrl = 'https://docs.google.com/spreadsheets/d/1MQp50DY3U4rNQmjaa5YI2UnvrUA9fNE5J_upSLE1D4c/edit#gid=0';
    return sheetRrl;
  }

// function to return the URL of the App Script
function getHtmlUrl()
  {
    var    execRrl = "https://script.google.com/macros/s/AKfycbygbQGKjER0tdYbvVUHysu3iqCw9burRlM5EWqogpTpRac7mbNIdXCz6Uy2pFFp7jDE/exec"
    return execRrl; 
  }

interogatemenu.gs #

function interogatemenu(tcu,tac,twa)
  {
    var spreadsheet    = SpreadsheetApp.openByUrl(getSheetUrl());
    var sheet          = spreadsheet.getSheetByName('permits');
    var int_uptally    = sheet.getRange("K4").getValue();
    var tx_useremail   = "demo@example.com"
    var tx_menuitem    = "example";
    var tx_permitlevel = "N/A";
    var tx_menutext    = "An Example";

    var menustring     = "<br>Menu Table Starting<br><table border = 1>";
    
    for(i=3;i<=int_uptally+2;i++)
    {
      tx_useremail     = sheet.getRange("A4").offset(i-3,0).getValue();
      tx_menuitem      = sheet.getRange("B4").offset(i-3,0).getValue();
      tx_permitlevel   = sheet.getRange("C4").offset(i-3,0).getValue();
      tx_menutext      = sheet.getRange("G4").offset(i-3,0).getValue();
      if(tx_useremail  = tcu)
      {
        if(tx_permitlevel == "R/O" || tx_permitlevel == "R/W")
        {
          menustring = menustring + "<tr>";
          menustring = menustring + "<td>";
          menustring = menustring + "<a href=";
          menustring = menustring + String.fromCharCode(34);
          menustring = menustring + twa;
          menustring = menustring + "?actioncode=";
          menustring = menustring + tx_menuitem;
          menustring = menustring + String.fromCharCode(34);
          menustring = menustring + ">";
          menustring = menustring + tx_menutext;
          menustring = menustring + "</a>";
          menustring = menustring + "</td>";
          menustring = menustring + "</tr>";
        }
      }
    }    
    menustring = menustring + "</table><br>Menu Table Complete<br>";

    return menustring;

  }

content.gs #

// demo of content - first world content
function fwc()
  {
    localstring = "Hello and welcome to My first World<br><br>";
    return localstring;
  }

// demo of content - second world content
function swc()
  {
    localstring = "Hello and welcome to My second World<br><br>";
    return localstring;
  }

• 修正链接打开方式：当前生成的<a>标签没有指定target属性，默认在当前上下文（可能是iframe）打开，触发了Google的跨域限制。给标签加上target="_top"或target="_blank"，强制在顶层窗口或新窗口打开链接，比如修改interogatemenu.gs里的链接生成代码，添加 target='_top'。
• 检查X-Frame-Options头：HtmlService默认会添加X-Frame-Options: SAMEORIGIN头，阻止页面在非同源iframe中加载。测试时可以临时设置HTMLOutput.setXFrameOptionsMode(HtmlService.XFrameOptionsMode.ALLOWALL)，但正式环境需评估安全性。
• 修复逻辑bug：interogatemenu.gs里的if(tx_useremail = tcu)是赋值操作而非相等判断，应改为if(tx_useremail == tcu)，否则会导致菜单权限逻辑错误。
• 查看浏览器控制台错误：打开F12开发者工具的Console标签，点击链接时查看具体报错信息，比如是否有CSP（内容安全策略）限制，能更精准定位问题。
• 确认部署权限与版本：检查脚本部署的权限范围是否正确，确保用户能正常访问；同时确认部署的是最新版本，避免缓存的旧代码导致异常。

内容的提问来源于stack exchange，提问作者Jukebox Jory