2

i'm using a jquery script embedded in a SharePoint page. i am able to load the results of a /_api/web/webs call to REST as myself (site collection admin). However, anyone that visits the page that is not a site collection admin (even users with Full Control access) are met with a prompt to enter their login credentials. After inputing their credentials three times, they are met with a 401 Unauthorized error.

It seems like just about any other api call works for just about all the users but specifically _api/web/webs is unauthorized.

Any information on why this particular call would require elevated privileges or if i am doing something wrong would be appreciated.

Here is the code: 

<script type="text/javascript" src="/_layouts/15/sp.runtime.js"></script>
<script type="text/javascript" src="/_layouts/15/sp.js"></script>
<script type="text/javascript">
var root;
$(function () {
     var pathname = window.location.pathname; // Returns path only
     var url      = window.location.href;
     root = url.substring(0,(url.length - pathname.length));
     $.getScript(root + "/_layouts/15/SP.RequestExecutor.js", getWebInfo) ; 
});

function getWebInfo(){
var executor = new SP.RequestExecutor(root);    
executor.executeAsync({
    url: root + "/_api/web/webs",
    method: "GET",
    headers: { "Accept": "application/json; odata=verbose"},
    success: successfulCall,
    error: failureCall
});
}
</script>
Improve this question
3
  • Do these users have permissions to the subsites? Also, why use RequestExecutor? That's the cross-domain library for use in an appweb. You can simply use $.ajax({url: "/_api/web/webs"});, since you're on the same domain.
    – wjervis
    Jul 13, 2015 at 13:57
  • For testing purposes they have been given full control. requestExecutor was only used to try to troubleshoot permissions issue. It is not necessary to keep.
    – cheffx1265
    Jul 13, 2015 at 16:25
  • Do all subsites inherit permissions? Doesn't matter if they have full control to a site, if the sub site has separate permissions.
    – wjervis
    Jul 13, 2015 at 16:25

1 Answer 1

Reset to default
2

Looks like there were some subsites with unique permissions. I added the security trimming filter at the end of the call and it fixed the issue. 

/_api/web/webs/?$filter=effectivebasepermissions/high%20gt%2032

Thanks for your help

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.