I would like to make an HTTP GET Request using the SharePoint REST API and I would also like to invoke the API based on the fact that my browser is already logged in, so I do not need to explicitly authenticate by entering the username and password in my GET request.

Is this possible in JavaScript and if Yes then how to do it?

I intend a flow like the following:

1) I execute the aforementioned JavaScript code on my own web page.

2) The code invokes the SharePoint REST API. Note that my own web site and the SharePoint system are distinct sites.

3) the invocation leads to a JSON/XML response which I can then manipulate using my script from 1)

  • That does clear things up a bit. I deleted my answer because my assumption was wrong and if I just changed my answer, all of our comments wouldn't make sense any more. I do have one more question. When you say your browser is already logged on to SharePoint, do you mean something like, you're logged onto SharePoint in one tab and connected to your external site in another tab? Or you're logged onto SharePoint in a iframe of your external application? Or what?
    – Joe McShea
    Feb 24 '20 at 22:29
  • I mean that I am logged in via a tab. :-)
    – Birdie
    Feb 24 '20 at 22:32

Ok, the bad news is, there is no way to share credentials between two browser tabs that are connected to two distinct applications. There is also no way to authenticate to the REST services using just a user name and password, as that would be very insecure too.

The SharePoint credentials go back and forth from browser to server in a cookie. And browsers enforce isolation between different web sites via what's called the Same Origin Policy. The origin is the protocol, port and server name, so for instance http://a.sharepoint.com/pages/a.aspx and http://a.sharepoint.com/pages/b.aspx share the same origin of http://a.sharepoint.com. But if there is any variation in the origin, those tabs/instances will not be able to share data like cookies, and as a result your second tab with your external app is not logged into SharePoint.

There are a couple of ways to try to work around this, both of which are pretty advanced topics that can't be fully addressed in a forum like stack exchange.

The first is that you can load SharePoint in an iframe in your external application and use window.postMessage to pass REST requests from your external application to SharePoint and pass responses back the same way (i.e. with window.postMessage). I wrote a few blog posts about this a year or so ago, that took about 6000 words with pictures and lots of source code, which is why I say it cannot be fully addressed here.

The second is that you can register your external app to get a client ID and secret and use OAuth to pass these as credentials to the REST service. There is a pretty good introductory blog post on this topic titled Performing OAuth and Rest calls with SharePoint Online (Without creating an add-in), with lots of good links to other resources on the topic.

  • I can’t get your first link to work? But thanks! I will look into this. Does the iframe approach follow the same origin principle?
    – Birdie
    Feb 24 '20 at 23:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.