3

When a javascript call to REST api from site page is executed, if user has no permissions on the site, he will be asked for credentials multiple times in a browser. How can I avoid/prevent that? Code below:

function requestRestApi(endpoint, options) {
  var opts = {
    type: "GET",
    url: endpoint,
    headers: { ACCEPT: "application/json;odata=verbose" }
  };
  return jQuery.ajax(jQuery.extend(opts, options));
} 


requestRestApi(siteUrl + "/_api/web/currentuser?$select=LoginName")
.then(function (data) {
  var user = data.d;
  var endpoint = siteUrl + "_api/web/getList('" 
    + listServerRelatedUrl + "')/getusereffectivepermissions(@u)?@u='"
    + encodeURIComponent(user.LoginName) + "'";

  requestRestApi(endpoint)
  .then(function(data) {
     var userPerms = data.d.GetUserEffectivePermissions;
     var perms = new SP.BasePermissions();
     var SP_PERMISSIONKIND_OPEN = 17;
     perms.initPropertiesFromJson(userPerms);
     console.info("Can open=" + perms.has(SP_PERMISSIONKIND_OPEN));
   });
});
  • Is this related to the Auth Type somehow? Am I misconfigured my REST request or my farm's auth? – dbardakov Jan 26 '17 at 12:10
  • I have faced the same behavior with RequestExecutor approach as well, as with JSOM too. – dbardakov Jan 26 '17 at 19:55
2

One potential fix could be to send an OPTIONS request before the GET. OPTIONS may be failing on 401 responses [tbc].
It it does, you simply need to check the response from the OPTIONS, and don't try to issue the GET if it failed with 401.

  • Before I read you answer, was thinking about the same. Today I had tried to execute HEAD and OPTIONS but with no luck – dbardakov Jan 26 '17 at 11:07
  • If you vote up this answer, please explain if it works for you, and in which version of SharePoint (mine on-perm 2016 is not) – dbardakov Jan 26 '17 at 17:12
  • @dbardakov What was the outcome of this for you, I have the same issue. – Batman Jun 22 '17 at 18:12
  • @Batman In case of NTLM auth there is no way browser won't ask you to enter new creds in response to 401. In case it was a call to another site collection to which user doen't have ANY perms at all. – dbardakov Jun 22 '17 at 21:40
  • 1
    I ended up changing from querying the site directly to using Search API instead. So I leave the permission handling to search and I don't get credential prompts. – Batman Jun 23 '17 at 15:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.