Before i start implementing my own custom security i thought i'd ask around perhaps you guys have any tested approach.

I have a SPO Provider hosted add-in (hosted in azure) and i need to secure it. What do i mean by that? When you build the C# add-in, users that did not follow the app link will get an error IF the page has any request to sharepoint. In my case the homepage (for example) doesnt. Its a portal page with no connection to sharepoint.

The SPO connection happens in a different page (not main) which can only be accessed by logged in SPO users (otherwise token error).

Did anyone implement anything like this to restrict access to any page unless the app was started from SPO?

The problem here is (except the home page) that i have a custom errors page. If the link went through SPO, the error page should display something. If the user doesnt have access to sharepoint (random external user), he should get either a blank page or a custom error (like the default one saying to run the app from sharepoint).

I've worked in the past with NETCore custom auth policy, but i dont have that much experience in MVC. Is there something similar?

EDIT: Just remembered there's a filter called [SharePointContextFilter]. Can i perhaps use that to display custom error pages in case the SPO Context is missing?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.