Ajax call to SharePoint API returns '403 - Forbidden'

Question

I need to access data on a SharePoint Online site from a php application. I'm using SharePoint API with JavaScript trying to achieve this. I already succeeded in accessing the SharePoint site with PowerShell, but now I need to be able to do the same in php.

Here's how far I got until now:

I want to check if the user is logged in to SharePoint, so I'm making the following API call:

    <script>
            function get_user() {
    
                payload = {
                    method: 'GET',
                    headers: { "Accept": "application/json; odata=verbose"
    
                    },
                    credentials: 'same-origin'
                }
    
                fetch('https://domain.sharepoint.com/sites/<sitename>/_api/CurrentUser',payload)
    
                    .then(response => {
                        if (!response.ok) alert(`Something went wrong: ${response.status} - ${response.statusText}`)
                        return response.json()
                    })
    
                    .then(user => {
                        let user_id = user;
                        alert('will code this later when it works :-)');

                    })
    
    
            }
        </script>

However, I keep getting "Something went wrong: 403 - Forbidden". When I just run the URL in the browser while I'm logged in to the SharePoint site, it returns a nice user object.

Any ideas?

Answer 1

You can not directly access SharePoint api in other application like PHP through JavaScript.

Recommended approach is to have an app registration authenticated as single page application.

Below are the high level steps for single page application.

• Register an app in azure ad.
• In Authentication - Select Single Page application
• Give graph api permission
• Use MSAL.js package for authentication and acquiring the token.

Detailed steps are given in below Microsoft docs

• Tutorial: Sign in users and call the Microsoft Graph API from a JavaScript single-page application (SPA)