on-premise sharepoint hosted app, anonymous access

Question

I have been wrestling with a permissions issue for a SharePoint hosted app. I have gone through all the permission settings for anonymous access so I am 90% sure it is all correct. So, now I am looking at the actual app code now...

This is a public facing site.

Is the code below correct?

        executor.executeAsync(
        {
            url:
               appweburl +
               "/_api/SP.AppContextSite(@target)/web/title?@target='" +
               hostweburl + "'",
            method: "GET",
            headers: { "Accept": "application/json; odata=verbose" },
            success: successHandler,
            error: errorHandler
         }

App manifest permissions:

<AppPermissionRequests AllowAppOnlyPolicy="true">
    <AppPermissionRequest Scope="http://sharepoint/content/sitecollection/web/list" Right="Read" />
    <AppPermissionRequest Scope="http://sharepoint/content/sitecollection/web" Right="Read" />
</AppPermissionRequests>

Still prompts me for credentials.

Update:

I am trying to follow the following:

http://msdn.microsoft.com/en-us/library/office/dn579415(v=office.15).aspx

Since I already set the site to allow anonymous I did the following:

• I removed the app from the app catalog, site content and from the page itself.
• I went to central admin, Manage web applications, clicked on site, went to authentication providers, unchecked Enable Anonymous
• reset iis to be safe
• reinstalled the app to app catalog
• added and trusted the app to site content
• I went to central admin, Manage web applications, clicked on site, went to authentication providers, checked Enable Anonymous

Still to no avail. Still required to login...

I even tried unchecking "Require Use Remote Interfaces Permission"...

unchecking "Require Use Remote Interfaces Permission" got rid of the credential issue but I still I get an error that I don't have any context.

Answer 1

The rest interface is not available to anon users by default. It can be enabled, but MS recommends against it. The preferred solution is to enable the search rest api for anonymous access, and retrieve all data that you need via that.

A good article that explains the above in detail.

Waldek's post that is a good explanation of how to enable the search api for anonymous

Another short writeup that addresses a couple additional challenges