Basic Example

  • mysite.mysharepoint.com has clientside code that wants to access a list on mysharepoint.com due to whatever reason.
  • the Same-origin policy forbids this

Possible Workarounds


While this is easily possible, I tend to avoid serverside code.


  • SSOM

Edit web.config

An simple web.config edit allows the communication.


  • all front-end servers have to be modified
  • hardware changes can affect the outcome


For Apps SharePoint provides some ways to enable cross-domain calls. (SP.RequestExecutor, SP.WebProxy) so you could communicate with the app and the app communicates cross domain. Same for CSOM apps while you here can work without the policy.


  • need of an app


Editing your own web-service's web.config isn't as critical as editing the SharePoint one. The web-service itself could access the data via SSOM (needs to be hosted on a SP server) or CSOM (much more the 2013 way). If configured correct, the service returns JSONP which can be consumed.


  • need of an web-service


If you have any suggestions or know other ways to solve the problem (SP365 Custom Action?) feel free to add them to this collection.

1 Answer 1


Not sure that YQL would solve it. As below sample

var site = url; //Cross Domain URL goes here
var yql = 'http://query.yahooapis.com/v1/public/yql?q=' + encodeURIComponent('select * from xml where url="' + site + '"') + '&format=xml&callback=?';
// Request that YSQL string, and run a callback function.
// Pass a defined function to prevent cache-busting.
$.getJSON(yql, function(data){


can try with Ajax as below,

$.support.cors = true;
    url : url,
    cache : true,
    type : "get",
    data : _data to be sent,
    global : false,
    dataType : "jsonp", //Specifying JSONP would make the magic for cross domain call
    jsonp : false,
    success : function jsonpCallback (response) {
  • this has nothing to do with my example
    – Mx.
    Commented Feb 20, 2015 at 11:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.