I am attempting to traverse up the site hierarchy tree using the Rest API in SharePoint with SPFx in order to create "legacy-style" breadcrumbs. I am basing my component on the code found here.

If the user does not have access to a particular site, I want to simply skip that site and not include it in that user's breadcrumb. The problem is, in an on-prem environment using NTLM-integrated security, the REST API automatically triggers a login dialog prompt when the currently-logged-in user does not have access. Since the current user does not have access, if they input their credentials, it keeps re-prompting them. The only way for the script to proceed, is if the user clicks "cancel", then we can handle the "Access Denied" case in code and continue building the breadcrumb.

How can we just receive an Access Denied message and avoid having the REST call trigger a credential popup when the user does not have permission?


If your SharePoint farm is using integrated security with your local domain, there is no way to directly stop the user from being prompted for credentials when you try to access a resource they do not have access to.

Instead, you would need to check that the user has access to the site first, and if not, then stop traversing up the hierarchy. Ideally, you would be able to call the EffectiveBasePermissions API, but in an integrated scenario where the user has no access, this also causes the credential prompt.

The best workaround is to use the Search API, to search for the site you are going to try to get through the web API. Since search is "security trimmed", instead of throwing an error or prompting for credentials, it will simply not include the site in the results. Use the following REST Query to search for a specific site:


If this returns one result, then you can safely execute the /_api/web REST call, if this query returns nothing, then stop.

| improve this answer | |
  • sorry for the delay, how do I get the parent web URL if the user does not have the permission on parent site. As you mentioned in the Path variable on the Query string, because we can get the parent info using "_api/Web/ParentWeb" it will be returned the result only if the user has the permission on the parent site. Is there any other way to get the parent site url? – Shahul Hameed Feb 19 at 13:11
  • You have the full URL of the current Web, you'll need to use JavaScript string manipulation, like lastIndexOf to trim the last "/currentWeb" to get the parent URL for purposes of executing the query. – willman Feb 19 at 13:19
  • thanks a lot !! – Shahul Hameed Feb 19 at 13:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.