Starting on December 9th, my web app PavOra (used for event scheduling and booking) began to show a critical usability issue: switching between sidebars became unstable or silently failed, making the app partially unusable.
At first, I assumed it was a temporary bug. Over time, it became clear that the issue was related to recent Google security changes affecting iframe handling and HTML sandboxing in Apps Script add-ons.
The issue
The new security policies caused sidebar reloads to become unreliable, especially when:
- multiple HTML files are loaded via
showSidebar() - dynamic templates are used
- failures occur without explicit errors
As a result, an app that previously worked fine suddenly became unstable, forcing users to reopen menus or reload the sidebar multiple times.
Related issues:
As of now, the problem is still unresolved.
Temporary workaround
To keep PavOra usable, I applied a short-term fix:
- the initial page now loads the admin interface
- the app opens directly on the main event management sidebar
- event creation/editing is handled via a modeless dialog instead of a sidebar
This worked, but the UX was far from ideal.
Final (current) solution
During the Christmas break, I redesigned the UI architecture:
- a single HTML sidebar
- internal navigation handled entirely via JavaScript
- an initial server call to:
- fetch structures and permissions
- dynamically assign user roles (read, write, admin)
The result:
- stable UI
- no sidebar reloads
- full compatibility with Google’s new sandbox restrictions
Video walkthrough
In the accompanying video, I walk through:
- the issue
- the temporary workaround
- the final (current) solution
Hopefully, this can help other developers working with Google Apps Script add-ons facing similar problems.
➤ PavOra is available on GitHub: https://github.com/rainnic/PavOra
