I have been banging my head against a wall on this problem for weeks now

Warning and Disclaimer .. I have very little JavaScript experience when it comes to REST / Web Services

  • I have an on premises SharePoint 2013 server running on a corporate AD domain
  • SharePoint authentication is Claims based NTLM
  • I have a mobile phone HTML5 app

I want to basically make SharePoint REST (or Web Service) calls from the phone app but I cannot work out how to pass over any NTLM credentials.

Is this even possible natively from JavaScript, or would I have to write my own anonymous Web Services and use the .NET Managed OM to proxy all of my requests around?

  • I've personally gone the anonymous web service route you mentioned. I've added a bounty to this question because I would really like to know how to do it, if its even possible. Jul 11, 2013 at 18:32

6 Answers 6


In your scenario it looks like you have some kind of mobile app running on android or iphone. As you talk about javascript it seems your talking about some kind of webview application (like phonegap). Simplified this is an app that is hosting a browser control. Typical development on the client using native tools for the plattform will work the way you descibe your probleme. The application is handing over the credentials to the object and the object is authenticating against sharepoint. For your scenario there is no native code running as you run in the "browser". In javascript there is no way to authenticate directly within your code. The hosting browser is authenticating against the url and any fututre request within the authenticated "session" is working. In your scenario you will try to access the REST api of sharepoint and the server is sending back a 401 HTTP status code so the browser lets the user enter the credentials. It depends on the API your using to make your REST request this 401 is not handled and the user is not able to authenticate.

If you are using some kind of emulator you can try to capture the traffic using Fiddler (www.fiddler2.com). This is a proxy that shows you any request your made and you will find the HTTP rest url and a 401 as reply.

Possible solutions depending on the software your use:

  • You could try to nagigate the "browser" inside of your application to show some kind of content from the sharepoint server. Try a picture from the sharepoint url. The "browser" normaly trieds to authenticate and will prompt the user to authenticate (depends on the platform). maybe you can change a setting of the "browser" that autnetication is allowed. After that authentication request you should be able top authenticate to the REST service.
  • [EVIL] Switch to basic authentication (you MUST use HTTPS) on the sharepoint web application (maybe a special zone only for the app). Your rest request can be authenticated directly within the url: http :// [email protected]:[email protected]/...

There might also be an issue with the type of authentication. If the mobile platform is only doing NTLM v1 and your company hopfully disallows this authentication (because it is insecure) you will never be able to access the REST endpoint. Try to get some kind of HTTP monitoring sofwtare between you (the app) and the server. Try fiddler or wireshark to gather more information about the problem.

  • If there are no constraints that the company is placing on the servers, are we certain basic authentication works with SharePoint this way? Is there any way to salt/hash/encrypt/etc. the credentials in addition to HTTPS? Jul 15, 2013 at 13:31
  • This is what all of my research led me to as well and I couldn't even get basic authentication to work properly either which is why I was looking for examples along with the bounty. That being said this answer has more or less confirmed my thoughts so I'll award the bounty to you. Thanks for answering! Jul 17, 2013 at 14:51

Roll your mobile app up into a 'provider-hosted' SharePoint app model app. Authenticate using OAuth.

Context Token OAuth flow for SharePoint Add-ins


As far as, you are using Sharepoint webservice to acheive this task, follow the MSDN instructions here.


I think you should include the FEDAUTH HTTP header within your request if you re using jquery with ajax calls .. you can setup default options with $.ajax.setup to specify what default header you should include in your requests.

"content-type": "application/json;odata=verbose",
"accept": "application/json;odata=verbose"

You only have to add your FEDAUTH header to the request.


The Accepted solution has the best approach in it, which is make a call to a default home page at first so user is promoted with authentication screen, after authentication do a redirect to you HTML5 App.

In a similar scenario i adopted a different approach, created a Proxy Service with c# which would do the authentication to SharePoint, could be accessed anonymously and only exposed the needed SharePoint API's

  • 1
    This does not give an answer. You can comment the author of the post. Or ask a new question.
    – Asad Refai
    Jan 21, 2016 at 10:51


The MSDN is quite full of client authentication, have you seen this one

Authenticate users to SharePoint and Video

For use via Javascript only use

Accessing Office 365 SharePoint Sites Using REST From A Local HTML / JavaScript Host also explained Here

  • Those all include C# code (which you can't execute on an iPhone / Android device). I was thinking of building a Web Service to generate the cookie using OAuthenticator .. but apparently the cookie is URL based so the JavaScript page needs to be on the same URL as the Web Service (again .. not going to happen) Apr 8, 2013 at 9:22
  • Also the ODataAuthenticator class referenced in that sample is part of the SharePoint SDK for Windows Phone .. so how it would execute on iPhone / Droid is confusing at best Apr 8, 2013 at 9:42
  • I've updated the answer with actual examples of JavaScript based authentication! Feb 15, 2014 at 18:05
  • @Marius - I tried the JavaScript method to authenticate, however didn't succeed in getting it to work. I m getting the "HTTP Error 403.14 - Forbidden; The Web server is configured to not list the contents of this directory." error. Any suggestions.
    – bkk
    Jun 5, 2014 at 9:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.