I am writing an application whose logic executes in the browser using JSOM. The application might have permissions that exceed that of those who access the application. Let's say the application simply adds List Items on their behalf, on lists to which they shouldn't have access. It's simple, for example the following creates a new list item that I can then add to some list:

var newItem = list.addItem(new SP.ListItemCreationInformation());

My problem is the following what-if scenario: what if a savvy user fires up Developer Tools, or the JavaScript console on their browser and starts project mayhem?

I believe this applies to all kinds of SharePoint apps, but I'm using SharePoint-hosted.


A SharePoint hosted app will always use the current users permissions to do stuff! There is no way to elevate the code to the application context, to be able to do that you would have you use the CSOM in .Net, which you can not do in an SharePoint hosted app.

So, to do stuff the current user lacks permissions to do (example, let anonymous users add list items in a list they have read-only rights to), you must use Provider Hosted (or, not recommended, Auto Hosted) app, and write the code doing the add in CSOM .Net

| improve this answer | |
  • Thanks. That makes sense, just wanted someone to assure me :). It is self explanatory if you think of JSOM outside the context of an app... JSOM is accessible in any SharePoint page. If my concern was valid, whole security model would be useless. – Mzn May 7 '14 at 4:30
  • 1
    Exactly, but at least I also had troubles grasping this in the beginning :) – Robert Lindgren May 7 '14 at 5:48

JS csom access is restricted by current visitor's permissions. For instance, is current visitor's access rights is read only, he will only be able to read or even not run JS csom. On the other hand, it is possible that your custom JS CSOM code will not possible to be executed unless the sp.js library is loaded for "read only" users. To reach this, please add the following code to your masterpage header section:

<SharePoint:ScriptLink ID="ScriptLink21" Name="sp.js" runat="server" OnDemand="false" LoadAfterUI="true" Localizable="false" />
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.