External list using REST API doesn't work

Question

I just tried to call the Rest API using Ajax, but the server redirects me multiple times to authenticate. Finally, I get an error from the server with both a different domain and same domain name that I used. My Ajax doesn't access the Rest API. Here is what the error say:

jqueryy-3.2.0.min.js:4 Failed to load https://Jass.ABC.org/dhis-web-commons/security/login.action: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'https://my.program.org' is therefore not allowed access.

Answer 1

You can't use Ajax to call SharePoint REST API in difference domains because of the cross domain problem.

As a workaround, we can create a custom web service in SharePoint to retrieve data via CSOM/SSOM and remember to set the response header [Access-Control-Allow-Origin : *], then you can call the custom web service by Ajax.

More information about create custom web service in SharePoint for your reference:

Walkthrough: Creating a Custom ASP.NET (ASMX) Web Service in SharePoint

Walkthrough: Creating a Custom Web Service

Answer 2

Because modern browsers have CORS. With CORS, you can't call across domains. Seems like you can going from program.org to ABC.org, and in order for these REST calls to work, you'd have to call from the same domain. SharePoint get's around it in apps by using SP.RequestExecutor.

Answer 3

As documented in Microsoft's "Complete basic operations using SharePoint REST endpoints," the REST API requires that you either use OAuth for request authorization or that you include the server's request form digest value.

Another important consideration when creating, updating, and deleting SharePoint entities is that if you aren't using OAuth to authorize your requests, these operations require the server's request form digest value as the value of the X-RequestDigest header. You can retrieve this value by making a POST request with an empty body to http://<site url>/_api/contextinfo and extracting the value of the d:FormDigestValue node in the XML that the contextinfo endpoint returns.

[...]

If you're using the authentication and authorization flow described in Authorization and authentication of SharePoint Add-ins, you don't need to include the request digest in your requests.

If you're using the JavaScript cross-domain library, SP.RequestExecutor handles getting and sending the form digest value for you.

If you're creating a SharePoint-hosted SharePoint Add-in, you don't have to make a separate HTTP request to retrieve the form digest value. Instead, you can retrieve the value in JavaScript code from the SharePoint a page (if the page uses the default master page), [...]