When a javascript call to REST api from site page is executed, if user has no permissions on the site, he will be asked for credentials multiple times in a browser. How can I avoid/prevent that? Code below:

function requestRestApi(endpoint, options) {
  var opts = {
    type: "GET",
    url: endpoint,
    headers: { ACCEPT: "application/json;odata=verbose" }
  return jQuery.ajax(jQuery.extend(opts, options));

requestRestApi(siteUrl + "/_api/web/currentuser?$select=LoginName")
.then(function (data) {
  var user = data.d;
  var endpoint = siteUrl + "_api/web/getList('" 
    + listServerRelatedUrl + "')/getusereffectivepermissions(@u)?@u='"
    + encodeURIComponent(user.LoginName) + "'";

  .then(function(data) {
     var userPerms = data.d.GetUserEffectivePermissions;
     var perms = new SP.BasePermissions();
     console.info("Can open=" + perms.has(SP_PERMISSIONKIND_OPEN));
  • Is this related to the Auth Type somehow? Am I misconfigured my REST request or my farm's auth?
    – dbardakov
    Commented Jan 26, 2017 at 12:10
  • I have faced the same behavior with RequestExecutor approach as well, as with JSOM too.
    – dbardakov
    Commented Jan 26, 2017 at 19:55

1 Answer 1


One potential fix could be to send an OPTIONS request before the GET. OPTIONS may be failing on 401 responses [tbc].
It it does, you simply need to check the response from the OPTIONS, and don't try to issue the GET if it failed with 401.

  • Before I read you answer, was thinking about the same. Today I had tried to execute HEAD and OPTIONS but with no luck
    – dbardakov
    Commented Jan 26, 2017 at 11:07
  • If you vote up this answer, please explain if it works for you, and in which version of SharePoint (mine on-perm 2016 is not)
    – dbardakov
    Commented Jan 26, 2017 at 17:12
  • @dbardakov What was the outcome of this for you, I have the same issue.
    – Batman
    Commented Jun 22, 2017 at 18:12
  • @Batman In case of NTLM auth there is no way browser won't ask you to enter new creds in response to 401. In case it was a call to another site collection to which user doen't have ANY perms at all.
    – dbardakov
    Commented Jun 22, 2017 at 21:40
  • 1
    I ended up changing from querying the site directly to using Search API instead. So I leave the permission handling to search and I don't get credential prompts.
    – Batman
    Commented Jun 23, 2017 at 15:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.