11

If I execute the REST Query using JavaScript and I am logged in to the SharePoint with Visitor privileges then will my code be able to query the administrative data like getting the column name and so on?

In short, does the query executes with Highest privileges or the permission is maintained by SharePoint for REST query?

| improve this question | |
12

Queries will be executed based on the logged in users context. The results will be security trimmed.

Also you should note that there is no option to elevate privileges from Client Side. This was done to eliminate security risks.

Talking about app's (which can use REST queries), we can elevate the permissions. But this permission is maximum limited to the ability of the permission of the App itself. i.e the code in app can run under either the current user context or the app context.

| improve this answer | |
  • 2
    Just to add to your post, App-only context is only available for Provider-hosted apps, not SharePoint-hosted. – wjervis Dec 25 '14 at 14:43
  • Hello sir thanks for replying,but is there any reference link is there where it is mentioned that the security trim is applied to REST query. As I prepared one sample example which queries for the column's internal name and if I am logged in as visitor user then I am getting the value of the column's internal name. But in UI of SharePoint the user with visitor privilege cannot see the menu item Site Settings – users1100 Dec 29 '14 at 7:04
  • 1
    @users1100 Yes that is true. Using REST you will be able to view the Web List properties. My answer is strictly in terms of Data. – Amal Hashim Dec 29 '14 at 13:09
  • Also, REST queries require the Browse Directories base permission when called from InfoPath. – Alexey Krasheninnikov Dec 31 '14 at 9:27
6

REST, JSOM run using the previleges of the current loggged in user

| improve this answer | |
  • Hello sir thanks for replying,but is there any reference link is there where it is mentioned that the security trim is applied to REST query. As I prepared one sample example which queries for the column's internal name and if I am logged in as visitor user then I am getting the value of the column's internal name. But in UI of SharePoint the user with visitor privilege cannot see the menu item Site Settings – users1100 Dec 29 '14 at 7:03
  • If the Visitor has read access to the list, then it can read the values of the field. However, it cannot create/update/delete a field or items in the list. Meanwhile, I will try to find a reference for you. – Nadeem Yousuf-AIS Dec 29 '14 at 7:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.