Forge Studio, embedded cross-origin

This page lives on embed-demo.jnc360.tech and embeds the editors from editors-qa.jnc360.tech — a genuinely different origin, the way a real customer site would. Every postMessage below targets the editor's origin and every reply is origin-checked.

1 · Host-controlled document (load / export)

Push content in with forge:load, pull the edited .docx back with forge:export — across origins.

Host controls:

2 · Save with identity-in-path (savepath + encryption)

The embed is handed an absolute savepath=https://embed-demo.jnc360.tech/demo-store/user42/report.docx — the path carries the user's identity, and the store is a real service on this host (watch the network tab: saves POST and loads GET embed-demo.jnc360.tech, cross-origin, the way your API endpoint would). Save, then reload the frame — the document comes back. Turn on encryption and the stored bytes become AES-GCM ciphertext.

Embed properties — edit, then reload the frame with them: savepath encrypt passphrase view (read-only) src

Files on ACME

loading…

waiting for forge:saved…

3 · Read-only share (?view=1) — form fields stay active

A shared document is locked for editing but its form fields work (fill mode auto-enables). Viewer below is a read-only spreadsheet for comparison.