I have an ASP.NET app that accesses SharePoint Online REST API using the
SharePointOnlineCredentials class. The app was working for months, then recently started returning a
401 Unauthorized error. It appears that only programmatic access is being blocked, because if I log into SharePoint Online in a browser and execute a REST request directly, I get valid results back. I don't think it is user-specific, because at least two different apps that access SharePoint (using two different user IDs) are now returning an error.
I took a look in Fiddler, and the direct, in-browser request uses a
FedAuth cookie for authentication. The programmatic request using the
SharePointOnlineCredentials class doesn't show any cookie or Authentication header.
Here's the code I'm using:
webClient.Credentials = _Credentials; // SharePointOnlineCredentials object webClient.Headers.Add("X-FORMS_BASED_AUTH_ACCEPTED", "f"); var uri = new Uri(restUri); response = webClient.DownloadString(uri); // Returns 401
Something had to change that disallows programmatic access or a specific machine (the two apps tested are executing on the same server). Or, possibly, Basic Authentication got disabled/removed. I'm not really a "SharePoint guy", so I don't which, if any, of these are possibilities.
I asked our SharePoint admins, but so far they haven't uncovered any reason for this change in behavior. What could have changed that would suddenly deny access to all users when making a programmatic request in this way?