I'm trying to develop a widget for deployment on Sharepoint Online.

The issue is that I need to retrieve personal information for the user from my REST API - however to do so I need to sign the request with my API key.

How should I do this using Sharepoint without exposing the API key on the client side, i.e. in the user's browser? What is the architecture I should be using? How can I create a hosted(?) server side sharepoint app which talks to the REST API?

The following diagram hopefully explains the current approach which has the security flaw.

enter image description here

Thanks for your help.


As you noticed, you can't really used an API key in this scenario as it's exposed to the client. One way in which you could implement the connection in a secure manner, is to implement OAuth implicit flow and have your REST API secure with Azure Active Directory. With the implicit flow, you won't be exposing a secret to the client. Instead the access token will be granted based on the ID of your web part as well as the URL of the page where the web part is placed. The challenge with this approach is that you have to know upfront all pages on which the web part will be placed as these URLs have to be registered with the AAD app securing the API. For more information on this approach see https://docs.microsoft.com/en-us/sharepoint/dev/spfx/web-parts/guidance/connect-to-api-secured-with-aad.

| improve this answer | |
  • Great thank you! The URL constraint is a good heads up - so we'd need to write a separate AAD app for every client that wants to embed our widget on their Sharepoint? Oh dear!! – Toby Beresford Nov 9 '17 at 17:24
  • Not necessarily. You can define a number of URLs for each app, but it still complicates just adding the web part to a random page. – Waldek Mastykarz - MVP Nov 9 '17 at 19:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.