I'm a complete newbie to SharePoint Provider-Hosted Solutions and their authentication logic. My App is an ASP MVC Solution. I run many AJAX-Calls from Client-Scripts to my Controller to interact with the SharePoint Host asynchronously. Many of my Task-Handlers in the Controller require the
ClientContext to handle UserData.
I analyzed the default procedures which provider-hosted Apps use to get a ClientContext. I found out that the
GetContextTokenFromRequest(HttpRequestBase request) method of the
TokenHelper is used to get a Context Token from the Request. This method searches for the following Parameters and returns it's Value, if one of them was found in the
The result of that Method is later used in the method
GetClientContextWithAccessToken(string targetUrl, string accessToken) together with the
HostWeb-Url to finally receive a
This means that the SharePoint App Redirection System must send either one of those Parameters to the provider-hosted App. In my case the Request contained the Parameter
The problem is that the AJAX Calls from my App-Client are obviously not coming from the SharePoint Host and do not contain any Token Parameters.
I used to store the
Access-Token (received through the
GetContextTokenFromRequest(HttpRequestBase request) method) in the Session of the user which is currently using my App and use it on every Call to the Controller. That works for the start but after some time of using the app, without any redirection through the SharePoint, the Access Token seems to expire, as I get
401 Unauthorized Exeptions everywhere.
I'm searching for a way to properly cache an Access-Token inside my provider-hosted App in order to get a
ClientContext to interact with the SharePoint Host.
Is this the right approach, or are there better ways of using the CSOM in such environments? If that is a valid approach, is there any way to validate the Token or to refresh it in case of an exception?