[Bug] CORS Issue for SharePoint Images

[mungamurives]

Describe the bug

I have connected the SharePoint with PAC command, particularly a document library, where I want to use one of the image as Banner Image in Code Apps application. When it is running locally, image is loading properly. But when I publish the app, then image is not loading and I am able to see CORS issue on the console. Ideally this is the connected data source not something external link according to code apps.

Steps to Reproduce

1. Connected the SharePoint document library as the data source.
2. With the get function I am calling a particular item (means an image).
3. Appending the image as a background image for the code apps application.
4. Getting CORS issue after publishing.

Expected behavior

At least connected data sources needs to be loaded without any CORS, because we have already added the data source URL inside schema too.

Actual behavior

Images as not loading, is it because Code Apps is running in an iframe ?

Screenshots or Error Messages

Environment information

• Framework, build tool or relevant package used: [React]
• Any connection/components: [SharePoint]

Additional context

[saussam18]

I will try and repro this to see what may be going on, not sure if the issue would be on Power Apps, Sharepoint, or if its a security thing that we are blocking.

The other option would be to pull down the image into the app directly using a public folder, and then adding it as the banner to unblock you for now

[mungamurives]

Yes Sam, at the moment I am just exploring the product. I have moved the image under Assets, which is working fine. The version of Power Platform extension I am using is 2.0.94.

I am ok to open a new bug, but even when I am planning to create a single page application (means implementing routing from React), it also has some issue.

Due to iframe concept, when I am trying to append a parameter to the URL, it's not working there.

[saussam18]

Yeah my hunch is this is actually an issue on Sharepoint only allowing their content to be framed by specific domains, otherwise CORS will reject it. For local, the app domain is "http://localhost", which they probably allow, but not our Power Apps backend urls for Code Apps.

Will need to discuss with team if this is something canvas supports today, and if so then we will need to work with sharepoint to add the code app urls to the CORS allowlist