I try to update a ListItem in a (foreign) SiteCollection wihtin an edit form by CSOM. But I can't get it to work without getting a 403 error:

cs.updateListItem = function(siteURL, listNameSTR, itemID, propertiesOBJ, successFUN)
    var ctxOBJ = new SP.ClientContext(siteURL);
    var listOBJ = ctxOBJ.get_web().get_lists().getByTitle(listNameSTR);
    var itemOBJ = listOBJ.getItemById(itemID);

    for(var propertySTR in propertiesOBJ) {
        itemOBJ.set_item(propertySTR, propertiesOBJ[propertySTR]);

        Function.createDelegate(this, successFUN), 
        Function.createDelegate(this, function(senderOBJ, argsOBJ){console.log(argsOBJ.get_message() + "\n" + argsOBJ.get_stackTrace());})

I also tried the same with a REST call...

  • Its not the Security Token/Digest (tried that in different ways)
  • It's not the user permissions (I tried even with farm admin)
  • Within the current site collection it works
  • it works if I fire the script on every other site, it only crashes within the form
  • I created a new plain vanilla site collections on a plain vanilla SharePoint
  • I tried different SharePoint releases of the last 12 months

There is always a 403...

this is very strange


We ran into the same issue on a page with a managed metadata field which was loading ScriptForWebTaggingUI.js.

This script (along with several others) changes the __REQUESTDIGEST value on header of Sys.Net.WebRequestManager - for more details see: https://officespdev.uservoice.com/forums/224641-general/suggestions/7025290-bug-with-jsom-when-working-with-cross-site-collect

To resolve the issue we added the following code before our JSOM request:

if (Sys.Net.WebRequestManager._events != null && Sys.Net.WebRequestManager._events._list != null) 
    var invokingRequests = Sys.Net.WebRequestManager._events._list.invokingRequest; 
    while( invokingRequests != null && invokingRequests.length > 0) 

This fixed the FORBIDDEN 403 error and so far hasn't cause any new issues with the managed metadata field - it seems to re-add the necessary invokingRequests automatically whenever it needs them.

| improve this answer | |
  • I'll try that later on... Now we replaced all MM with Look-up values (and I'm actually nood in the mood to do it all again ;-) – Dave Nov 27 '15 at 13:20
  • I'm sorry to hear that... – Catriona MacKenzie Nov 27 '15 at 13:49
  • Hehe... we have Code Freeze today... So there is not much room for experiments. – Dave Nov 27 '15 at 15:09

403- forbidden error is given by SharePoint only when we don't have enough permission to perform operation. But as you said that you tried with Farm Admin and also you mentioned that it is crashing only with Form. Only thing i can suggest is give a chance by crossdomain operation using SP.RequestExecutor. https://msdn.microsoft.com/en-us/library/office/jj164022.aspx

All the best.



| improve this answer | |

You are querying another domain, and cross-domain JavaScript calls are blocked for security reasons. You need to use SP.RequestExecutor.js to execute your query with the JavaScript cross-domain library as described on MSDN:

// Load the js files and continue to the successHandler
$.getScript(scriptbase + "SP.RequestExecutor.js", execCrossDomainRequest);

// Function to prepare and issue the request to get
//  SharePoint data
function execCrossDomainRequest() {
    // executor: The RequestExecutor object
    // Initialize the RequestExecutor with the add-in web URL.
    var executor = new SP.RequestExecutor(appweburl);

    // Issue the call against the add-in web.
    // To get the title using REST we can hit the endpoint:
    //      appweburl/_api/web/lists/getbytitle('listname')/items
    // The response formats the data in the JSON format.
    // The functions successHandler and errorHandler attend the
    //      sucess and error events respectively.
              appweburl +
          method: "GET",
          headers: { "Accept": "application/json; odata=verbose" },
          success: successHandler,
          error: errorHandler


| improve this answer | |
  • No it's not a domain issue. If I am on other sites it is working. It's just the edit form. – Dave Nov 16 '15 at 9:59

So... I finally found out: It is simply a SharePoint Bug with Managed Metadata fields. If you remove these, it's working fine:

You can't start REST- or CSOM calls with write operations to a list on an other Site Collaction within an edit form containing Managed Metadata / taxonomy fields.

Very weired...

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.