We run into following problem:

  • We have application, that makes authenticated calls to sharepoint 2013 REST services (PUT and GET). Everything works well, when anonymous access is turned off.
  • But we need to enable anonymous access for two or three lists. When this is done, request for FormDigest from C# code fails always with 403 result – forbidden.
  • I attach following code that is used for making the call. Again, it works fine when Anonymous Access is disabled for this site collection.

            var contextContent = new StringContent(string.Empty,Encoding.UTF8,"text/xml");
            var contextInfoRequest = await contextInfoClient.PostAsync(url + "/_api/contextinfo", contextContent);
            var contextInfoRequestStr = await contextInfoRequest.Content.ReadAsStringAsync();
            var formDigestXml = XDocument.Parse(contextInfoRequestStr);
            var formDigestNode = formDigestXml.Descendants(d + "FormDigestValue").First();
            var formDigest = formDigestNode.Value;
            var itemPostBody =
                Encoding.UTF8.GetBytes("{'__metadata':{'type':'" + entityTypeName + "'}, " + jsonProperties + "}");
            var addRequest = (HttpWebRequest)WebRequest.Create(queryUrl);
            addRequest.Method = "POST";
            addRequest.ContentType = "application/json;odata=verbose";
            addRequest.Accept = " application/atom+xml"; 
            addRequest.Headers["X-RequestDigest"] = formDigest;
            addRequest.Credentials = new NetworkCredential(user, pass, domain);
            var itemRequestStream = await addRequest.GetRequestStreamAsync();
            itemRequestStream.Write(itemPostBody, 0, itemPostBody.Length);

// Following line causes 403 Frobidden Exception:

            var itemResponse = (HttpWebResponse) await addRequest.GetResponseAsync();
            var respStream = itemResponse.GetResponseStream();
            var l = new List<byte>();
            while (respStream.CanRead)
                var i = respStream.ReadByte();
                if (i == -1) break;
            var xml = Encoding.UTF8.GetString(l.ToArray(),0,l.Count);

3 Answers 3


unfortunately, afaik (& tested) the REST services are only working for authenticated users. You'll need to create a bridge service calling with credentials the native ones if you want to provide that functionality but since you're authenticating your request, are you sure it's not an authentication issue ? Does the target username / password combination is valid and have sufficient rights to perfom the expected operations ?

Are you obtaining properly the form digest associated with the page / request (eg : the snippet took from Danny Jessee on his post : http://blog.cloudshare.com/2012/12/16/access-and-manipulate-data-in-your-cloudshare-sharepoint-2013-farm-from-anywhere-with-csom-rest-and-odata/ (which I highly advice you to read since it has pretty similar requirements).

string GetFormDigest()


// To get the form digest for external calls, need to make a POST request to

// http://siteUrl/_api/contextinfo

Uri uri = new Uri(siteUrl + "_api/contextinfo");

HttpWebRequest requestPost = (HttpWebRequest)WebRequest.Create(uri);

requestPost.Credentials = new NetworkCredential("username", "password", "domain");

requestPost.Method = "POST";

requestPost.ContentLength = 0;

HttpWebResponse responsePost = (HttpWebResponse)requestPost.GetResponse();

XDocument doc = XDocument.Load(responsePost.GetResponseStream());

XNamespace ns_dataservices = "http://schemas.microsoft.com/ado/2007/08/dataservices";

return doc.Descendants(ns_dataservices + "FormDigestValue").First().Value;


You should fire this with Fiddler running to see the request / response flows. You might receive a 401/403 if your request is not fully compliant to what SP is expecting (that canary protection took me a while as well in a public SP2010 implementation).

  • In our experience, REST service implementation in SharePoint 2010 leaves much to be desired and anonymous inability is one of the known unwelcome limitations, so we switched to Client Object Model, whether JavaScript or otherwise. Haven't tried 2013 yet, though. Jan 16, 2013 at 7:19

You can disable the Access permission to remote interfaces to the anonymous users, follow this:

  1. Navigate to the site (or sub-site) where you wish to enable anonymous access.

  2. Go to Settings - Site settings.

  3. Under Users and Permissions, click on Site Permissions.

  4. Under the Permissions tab, click on Anonymous Access.

  5. Choose whether you want Anonymous users to have access to the entire Web site or to lists and libraries only. Uncheck Require Use Remote Interfaces permission if anonymous users are complaining they are having issues accessing the site and then click on OK.

From: http://support.sherweb.com/Faqs/Show/how-to-enable-anonymous-access-to-a-sharepoint-site-sharepoint-2013

  • Ernesto, can you include some details regarding the process? We discourage link only posts because blog posts can be moved or deleted. Mar 31, 2014 at 21:53

Old question but we had the same issue (SP2013) by where a site set up for anonymous access (and Use Remote Interfaces permission ticked) would not work with our REST POST calls, thought I would share our solution in case it helps others.

Our solution was to add the X-RequestForceAuthentication header with a value of true to the request to obtain a digest value.

So assuming the original posters contextInfoClient is an HttpClient then the following code would be required to add the header prior to making the PostAsync call:

contextInfoClient.DefaultRequestHeaders.Add("X-RequestForceAuthentication", "true");

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.