In our project we need to download some data from Add-in Web. And it brings some problems.
For example, user have to be logged in on both domains.
If user is logged in on your website
http://mywebsite.sharepoint.com and there is a REST call to
http://mywebsite-e72bc262fda58e.sharepoint.com/YourAddInName/_api/web/lists made by JS, this call will get 302 response with redirect to login page. So user must open
http://mywebsite-e72bc262fda58e.sharepoint.com/YourAddInName/ first, complete the authentication and only after that you can use REST calls to
http://mywebsite-e72bc262fda58e.sharepoint.com/YourAddInName from Host Web.
To workaround this problem we send REST request to Add-in Web using same domain:
http://mywebsite.sharepoint.com/YourAddInName/_api/web/lists It works well, but the question we have - how reliable is this way? Is it something officially declared or it may change any moment?