Sharepoint Rest API Error 403

Question

i have a sharepoint farm with two different web applications. When i'm trying to access the second web application with java script from a page of the first web application, i always get an http error 403.

Sample Code on web application 1:

$.get({ 
        url: "https://webapplication2/_api/web/lists/getbytitle('documents')/Items?$select=Title",
        headers: { "Accept": "application/json;odata=verbose" },
        contentType: "application/json; odata=verbose",
          xhrFields: {
              withCredentials: true
         },
        success: function (data) { 
           if (data.d.results) { 
              // TODO: handle the data  
              console.log('handle the data'); 
           } 
        }, 
        error: function (xhr) { 
            console.log(xhr.status + ': ' + xhr.statusText); 
        } 
     }); 

We have already installed August 2018 CU for the cors preflight setting:

$stsConfig = Get-SPSecurityTokenServiceConfig
$stsConfig.ActivateOkResponseToCORSOptions = $true
$stsConfig.Update();

We also configured the cors iis module for accepting all request from all origins:

<cors enabled="true">
    <add origin="*" allowCredentials="true">
        <allowHeaders allowAllRequestedHeaders="true" />
    </add>
</cors>

When i'm trying to access the url in the browser, i get a correct answer.

Can anyone help me with this issue?

Answer 1

You could try to use JSOM to access cross site collection.

Sample code(the user need permission to target site collection).

<script type="text/javascript">
        function CrossSiteCollection() {
            var siteUrl = "http://sp";
            var clientContext = new SP.ClientContext(siteUrl);
            this.oWebsite = clientContext.get_web();

            clientContext.load(this.oWebsite);

            clientContext.executeQueryAsync(
                Function.createDelegate(this, this.onQuerySucceeded),
                Function.createDelegate(this, this.onQueryFailed)
            );
        }

        function onQuerySucceeded(sender, args) {
            alert('Title: ' + this.oWebsite.get_title() +
                ' Description: ' + this.oWebsite.get_description());
        }

        function onQueryFailed(sender, args) {
            alert('Request failed. ' + args.get_message() +
                '\n' + args.get_stackTrace());
        }

    </script>