Really, why?

You said XSS. Ok, what is XSS? XSS allows me to execute maleficent script on different domain. So, from an app web I can't break something in a host web.

But stop.
I can request Write permissions on the host web, next, using JSOM I can add JavaScript file into the host web (files.add()...) from the app web. Next I can add CustomAction using JSOM (ScriptSrc="/path/to/maleficent.script.js", Location="ScriptLink") into the host web. And voila - I have my script included in all pages in the host web. And I can do everything I want in the host web.
It's similar to XSS.

The question is, what is the real purpose of creating separate domain? XSS is not an answer.

1 Answer 1


There are two primary reasons why SharePoint components are deployed to app webs, rather than the host web. Both are related to security.

  1. Enforcement of app permissions: In the model for apps for SharePoint, an app has its own identity and it has permissions that are not necessarily the same as the permissions of the user who is executing the app. These app permissions are requested when the app is installed and granted by the person who installs the app, as long as person has all the permissions that the app requests. (If the user who is installing the app does not have all the permissions that are requested by the app, the user cannot install the app.) By giving each app its own domain, SharePoint 2013 can reliably identify requests made by the app and verify the permissions of the app.

  2. Cross-domain scripting security: Modern browsers support a "same origin policy" with regard to JavaScript method calls. By deploying each app for SharePoint to its own domain, SharePoint takes advantage of the browser's same origin policy to ensure that JavaScript in the app for SharePoint cannot execute any JavaScript from any other domain, including the domain in which, from the end-user's perspective, the app is installed.

SharePoint also provides a means of safely overcoming the limits of the policy. Among other things, this enables the remote components of an app for SharePoint to query data from any website in the common parent tenancy of the host and app webs.

Also Check:




Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.