5

In an on-premises scenario I need to call SharePoint 2016 REST services (via XHR) from JavaScript. The calls will originate from a host different from the SharePoint host. To allow these calls I need to configure CORS on the SharePoint side. The Authorization header must be sent along for this request to be authenticated.

For the Authorization header to be included in my REST calls I need the Access-Control-Allow-Origin header sent by SharePoint to contain a specific host name (specifically not '*' as this prevents the header from being sent.)

Unfortunately in SharePoint 2016 the Access-Control-Allow-Origin header seems to be hard-coded to '*' according to this blog post:

https://thesharepointfarm.com/2017/03/cors-http-headers-in-sharepoint-server-2016/

Quote from the blog post:

Since SharePoint only accepts OAuth for CORS requests, and not user authentication such as cookies, Cross Site Request Forgery is a non-issue as origin validation does not need to take place when using OAuth. As such, setting Allow-Cross-Origin-Request to ‘*’ becomes a non-issue.

Now the question is, how to deal with this situation?

More specifically:

  • Can CORS for SharePoint 2016 be configured in a way to explicitly use host names for Access-Control-Allow-Origin?
  • If this is not possible: how to use OAuth in SP 2016 on-prem from JavaScript? Which authentification endpoint must be used? Which flows are supported? We are not talking about an add-in here, but about plain JS running in another host.
  • Is some kind of add-in registration (appregnew.aspx) and/or add-in package (dummy?) necessary for this to work? Note: no server-to-server communication is needed. Only plain JS XHR from the browser.

Any thoughts are appreciated.

Improve this question
4

1 Answer 1

Reset to default
4

Evantually we successfully used the URL Rewrite module, evaluating and inserting CORS headers when requests come in. This is happening outside SharePoint, as part of IIS request processing.

Improve this answer
3
  • So, just to be clear, setting headers manually does not work, using the official IIS module for CORS does not work, but setting a Rewrite module rule to modify the headers does work? I guess it must run after whatever core Sharepoint logic is forcibly setting ACA-Origin: * ?
    – Coderer
    Jul 31, 2020 at 8:53
  • I think yes. The Rewrite module modifies what SharePoint generated..
    – Heinrich Ulbricht
    Jul 31, 2020 at 10:03
  • 1
    Ugh. It sounds like this might be the only real solution for on-prem. I was waiting for an official answer from someone on the PnP/SP team but it's been a while and nothing yet. (All the solutions in the docs require you to authenticate through login.microsoftonline.com -- not much help for a farm that's not on the internet!)
    – Coderer
    Aug 3, 2020 at 14:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.