SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I can use any sort of console in Firebug, Developer Tools, etc. to access any Javascript included in a page and make calls to Javascript functions without a problem.

If, on a SharePoint page, I use the Client Object Model, doesn't this pose a massive threat to the SharePoint site by exposing service calls that allow you to completely interrogate and manipulate SharePoint objects?

What's stopping a visitor from firing up a console in the browser and doing damage?

share|improve this question
This thing is called SharePoint permission. You can not do actions through COM that is not allowed for the curent loged in user. – Alexander Nov 28 '12 at 17:13
up vote 5 down vote accepted

SharePoint permissions. If a user does not have permissions to view a list, they won't be able to retrieve it. If a user does not have permissions to delete a list item, they won't be able to delete it.

While this does expose the site to CSOM code, the idea is users should only have permissions to perform actions they should have access to.

If you don't trust a user, don't give them the permissions.

share|improve this answer
you was faster ))) – Alexander Nov 28 '12 at 17:16
Lol, indeed sir. – RJ Cuthbertson Nov 28 '12 at 17:19

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.