I have a website on SharePoint Online and a website on SharePoint On-premise. From my On-premise website i want to create a new list on my SharePoint Online site.

To authenticate I used the following codes:

    var soapRequest =
     '<?xml version="1.0" encoding="utf-8"?>
      <soap12:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"  
         <Login xmlns="http://schemas.microsoft.com/sharepoint/soap/">
            <username>[email protected]</username>

And then:

          url: myUrl + "_vti_bin/authentication.asmx?op=Login",
          type: "GET",  
          contentType: "text/xml",  
          dataType: "json", 
          data: soapRequest, 
          success: function (a) {
          error: function (a) {

As result I get:

XMLHttpRequest cannot load https://myUrl/_vti_bin/authenti…in3!%22%3C/password%3E%3C/Login%3E%3C/soap12:Body%3E%3C/soap12:Envelope%3E. The request was redirected to 'https://myUrl/_layouts/15/error.aspx?ErrorText=Request%20format%20is%20unrecognized%2E', which is disallowed for cross-origin requests that require preflight.

What can I do to avoid the error?

Thank you very much.

  • Are you sure about request type "GET"? I thought it should be "POST". Doesn't it the problem cause?
    – andrii
    May 6, 2015 at 13:32
  • do you use SSO(ADFS)?
    – Mike
    Aug 14, 2018 at 15:54
  • @Mike for ADFS, use oAuth. It's much simpler. This article is pretty similar to what you want to do: medium.com/@yash_agarwal2/…. This should give you an idea. You don't have to do all the steps that are mentioned there, but it's sufficient to give you a head-start.
    – Akhoy
    Aug 14, 2018 at 16:24
  • there should be a way to authorize the user performing the request without having to create an Client Id and Client Secret, those are for tools that we want to authenticate automatically. but when we want to authenticate the user there should be a way like the the PNPauthentication manager.
    – Mike
    Aug 14, 2018 at 16:31
  • 1
    @Mike Since REST api is mentioned in the question, the only way (as far as I'm aware) is to just register your app/website in SharePoint for getting the client ID and secret, get the authorization token and attach it for REST calls. Another way would be to (this step is also there in Pnp Authentication manager) open a window and show the login prompt, get the fedAuth and rTFa cookies and attach it to the REST call.
    – Akhoy
    Aug 16, 2018 at 6:43

2 Answers 2


In this post I describe the process of the authentication against O365. The most important steps are:

  1. We get the token from the security token service (STS) of MS Online.

  2. "Login" to the actual O365 site using the token provided by STS in the former step. As a result of this step, we have the required cookies (FedAuth and rtFA) to be used automatically in the next steps. These cookies are set by Set-Cookie headers of the response and cached and reused by the browser for later requests targeting the same site.

  3. Get the digest from the contextinfo REST endpoint (see MSDN for details) or from the Sites web service store the value into a JavaScript variable (digest).

  4. Execute the REST request.

Note, that the code sample was correct as I wrote the post about 2 years ago, however I have not tested it since then. The process itself should be the same.

  • I tried your codes several times but I always get the following error: XMLHttpRequest cannot load https://login.microsoftonline.com/extSTS.srf. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://myLocalSP' is therefore not allowed access. So was can I do to avoid the error?
    – JohnSP
    Mar 24, 2015 at 14:27
  • Which version of jQuery and what kind of browser do you use? My sample is based on the 1.8.3. version of jQuery and probably IE 9. Might be that something has been changed regarding the security. Note, that in my sample I work with a local HTML file. If you would like to access SP online from an on-premise site, you might have issues with the Same-origin policy. See stackoverflow.com/questions/19821753/…
    – pholpar
    Mar 24, 2015 at 14:42
  • I'm using IE 10 and jquery 1.11.
    – JohnSP
    Mar 30, 2015 at 7:05

The Root Federation Authentication (RTFA) cookie is used across all of SharePoint. When a user visits a new top-level site or another company's page, the RTFA cookie is used to authenticate them silently without a prompt. When a user signs out of SharePoint, the RTFA cookie is deleted.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.