Authenticate user with FormDigest via CSOM/REST

Question

Our SharePoint 2013 farm is using Windows Authentication and exposed to the Internet. We have a webparts contains javascript AJAX call to another server with a different hostname.

Intranet: intranet.northwind.com API: api.northwind.com

Obviously we can't turn on IIS Windows Authentication for our API server, otherwise we can't call it from javascript loading from Intranet page without exposing any user credentials.

Can I use the SharePoint FormDigest as the token to call something via CSOM or REST inside our API application to authenticate a user? There is no problem passing the X-FormDigest value across our API application, it just that I don't know if there any method to use this token to authenticate a user.

Answer 1

You hardly can authenticate with X-FormDigest, even if that part is mandatory for POST methods.

You really need the user token and add a Bearer Header to your HTTP request

headers: {
        ...
        "Authorization": "Bearer " + UserOrAppToken
        ...
    },  

If you're not able to get user token, you can use the AppOnly token with ClientID and ClientSecret, but you need one token for all requests. More info about AppOnly

Mind my answer if you did use an equivalent of next sample in JavaScript.

clientContext.ExecutingWebRequest += delegate(object sender, WebRequestEventArgs e)
{
    e.WebRequestExecutor.WebRequest.Headers["Authorization"] = string.Format("Bearer {0}", CurrentProperties.Token);
};