I have create a SharePoint Hosted App and installed on a Site which is located on WebApplication1. This app tries to get list items from a list in a site which is located on Webapplication2. I have tried different solutions (REST and csom) but it generates access denied. Following is my code.

I have added a RemoteEndPoint to the manifest file which points to the web that contains the list.

 var appweburl = decodeURIComponent(getQueryStringParameter("SPAppWebUrl"));

var blogWebUrl = "https://webapplication2.com/personal/userName/Blog";

var context1 = new SP.ClientContext(appweburl);

var factory = new SP.ProxyWebRequestExecutorFactory(appweburl);


var blogWebContext = new SP.AppContextSite(context1, blogWebUrl);

var blogWeb = blogWebContext.get_web();

var list = blogWeb.get_lists().getByTitle("Posts");

var camlString =
  "<View><ViewFields>" +
      "<FieldRef Name='Title' />" +
      "<FieldRef Name='Body' />" +

var camlQuery = new SP.CamlQuery();
var allPosts = list.getItems(camlQuery);

context1.load(allPosts, "Include(Title, Body)");

   Function.createDelegate(this, function (sender, args) {
    Function.createDelegate(this, function (sender, args) {
        alert('failed: ' + args.get_message());

2 Answers 2


Is the MySite host in the same O365 tenancy or the same on-premises SharePoint web application as the app? If it is, then you can use SharePoint's Cross-Domain JavaScript Library. See the SDK topic http://msdn.microsoft.com/en-us/library/fp179927.aspx

If they are not in the same tenancy or web application, then a SharePoint-hosted app cannot get data from the MySite. This is by design. It is for security reasons to block cross-domain scripting attacks. You will need to use a SharePoint provider-hosted app or a SharePoint autohosted app.

  • they are not in the same web application
    – Medes
    Commented Jul 29, 2013 at 6:43

Your code seems okay at a glance.The "camlString" variable and the "Include(Title,Body)" seems redundant but I doubt that would cause any problem.

var blogWebUrl = "https://webapplication2.com/personal/userName/Blog";

^is this intentional? "/userName/Blog" doesn't seem right

Also, you can try to add an AppPermission in the App Manifest thats prompts you to accept the app to read Lists (select the list you want during the prompt) on install. Perhaps your site has permission issues.

  • when you want to get posts from "Posts" list located in Blog site for a user, You have to get it by the url. Isn't it? (if you use REST Api). I have added Full Control for Web and Sites in the Manifest file.
    – Medes
    Commented Jul 10, 2013 at 6:28
  • ^yes everything you've said above sounds correct. But all I was saying earlier was allowing for Full Read Permissions of Lists which can be done in the App Manifest file. That's how I've been letting the app read lists. Of course Full Control for Web and Sites may encompass that.
    – zigo
    Commented Jul 10, 2013 at 12:22
  • all I need to achive is, Getting my posts from Blog site by using REST. it seems impossible because My Site Host located on another Web application than the one that contains the app.
    – Medes
    Commented Jul 11, 2013 at 8:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.