Has anybody been able to REST Upload cross site/domain of a file to a document Library with REST on SPO 2013 thru embedded page code or NAPA? Wondering how app security is set on the TargetSite? I can do it to a doc lib on the same site, but cross gives me 403 - Denied. User has full control to both sites.

Here's my code. Note the two URLs /sites/dev vs /sites/test

    function PerformUpload(fileName, fileData) {
    var url;

    //var path = appWebUrl; var p = path.split('/');var approot = p[0]+"//"+p[2]+"/"+p[3]+"/"+p[4];

        url = 'https://mytenant.sharepoint.com/sites/dev' +
          "@TargetSite='" + 'https://mytenant.sharepoint.com/sites/test'+ "'" +
            "&@TargetLibrary='Documents'" +
            "&@TargetFileName='CV" + fileName + "'";

        url: url,
        type: "POST",
        headers: {
            "Accept": "application/json; odata=verbose",
            "X-RequestDigest": $("#__REQUESTDIGEST").val()

        data: JSON.stringify({ '__metadata': { 'type': 'SP.List' }, 'Title': 'New title' }),

        contentType: "application/json;odata=verbose",
        binaryStringRequestBody: true,
        body: fileData,
        error: errorHandler

You need to implement a cross domain policy file on the Document Library that you are connecting to.

Here is an article explaining how to do this.


// Load the cross-domain library.
$(document).ready(function () {
var hostweburl;
var appweburl;

//Get the URI decoded URLs.
hostweburl = decodeURIComponent(
appweburl = decodeURIComponent(

// Load the .js files using jQuery's getScript function.
    hostweburl + "/_layouts/15/SP.RequestExecutor.js",

// After the cross-domain library is loaded, execution
//  continues to this function.
function continueExecution() {
    var executor;

    // Initialize your RequestExecutor object.
    executor = new SP.RequestExecutor(appweburl);

    // You can issue requests here using the executeAsync method
    // of the RequestExecutor object.

// Function to retrieve a query string value.
function getQueryStringParameter(paramToRetrieve) {
    var params =
    var strParams = "";
    for (var i = 0; i < params.length; i = i + 1) {
        var singleParam = params[i].split("=");
        if (singleParam[0] == paramToRetrieve)
            return singleParam[1];
  • Thank you. Maybe I missed it, but the article does little on how to implement it. Please note this is on SharePoint Online and My code is embedded into a page, so no VS or NAPA deployment is going on. Also, I googled "implement a cross domain policy file on a SharePoint Document Library" and found very little. – Hell.Bent Sep 6 '13 at 8:15
  • I don't know much about SPOnline but I know this article is solving the exact issue you are describing in the exact environment. You have to use the SPExecutor object to perform your requests on the site. – Joseph D Surgeon Sep 6 '13 at 14:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.