403 Error on REST/JSOM call within a form in SharePoint 2013

Question

I try to update a ListItem in a (foreign) SiteCollection wihtin an edit form by CSOM. But I can't get it to work without getting a 403 error:

cs.updateListItem = function(siteURL, listNameSTR, itemID, propertiesOBJ, successFUN)
{
    var ctxOBJ = new SP.ClientContext(siteURL);
    var listOBJ = ctxOBJ.get_web().get_lists().getByTitle(listNameSTR);
    var itemOBJ = listOBJ.getItemById(itemID);

    for(var propertySTR in propertiesOBJ) {
        itemOBJ.set_item(propertySTR, propertiesOBJ[propertySTR]);
    }

    itemOBJ.update();
    ctxOBJ.executeQueryAsync(
        Function.createDelegate(this, successFUN), 
        Function.createDelegate(this, function(senderOBJ, argsOBJ){console.log(argsOBJ.get_message() + "\n" + argsOBJ.get_stackTrace());})
    );  
}

I also tried the same with a REST call...

• Its not the Security Token/Digest (tried that in different ways)
• It's not the user permissions (I tried even with farm admin)
• Within the current site collection it works
• it works if I fire the script on every other site, it only crashes within the form
• I created a new plain vanilla site collections on a plain vanilla SharePoint
• I tried different SharePoint releases of the last 12 months

There is always a 403...

this is very strange

Answer 1

We ran into the same issue on a page with a managed metadata field which was loading ScriptForWebTaggingUI.js.

This script (along with several others) changes the __REQUESTDIGEST value on header of Sys.Net.WebRequestManager - for more details see: https://officespdev.uservoice.com/forums/224641-general/suggestions/7025290-bug-with-jsom-when-working-with-cross-site-collect

To resolve the issue we added the following code before our JSOM request:

if (Sys.Net.WebRequestManager._events != null && Sys.Net.WebRequestManager._events._list != null) 
{ 
    var invokingRequests = Sys.Net.WebRequestManager._events._list.invokingRequest; 
    while( invokingRequests != null && invokingRequests.length > 0) 
    { 
        Sys.Net.WebRequestManager.remove_invokingRequest(invokingRequests[0]); 
    } 
}

This fixed the FORBIDDEN 403 error and so far hasn't cause any new issues with the managed metadata field - it seems to re-add the necessary invokingRequests automatically whenever it needs them.

Answer 2

403- forbidden error is given by SharePoint only when we don't have enough permission to perform operation. But as you said that you tried with Farm Admin and also you mentioned that it is crashing only with Form. Only thing i can suggest is give a chance by crossdomain operation using SP.RequestExecutor. https://msdn.microsoft.com/en-us/library/office/jj164022.aspx

All the best.

Thanks

Azam

Answer 3

You are querying another domain, and cross-domain JavaScript calls are blocked for security reasons. You need to use SP.RequestExecutor.js to execute your query with the JavaScript cross-domain library as described on MSDN:

// Load the js files and continue to the successHandler
$.getScript(scriptbase + "SP.RequestExecutor.js", execCrossDomainRequest);



// Function to prepare and issue the request to get
//  SharePoint data
function execCrossDomainRequest() {
    // executor: The RequestExecutor object
    // Initialize the RequestExecutor with the add-in web URL.
    var executor = new SP.RequestExecutor(appweburl);

    // Issue the call against the add-in web.
    // To get the title using REST we can hit the endpoint:
    //      appweburl/_api/web/lists/getbytitle('listname')/items
    // The response formats the data in the JSON format.
    // The functions successHandler and errorHandler attend the
    //      sucess and error events respectively.
    executor.executeAsync(
        {
          url:
              appweburl +
              "/_api/web/lists/getbytitle('Announcements')/items",
          method: "GET",
          headers: { "Accept": "application/json; odata=verbose" },
          success: successHandler,
          error: errorHandler
        }
    );
  }

https://msdn.microsoft.com/en-us/library/office/fp179927.aspx?f=255&MSPPError=-2147217396

Answer 4

So... I finally found out: It is simply a SharePoint Bug with Managed Metadata fields. If you remove these, it's working fine:

You can't start REST- or CSOM calls with write operations to a list on an other Site Collaction within an edit form containing Managed Metadata / taxonomy fields.

Very weired...