金融行业高安全环境下Office Web Add-in端口限制及运行可行性问询

Great question, especially for highly regulated environments like banking/finance. Let's break this down clearly:

Core Port Dependencies & Impact of Blocked 80/443 #

• Port 80 (HTTP): In production environments, Office Web Add-ins do not support HTTP at all—Microsoft's security policies require all production Add-in resources (including the manifest and the add-in itself) to use HTTPS. So blocking port 80 won't directly break a properly configured production Add-in, but if your manifest or add-in accidentally uses HTTP (port 80), that will fail regardless of port blocking.
• Port 443 (HTTPS): This is the standard port for HTTPS, and while Office technically supports HTTPS on non-standard ports (e.g., 8443), the reality is that most production Add-ins rely on 443 because it's the only HTTPS port commonly allowed in strict enterprise firewalls. If port 443 is blocked, your Add-in will almost certainly fail to load in production—even if you use a non-standard HTTPS port, high-security environments like banks typically block all non-approved ports, so that workaround is unlikely to work.

Manifest URL Rules #

• Manifest Location: The URL hosting your Add-in's manifest must be HTTPS (production only; localhost HTTP is allowed for development). You can use a non-443 port for this URL, but again, the client's firewall needs to allow traffic to that port.
• Add-in Source Location: The actual add-in application URL (specified in the <SourceLocation> element of the manifest) also must be HTTPS in production. This can point to any valid HTTPS address, including those on non-standard ports, as long as:
  1. The client's network allows outbound traffic to that port and domain.
  2. The SSL certificate is valid and trusted by the client's machine (critical for banking environments with strict certificate pinning/trust stores).
• Local Development Exception: For testing on your own machine, you can use HTTP with localhost (e.g., http://localhost:3000)—Office allows this as a development loophole, but this won't work in production.

Recommendations for Banking/Finance Environments #

If your clients have 443 blocked, there's no straightforward way to run Office Web Add-ins in production. Here are your options:

1. Confirm 443 Access: First, verify if port 443 is actually blocked for your Add-in's specific domain. Sometimes firewalls block 443 for general internet but allow it for approved internal or trusted external domains.
2. Work with IT Teams: If 443 is blocked, collaborate with the client's IT department to get your Add-in's domain/port whitelisted. For non-standard HTTPS ports, this is possible but rare in high-security environments.
3. Alternative Add-in Types: If HTTPS access isn't feasible, consider Office COM Add-ins (desktop-only) or VSTO solutions, which don't rely on web-based resources. Note that these have different deployment and security requirements.

内容的提问来源于stack exchange，提问作者Sarang Datye