1

In an on-premises scenario I need to call SharePoint 2016 REST services (via XHR) from JavaScript. The calls will originate from a host different from the SharePoint host. To allow these calls I need to configure CORS on the SharePoint side. The Authorization header must be sent along for this request to be authenticated.

For the Authorization header to be included in my REST calls I need the Access-Control-Allow-Origin header sent by SharePoint to contain a specific host name (specifically not '*' as this prevents the header from being sent.)

Unfortunately in SharePoint 2016 the Access-Control-Allow-Origin header seems to be hard-coded to '*' according to this blog post:

https://thesharepointfarm.com/2017/03/cors-http-headers-in-sharepoint-server-2016/

Quote from the blog post:

Since SharePoint only accepts OAuth for CORS requests, and not user authentication such as cookies, Cross Site Request Forgery is a non-issue as origin validation does not need to take place when using OAuth. As such, setting Allow-Cross-Origin-Request to ‘*’ becomes a non-issue.

Now the question is, how to deal with this situation?

More specifically:

  • Can CORS for SharePoint 2016 be configured in a way to explicitly use host names for Access-Control-Allow-Origin?
  • If this is not possible: how to use OAuth in SP 2016 on-prem from JavaScript? Which authentification endpoint must be used? Which flows are supported? We are not talking about an add-in here, but about plain JS running in another host.
  • Is some kind of add-in registration (appregnew.aspx) and/or add-in package (dummy?) necessary for this to work? Note: no server-to-server communication is needed. Only plain JS XHR from the browser.

Any thoughts are appreciated.

0

Evantually we successfully used the URL Rewrite module, evaluating and inserting CORS headers when requests come in. This is happening outside SharePoint, as part of IIS request processing.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.