REST API page validation error for SharePoint app

Question

I need to do insert operation to SharePoint list. Below is my code..

$.ajax({
        url: appWebUrl + "/_api/SP.AppContextSite(@target)" + "/web/lists/getbytitle('NewList')/items?" + "@target='" + hostWebUrl + "'",
        type: "POST",
        data:  JSON.stringify({ '__metadata': { 'type': 'SP.Data.NewListListItem' },
        'Title': "TitleVal", 'Name':"Satya"}),       
        headers: { 
            "accept": "application/json;odata=verbose",
            "X-RequestDigest": $("#__REQUESTDIGEST").val(),
            "content-Type": "application/json;odata=verbose" },
        success: function (data) {
            success(data);
        },
        error: function (xhr, status, error) {
             console.log( " xhr.responseText: " + xhr.responseText + " //status: " + status + " //Error: "+error );
            alert("error");
        }
    });

It throws error:

Microsoft.SharePoint.SPException","message":{"lang":"en-US","value":"The security validation for this page is invalid and might be corrupted. Please use your web browser's Back button to try your operation again."

Answer 1

Refresh the token in Form Digest

The two most common ways are to either use ye olde web services and call into the /_vti_bin/sites.asmx and use the GetUpdatedFormDigest method. To use this you have to create a SOAP message and then parse the response and retrieve the updated token. You can then either pass that new token for your subsequent requests, or even better update the hidden __REQUESTDIGEST field. The second one is to use the new REST POST endpoint /_api/contextinfo and then parse that response which can be either XML or JSON. This is how to do it the JSON way:

UPDATE:

Use your method like this:

$.ajax({
    url: _spPageContextInfo.webAbsoluteUrl + "/_api/contextinfo",
    method: "POST",
    headers: { "Accept": "application/json; odata=verbose"},
    success: function (data) {

        $.ajax({
        url: appWebUrl + "/_api/SP.AppContextSite(@target)" + "/web/lists/getbytitle('NewList')/items?" + "@target='" + hostWebUrl + "'",
        type: "POST",
        data:  JSON.stringify({ '__metadata': { 'type': 'SP.Data.NewListListItem' },'Title': "TitleVal", 'Name':"Satya"}),
        headers: { 
            "accept": "application/json;odata=verbose",
            "X-RequestDigest": $('#__REQUESTDIGEST').val(data.d.GetContextWebInformation.FormDigestValue),
            "content-Type": "application/json;odata=verbose" },
        success: function (data) {
            success(data);
            },
        error: function (xhr, status, error) {
            console.log( " xhr.responseText: " + xhr.responseText + " //status: " + status + " //Error: "+error );
            alert("error");
                }
            });
    },
    error: function (data, errorCode, errorMessage) {
        alert(errorMessage)
    }
});

Hope this will help you.

Answer 2

Old thread but just want to share what fixed my issue.

Make sure the user performing the REST call have below the permission "User Remote Interfaces". To check the permission level, refer to below steps:

Site settings (root site) > Site Permissions > Permission Levels > Edit Permission Level > Under Site Permissions

Use Remote Interfaces - Use SOAP, Web DAV, the Client Object Model or SharePoint Designer interfaces to access the Web site.

Answer 3

The error message indicates that your App doesn't have permissions to do the add. You need to request write permission at the Web scope in the App manifest.

You also need to change the GET to a POST.

Answer 4

You can refresh Form Digest Token just before the POST call.

there is a native method for refreshing the token built-in to the SharePoint JavaScript libraries. It’s a function called UpdateFormDigest(). It’s defined in INIT.js.

The method takes two parameters, first of all the URL to the current site and secondly it takes an update interval parameter (global constant called _spFormDigestRefreshInterval ). And this is how you should use the function:

UpdateFormDigest(_spPageContextInfo.webServerRelativeUrl, _spFormDigestRefreshInterval);