I've developed a Visual Web Part for Sharepoint 2010 that includes an HTTP handler for some AJAX functionality. I followed this guide to accomplish this.

I've createad a brand new SP 2010 web application under Sharepoint 2010 server to test this web part.

The problem is that when I try to access the handler with some new users I get access denied as follows:


But it works just fine with my user (the one I'm using to develop and deploy the webpart in VS)

The site is configured to use Windows authentication (FBA is not enabled).

Another weird thing is that I've another 2 visual web parts with the same structure and an http handler that works just fine with every user. So there's something in this particular handler that's causing the access denied problem.

Any idea how to solve this problem? Where to start looking at least to see why I'm getting it?

UPDATE I've noticed that the handler only works for user in the site collection admin group. For the site collection members group (with contribute permission) it throws the access denied.

UPDATE 2 I've commented everything and left just the method ProcessRequest with a simple return string and it works for every user. So it's something I'm doing inside the handler that non-admin users doesn't have permission to do. I'll check each method too see what it's causing the error.


2 Answers 2


Common issue is:

The web part is located on a page of subsite, and tries to retrieve data from '/_layouts/somefolder/somehandler.ashx'. But this url is the url of root site which user have not access to.

In this case you should use '<%= SPContext.Current.Web.ServerRelativeUrl %>/_layouts/somefolder/somehandler.ashx'

  url: "<%= SPContext.Current.Web.ServerRelativeUrl %>/_layouts/somefolder/somehandler.ashx",
  context: document.body
}).done(function() { 


  • Yes, the http handler is located under 'root-site/_layouts/myHandler/myHandler.ashx'. See my update, the users getting this errors are those that aren't admin, but contributing members. The weird thing is that the other 2 web parts that works, also have a http handler like this, located under layouts mapped folder. So I don't know why these 2 works, but the other one doesn't. I didn't understand where to use what you said. I'm just trying to access the handler via URL to test if it works. The webpart uses jQuery.ajax to call the handler.
    – empz
    Mar 22, 2012 at 19:51
  • if you call this function from markup you can use something like I added to my answer, in other case you should pass server relative url as parameter. If it is not a reason, you can try to attach to W3wp.exe process and debug your code, in this case you can find a line that throws an error.
    – Alexander
    Mar 22, 2012 at 19:59
  • Yes, I understand, but if you see my Update 2 you will see that the problem is inside the handler, not accessing it. I can access it, but some code inside is doing something that non-admin users doesn't have permission to do.
    – empz
    Mar 22, 2012 at 20:02
  • try to attach to W3wp.exe process and debug your code, in this case you can find a line that throws an error. Could you debug handler?
    – Alexander
    Mar 22, 2012 at 20:06

The problem is that I was trying to do the following inside the handler:

SPSite siteColl = SPContext.Current.Site;
var webs = siteColl.AllWebs;

And that fails when a non-admin user is logged in.

So instead of using AllWebs, I used:

var webs = siteColl.OpenWeb().GetSubwebsForCurrentUser()

More info about GetSubwebsForCurrentUser() here

  • This only gets subwebs in the root webs. You will have to do a recursion function to go through subwebs of subwebs and so on...
    – harsimranb
    Mar 21, 2013 at 18:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.