How SharePoint-Hosted Apps Authenticate and Authorization? Is it same as Provider-Hosted Apps or different?

Provider-Hosted Apps use OAuth; what about SharePoint-Hosted Apps?

For cross domain scripting we have cross domain libraries SP.RequestExecutor, is it for scripting only or also for Authentication?

1 Answer 1


SharePoint Hosted Apps is only about client-side: the cient authenticates directly against the server. There's no need for advanced authentication mechanism since there's no third-party involved.

oAuth, for instance, allows a third-party (the "provider" part in the case of a provider-hosted App) to "act as" the initial client: even if the request is from a completely random server on the net, SharePoint (kinda) sees it as if it was the client itself.

In the case of a SharePoint-hosted App, it's only a matter of client JavaScript code: so it is either authenticated thanks to a cookie already present in the browser, or it establishes a new authentication handshake, in a transparent manner.

SP.RequestExecutor is more a CORS workaround than authentication. Authentication is not made at that API level, but is mostly handled by the browser.
Said differently (that infamous CORS problem taken apart), the SharePoint-hosted model is nothing else than JavaScript injection in the page.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.