Access is denied in MicrosoftAjax.js in SharePoint-Hosted app when querying host web list items

Question

Whenever, I try to query list items from the host web in my app, I am getting access denied in MicrosoftAjax.js on the point where it is calling xmlHttpRequest.open().  The code is hosted in a Client Web Part in this case.  I'm following the basic examples as seen on this article and I thought it should work.  The basic code:

context = new SP.ClientContext(spHostUrl);web = context.get_web();

   var list = web.get_lists().getByTitle('My List').val());

    var camlQuery = new SP.CamlQuery();
    camlQuery.set_viewXml('').val());

    this.listItems = list.getItems(camlQuery);
    context.load(listItems);

    context.executeQueryAsync(Function.createDelegate(this, this.onQuerySucceeded),
        Function.createDelegate(this, this.onQueryFailed));

I don't need the cross-domain library since it is SharePoint hosted right?  I tried that approach anyways and it didn't work either.  It gave me "App Web is not deployed for this app's request url".

I also tried requesting Web and Lists access in the App Manifest but that did not make any difference either.

Corey Roth - SharePoint Server MVP blog: www.dotnetmafia.com twitter: @coreyroth

Answer 1

I believe you do need to use cross-domain library. You code is from you App web to the Host Web which are two different domains with SharePoint hosted options. If you are querying list from App web then you do not need cross-domain library.

Please check out sample at http://code.msdn.microsoft.com/officeapps/SharePoint-2013-Bookstore-328060fc/view/SourceCode#content. It is using JavaScript from remote App but shows the use of cross-domain library with REST API.

Answer 2

That makes sense but what doesn't is why there are so many examples without using the cross-domain library.  That is why I tend to think it is possible somehow.

---

Corey Roth - SharePoint Server MVP blog: www.dotnetmafia.com twitter: @coreyroth

Answer 3

All examples yo are seeing may query the App web lists/items from JavaScript so there is no cross-domain concern. Without cross-domain library, you could try REST API without using JavaScript OM library but again I think you are cross-domain. In case of using REST API with JavaScript, I believe you would need to supply access token in order to get away from access denied error. With JavaScript cross-domain library, there is no need for the access token.

jQuery.ajax({
  url: “http://site url/_api/web/lists”,
  type: "GET",
  headers: {
  "ACCEPT": "application/json;odata=verbose",
  "Authorization": "Bearer " + accessToken
 },
})

Please see page at

http://msdn.microsoft.com/en-us/library/jj164022(v=office.15).aspx

Answer 4

Because the host web and app web are on different domains, you'll have to create two contexts - one for the app web (which will be the actual "context" and one for the host web (which will be more of a pseudo context).  The code would look something like this:

    spcontext = new SP.ClientContext.get_current();
    //then use the host web URL to get a parent context -this allows us to get data from the parent
    parentCtx = new SP.AppContextSite(spcontext, SPHostUrl);
    parentWeb = parentCtx.get_web();
    //grab the list of lists from the parent web
    lists = parentWeb.get_lists();
    spcontext.load(lists);
    spcontext.executeQueryAsync(success, failure);

---

Elisabeth Olson SharePoint PM - MSFT

Answer 5

Thank you Elisabeth!  That worked perfectly.  I am pretty sure that is not documented anywhere.  It should be mentioned in this article.  I'll also write up a blog post tonight on it because I think that it's important to share.

Thanks again and if you're at SPC, look me up, because I owe you a drink.  

---

Corey Roth - SharePoint Server MVP blog: www.dotnetmafia.com twitter: @coreyroth

Answer 6

I did a write up on the working code sample that I was able to get to work.  Thanks again.

---

Corey Roth - SharePoint Server MVP blog: www.dotnetmafia.com twitter: @coreyroth

Answer 7

Glad I could help!  Unfortunately I have to miss SPC this time around - I'm expecting a baby in early Dec, so flying (and, for that matter, drinking) are off the table for me.  Maybe have a round in my honor instead?  :-)

---

Elisabeth Olson SharePoint PM - MSFT

Answer 8

Understood and congratulations!  We can certainly do that.  Thanks again.

---

Corey Roth - SharePoint Server MVP blog: www.dotnetmafia.com twitter: @coreyroth

Answer 9

Hi,

Have you ever tried to access resources in other site collections? This works perfectly for the "current" site collection, but I'm getting access denied when trying to access other site collections.

I've requested access to all site collections in appmanifest, and I thought that should be enough, but it's not working.