I'm doing a very simple REST Get to a list of broadcast messages on the web application that serves as our "intranet portal" from the web application we use for team site collections. Both web applications are in the same domain (names changed to protect the innocent and my job):

  • intranet.domain.com
  • teamsites.domain.com

Here's a sample of the code I'm using:

    var api = new ApiHelper('https://intranet.domain.com');
    var options = {
            'orderby':'Created desc',

window.ApiHelper = function(webUrl){
    this.webUrl = webUrl;

ApiHelper.prototype.execute = function(relativeUrl){
    var fullUrl = this.webUrl + "/_api" + relativeUrl;
    var executeOptions = {
        url: fullUrl,
        method: 'GET',
        dataType: "json",
        headers: {
    return $.ajax(executeOptions);

ApiHelper.prototype.getListData = function(options){
    //Set the base endpoint Url.
    var executeUrl = "/web/lists/getByTitle('"+options.list+"')";

    if(options.op == 'All'){return this.execute(executeUrl).then(function(data){if(data.d){return data.d;}else{throw "Something bad happened..."}});
    }else if(options.op == 'Id'){executeUrl+='/Id';return this.execute(executeUrl).then(function(data){if(data.d){return data.d.Id;}else{throw "Something bad happened..."}});
    }else if(options.op == 'Forms' || options.op == 'Views' || options.op == 'WorkflowAssociations'){
        return this.execute(executeUrl).then(function(data){
            if(data.d && data.d.results){
                return new QueryResults(data.d.results);
            } else {
                throw "Something bad happened...";
        //If there's a parameter object, then add the dollar signs, turn it into a string, and add it to the URI.
            params = options.params;
            var key;
            for(key in params){
                if(params.hasOwnProperty(key)){params['$'+key] = params[key];delete params[key];}
            queryString = decodeURIComponent($.param(params));
        return this.execute(executeUrl).then(function(data){
            if(data.d && data.d.results){
                return new QueryResults(data.d.results);
            } else {
                throw "Something bad happened...";

Using this, I get a cross origin failure every time when it's run from the teamsites.domain.com web application. Which shouldn't happen, because both web apps are in the same domain... right?

I realize this is very similar to questions that have been asked a few times before, so let me start by saying a couple of things up front:

  • Using SP.AppContext in the endpoint URL continues to give me the cross origin failure as well.
  • I've tried using the CORS library, and that gives me one of these: enter image description here
    If I click Fix It, I get taken to an error page on the intranet webapp for a page that doesn't exist.
  • According to research, the primary suggestion is that this is because my intranet and teamsites web applications are "in different IE security zones". That seems like it can't be my case, because 1.) they're both in the .domain.com domain, and I have a wildcard in my list of intranet sites in IE's security options for that domain and 2.) it's my understanding that Chrome and Firefox don't do security zones and I get the same issues in those browsers.
  • I've tried doing... whatever the hell it is they're suggesting here, but I'm not sure what I'm supposed to do with that app page I create.

Additional information:

  • We're SP2013 on premise. Our intranet web application has not been visually upgraded yet, owing to an immense amount of ill advised (and not controlled by my group) customization to the UI there. teamsites is upgraded.
  • I have a few applications currently using REST endpoints that are running out of the intranet web application and getting data from the teamsites web application without issue. Or, if they are causing problems, I haven't heard them yet.

You will have no Cross Origin Failure as long as you are in the same domain.

intranet.domain.com and teamsites.domain.com are not considered same domain.

Have you tried using the Cross Domain Library (CDL) and the RequestExecutor ?


  • Second bullet point under "Let me start by saying..."; it's the one with the picture. Yes. Doesn't work. My administrator assures me that regardless of the prefix (intranet vs. teamsite), that "domain.com" indicates we're in the same domain. And, anyway, I've got no issue with some apps that both get and write from intranet to teamsites. – ChrisPEditor May 12 '16 at 20:56

Ok, well, I cracked it, but the answer is... eh. I took the code above, put it into a separate js file, hosted it at intranet.domain.com, and ran it from teamsites.domain.com. No issues.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.