I have been working on a lot of applications with app-only policy and just wanted to make sure that I am not overlooking any security vulnerability. Below is a sample scenario for discussion:
- Provider hosted Add-in with Contribute permissions and app-only configured.
- Add-in has a page which reads data using App-only policy.
Now users who use this app do not have any permission on the SharePoint site. But can the user somehow hijack the App-only token in the browser and use REST calls to delete or edit items in the host web?
I see from this post that App-Only calls can be used in REST calls in c#.