Is there any rule that says when SOAPAction is REQUIRED in the setRequestHeader?

In my jQuery library (SPServices), I've been including the SOAPAction for every Web Service call. It turns out that is what is preventing anonymous access to the Web Services to work. When I remove SOAPAction entirely and I AM logged in, some calls fail with the following error:

errorstring: The security validation for this page is invalid. Click Back in your Web browser, refresh the page, and try your operation again. 
errorcode: 0x8102006d

I suppose that it could be as simple as operations which read vs. operations which write, but I figured I'd toss it out there for ideas.


UPDATE: @cwheeler76 pointed out this article from Jan Tielens: The security validation for this page is invalid" when calling the SharePoint Web Services. It also describes the problem and the solution using SOAPAction. I'm looking for more the 'when' as opposed to the 'how'.

  • Marc if you don't get any reasonable answer could you possibly post a list of all calls (that you know of) which definitely DO fail without the SOAPAction defined. This would be invaluable info for people who stumble across this post. Mar 18, 2010 at 20:51
  • I think I'm going to end up brute force figuring it out. The results will, of course, be documented in the library, but I'll try to remember to post them here, too. Mar 18, 2010 at 22:26

1 Answer 1


Well, no one else had an answer, so I think I figured it out for myself. I'm going to mark my own answer here as the right one and see if I can push my points from 998 over 1000. UPDATE: Damn. I have to wait 12 hours to be a greedy point grabber and mark my own post as the answer.

The full answer and how I got to it is in my blog post entitled Allowing Anonymous Access with SharePoint Web Services and SPServices, but here's the meat of it:

It turns out that you don't need to pass the SOAPHeader if the Web Service operation is a read-only one. For instance, some of the most useful things, like GetListItems, don't require it. In my testing, none of the read-only operations need the SOAPHeader. Oddly, if you don't pass it with the read/write functions, they only fail if you are authenticated, the error says that you aren't authenticated, and that you should hit the back button and refresh. Well that's hardly helpful given that you aren't working interactively, but talking to the Web Services programmatically.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.