I have an Sharepoint app hosted at:


And I want to retrieve the json representation of an excel document using the Excel Service Rest API hosted at:


I can't simply perform a get due to same-origin policy limitations as they are hosted on different domains, so my questions are:

1) Is this scenario even possible?

I've seen a number of post suggesting that it isn't ie:


2) If is is possible, how?

  • I assume this is a SharePoint hosted app (as opposed to provider hosted)?
    – Nathan
    Commented Nov 18, 2014 at 17:19
  • As a follow up, we ended up building a custom hosted proxy to get around the lack of CORS support
    – kimsagro
    Commented Nov 24, 2014 at 20:35

2 Answers 2


This doesn't currently appear possible :(

I've tried setting up everything using SP.RequestExecutor in the cross-domain library, but since the ExcelRest.aspx page is in the _vti_bin virtual directory you can't access the endpoint that way.

I've also tried using the web proxy and specifying my host site as an authorized endpoint but I still recieve 403 -- Forbidden responses from the server.

As an interesting, semi-related, note: it seems that app webs do not allow you to access their own /_vti_bin/ExcelRest.aspx endpoint either, also responding with 403

And here is another link to an MSDN question with an accepted answer from MVP Steve Curran stating that this doesn't appear to work also...

Hopefully this is a scenario will be possible sometime in the future...


Did you try this?:

By default, cross-domain workbook and data connection access is not allowed. To allow workbooks in trusted file locations (and data connections in trusted data connection libraries) to be accessed across domains by web parts, pages, or Web services, run the Stsadm.exe command-line utility, as shown in the following example, where SSP name is the name of your Excel Services Shared Services Provider:

stsadm.exe -o Set-EcsSecurity -Ssp -AllowCrossDomainAccess true|false

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.