REST API with HTTP in Sharepoint Online

Question

I am trying to consume a REST API that the protocol is HTTP, no HTTPS. But, as Sharepoint Online uses protocol HTTPS, I am getting this error:

Mixed Content: The page at 'https://integralinf.sharepoint.com/sites/guilherme.nass/fischer/SitePages/P%C3%A1gina%20Inicial.aspx' was loaded over HTTPS, but requested an insecure XMLHttpRequest endpoint 'http://api.promasters.net.br/cotacao/v1/valores/'. This request has been blocked; the content must be served over HTTPS.

My code is:

$(document).ready(function() {
    $.ajax({
        method: 'get',
        url: 'http://api.promasters.net.br/cotacao/v1/valores/',
        success: function(data){  
            console.log(data);
        },
        error: function(err) { 
            console.log(err);
        }
    });
});

I can't change the REST API to uses HTTPS, because it's not my API, it is only an API that I found.

Is there any solution for this? I really need to use this API.

Answer 1

I created a small example for you to use.

This example forwards your request to the requested endpoint http://api.promasters.net.br/cotacao/v1/valores/

If you pass which resource you want to reach to the proxy it will give you the same response.

https://sharepintdemo2.azurewebsites.net/valores/

Here is a description of how to do it. First create an Azure Function App. Call it what ever you want. Probably something with your company name.

Second, create a new Proxy.

Third, fill in your settings.

By entering a route template you can forward the passed parameters to the Backend URL.

And voila!

Answer 2

You will be required to use an https endpoint for your Rest API. The mixed content issue is well known, and any attempts to circumvent are just BAD practice (And a waste of time).

Actions to resolve your issue:-

• Setup a very basic Rest API that you control, that acts as a simple proxy to the API that you require. Basically you call the3rd Party API from you API. Then inside sharepoint call your API

• Approach the vendor and explain to them your situation. Any vendor in this space that wishes to be taken seriously should be able to provide a HTTPS endpoint so as not to isolate potential consumers of it.

Ultimately this is by design. And it is a good design because it collectively increases the security of the web and it users.

Answer 3

The reason that we don't serve content via a HTTP endpoint is quite simple. You would be passing an authentication cookie to the server, and we wont allow you to do that, since others could intercept it on an insecure channel and that would allow them to hijack your session.

So the simple solution is to switch to HTTPS, since you even said the snippet is your code.