here is simple service function getting list items;

public readItems(webUrl: string, listName: string): ng.IPromise<IListItem[]> {
    const deferred: ng.IDeferred<IListItem[]> = this.$q.defer();

      url: `${webUrl}/_api/web/lists/getbytitle('${listName}')/items`,
      method: 'GET',
      headers: {
        'Accept': 'application/json;odata=nometadata'
    }).then((result: ng.IHttpPromiseCallbackArg<{ value: IListItem[] }>): void => {
    return deferred.promise;

I am to to see contents of list in browser using same url; enter image description here

but in application response to this call; enter image description here

how can I add required information that sharepoint needs to understand its authenticated request?


I'd not be surprised your JavaScript code runs from another domain than mod970274.sharepoint.com, thus resulting in a same-origin policy violation... and cross-domain calls being forbidden by default result in a 403 error, as the one you get...

Fortunately, with Office 365, there's now a way to workaround this policy by declaring an app in the Office 365 portal (the app declaration includes the domain name your JavaScript code is hosted at); calls from this app will then be allowed by the mean of "CORS".
Official info can be found here + a lot of other articles.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.