I'm having trouble coming up with a good way to store data serverside on SharePoint, in such a way that I can interact with it in my Javascript code (add, change, and delete data). So far all I can think of is using SharePoint lists, which is not so good because anyone can delete and change them as they wish. Are there any preferred methods for storing data serverside such that it can be accessed and edited through Javascript?

Thanks in advance.

  • You can manage list permissions to avoid "anyone can delete and change them as they wish" – Arsalan Adam Khatri Feb 21 '17 at 16:30
  • Sure, but since there is no impersonation in JavaScript, there is no way for CRUD like he needs to – Eric Alexander Feb 21 '17 at 16:38
  • "If you invite friends into your home they can take beers from the fridge" That is the scenario when you give accounts Write access in SharePoint, the only way to protect your beer is to use APIs or Workflows that elevate permissions (in my case its my mother-in-law whom I assign to kitchen/fridge duty to protect my precious home-brews), in the SharePoint Online Domain its developing Workflows or building Azure applications – Danny '365CSI' Engelman Feb 21 '17 at 16:55

Anything you do with Javascript will require CRUD rights for the user no matter where you store it. There is no impersonation in JavaScript in SharePoint Online. You could mitigate this to a degree, but you will run into the possibility that people game the system and manipulate their data.

You could create this in a singular list that everyone has contribute rights to, however, you set the item level permissions in the Advanced Settings of the list as such:

item level permissions

This will allow users to do CRUD against their own data. If they happen to get to the list, they can only manipulate their own data, so it doesn't really solve your problem.

If you roll your own REST service in Azure, you could make it a little more robust, but the same issues might come up. If someone starts sniffing the traffic, they could inflate their data by reposting to your service, but it'd be something you have more control over on your service endpoint.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.