0

There are a few points about add-in user permissions that I am missing.

Please correct me if I am wrong about the following points:

  • Installing an add-in creates a SPWeb, over which add-ins and users have full-control.
  • Developers can request permissions over host web resources using the add-in's manifest file.
  • By the time users are prompted to give an app permission, they can only grant permissions they actually have. Therefore, a user who has read-only permissions on the host web cannot grant writing privileges to an add-in.

My question is, if spadmin installs an add-in that requests writing privileges over the host web, would read-only users be able to perform writing operations using that add-in, or would SharePoint deny access to those users and limit usage to a user's own permissions set? What about anonymous users: is it possible to allow anonymous users to use an add-in, and, therefore, inherit the add-in's writing permissions?

My main concern is, since the code will be on the client-side, as the manifest files can request permissions to a whole site as the scope value, users could possibly replace an add-in's JavaScript functions using a browser's console, and then perform operations that they would not normally be allowed to execute without inheriting an add-in's access.

1

The SharePoint hosted app model, that you are referring to doesn't magically give the user more permissions than they already have, because if it did it would a be a security flaw, as you point out.

Thus a SharePoint hosted app, will always use the current users permissions, as everything is run in the context of the users.

On the other hand if you build a provider hosted app (on that runs on a separate web server, and typically build with some backend technology, e.g. MVC) then your app can request permissions that the users doesn't have. This is know as add-in-only-permissions. Note the default way to build addin is not to use add-in-only permission but still use the current users permission, but in some case you want e.g. read only users to be able to edit very specific lists, and then it might make sense.

The add-in-only-premissions are granted at install time, but the app can't request permissions that the person installing it doesn't have. But you have to be careful, if you as an admin install an app that e.g. ask for full control of all sites in sharepoint, any bug in the code could potentially leave all users full access to all of your SharePoint. But since the code is server side, it is up to the developers to ensure that that doesn't happen.

You can read more about add-in policies here: https://msdn.microsoft.com/en-us/library/office/fp179892.aspx

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.