Skip to main content
SharePoint

Return to Question

added 4 characters in body
Source Link
Unnie
Unnie
  • 8.8k
  • 1
  • 22
  • 36

I have been working on a lot of applications with app-only policy and just wanted to make sure that I am not overlooking any security vulnerability. Below is a sample scenario for discussion:

  1. Provider hosted Add-in with Contribute permissions and app-only configured.
  2. Add-in has a page which reads data using App-only policy.

Now users who use this app do not have any permission on the SharePoint site. But can the user somehow hijack the App-only token in the browser and use REST calls to delete or edit items in the host web.?

I see from this post that App-Only calls can be used in REST calls in c#.

I have been working on a lot of applications with app-only policy and just wanted to make sure that I am not overlooking any security vulnerability. Below is a sample scenario for discussion:

  1. Provider hosted Add-in with Contribute permissions and app-only configured.
  2. Add-in has a page which reads data using App-only policy.

Now users who use this app do not have any permission on the SharePoint site. But can the user somehow hijack the App-only token in the browser and use REST calls to delete or edit items in the host web. I see from this post that App-Only calls can be used in REST calls in c#.

I have been working on a lot of applications with app-only policy and just wanted to make sure that I am not overlooking any security vulnerability. Below is a sample scenario for discussion:

  1. Provider hosted Add-in with Contribute permissions and app-only configured.
  2. Add-in has a page which reads data using App-only policy.

Now users who use this app do not have any permission on the SharePoint site. But can the user somehow hijack the App-only token in the browser and use REST calls to delete or edit items in the host web?

I see from this post that App-Only calls can be used in REST calls in c#.

Source Link
Unnie
Unnie
  • 8.8k
  • 1
  • 22
  • 36

Security Issues with App-only policy

I have been working on a lot of applications with app-only policy and just wanted to make sure that I am not overlooking any security vulnerability. Below is a sample scenario for discussion:

  1. Provider hosted Add-in with Contribute permissions and app-only configured.
  2. Add-in has a page which reads data using App-only policy.

Now users who use this app do not have any permission on the SharePoint site. But can the user somehow hijack the App-only token in the browser and use REST calls to delete or edit items in the host web. I see from this post that App-Only calls can be used in REST calls in c#.