Authorization header must be sent along for this request to be authenticated.
Authorization header to be included in my REST calls I need the
Access-Control-Allow-Origin header sent by SharePoint to contain a specific host name (specifically not '*' as this prevents the header from being sent.)
Unfortunately in SharePoint 2016 the
Access-Control-Allow-Origin header seems to be hard-coded to '*' according to this blog post:
Quote from the blog post:
Since SharePoint only accepts OAuth for CORS requests, and not user authentication such as cookies, Cross Site Request Forgery is a non-issue as origin validation does not need to take place when using OAuth. As such, setting Allow-Cross-Origin-Request to ‘*’ becomes a non-issue.
Now the question is, how to deal with this situation?
- Can CORS for SharePoint 2016 be configured in a way to explicitly use host names for
- Is some kind of add-in registration (appregnew.aspx) and/or add-in package (dummy?) necessary for this to work? Note: no server-to-server communication is needed. Only plain JS XHR from the browser.
Any thoughts are appreciated.