7

I've read some unofficial things online that using the Javascript client object model to retrieve content from other site collections is not allowed due to prevent the equivalent of "cross site scripting attacks". For example, if I wanted to access some list items from one site collection, and display them in another, I cannot do so.

I tried a simple example and I got the "The security validation for this page is invalid." error message (see end of post for simple example).

Is it true that you cannot go across site collections (assuming user has permissions in both)? If so, where is this called out? All the MSDN/SDK examples make it appear as though you can go across site collections...

    <script type="text/javascript">
 var foo = ExecuteOrDelayUntilScriptLoaded(loadView, "sp.js");

 function loadView(){

    var siteUrl = '/sites/AnotherSiteCollection'
    var ctx = new SP.ClientContext(siteUrl);

    this.web = ctx.get_web();            
    var lists = web.get_lists();
    var list = lists.getByTitle("Shared Documents");
    var views = list.get_views();
    this.View = views.getByTitle("All Documents");
    this.ViewAsHtml = this.calendarView.renderAsHtml();

    ctx.load(this.calendarView);

    ctx.executeQueryAsync(Function.createDelegate(this, this.success), Function.createDelegate(this, this.failure));
 }

 function success() {
    $get("viewContainer").innerHTML = this.ViewAsHtml.get_value();

 }

 function failure(sender, args) {
    alert('Request failed. ');
    alert( args.get_message());
 }

</script>

<div id="viewContainer" > </div>

4 Answers 4

2

According to posters on http://social.msdn.microsoft.com/Forums/bg-BG/sharepoint2010general/thread/6634b3d4-70a5-451f-9c38-cbdc60983b4d You can use the clientObjectModel across site collections if you turn off Web Page Security Validation.

Haven't tested it myself but I remember encountering a security issue when trying to access another site collection, so I definetely think it could work. Of course, turning off security is not an option for most serious applications though...


I agree that this question highlights a major issue with Sharepoint's documentation. I've never MS state that clientObjectModel should only be used in the current site collections or that security should be turned off. On the contrary - Several MSDN examples use a variable where you can set siteCollection and don't mention it as something odd. For example: http://msdn.microsoft.com/en-us/library/hh185011.aspx

var siteUrl = '/sites/MySiteCollection';

function updateListItem() {

    var clientContext = new SP.ClientContext(siteUrl);
    var oList = clientContext.get_web().get_lists().getByTitle('Announcements');

[...]
}

If the code above was only intended to be used on the current site collection, why use a siteURl variable instead of SP.ClientContext.get_current(); ?

EDIT: SP.ClientContext.get_current(); retrieves the context of the current site. If the script runs on a page of a sub-site of the site collection, .get_current() only returns the sub-site's context, so you could not perform operations against a List on its parent site, for example. In the example above, the siteUrl variable can be used to access another sub-site or the main site from the site collection.

Starting to suspect that the MSDN code might have been tested using an application with security turned off and therefore only works under those conditions.

6

Using only the Client Object Model you cannot access another site collection. You can however connect to the web services directly using a variety of methods/libraries such as jQuery. When crossing the site collection boundary, I'll mix and match the two approaches as needed.

3
  • Is there something official I can reference that outlines this limitation of the Javascript Client Object Model?
    – Brian
    Nov 11, 2011 at 18:41
  • Here is a resource that explains the client context: msdn.microsoft.com/en-us/library/ee536158.aspx Nov 11, 2011 at 19:00
  • This link only confuses matters more and seems to indicate exactly my problem with the API/documentation: "The ClientContext constructor (JavaScript: ClientContext(serverRelativeUrl)) initializes a client context based on a specified Web site or site collection. In the managed client object model, the URL must be the absolute URL of a particular Web site. In the ECMAScript (JavaScript, JScript) object model, either a server-relative URL or no parameter is required."
    – Brian
    Nov 11, 2011 at 20:28
1

@Drkawashima, you appear to be correct. Here is a screenshot highlighting a test:

enter image description here

-1

Actually, you can access the subsites by using Javascript Client Object Model. I have done that before. The problem that I found was it will return all the items from the subsite list library. The CAML query can not filter the record out.

1
  • Do you mean a sub web? For the question is about different site collections. Jan 6, 2012 at 15:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.