JSOM calls forbidden in apps in anonymous mode on the first load of the page (a reload solves it)

Question

I have an app part on a page on a publishing site. In that app, the JSOM calls work well when the user is authenticated. In anonymous mode, it will work only after a reload of the page containing the app part. During the first loading, I will get this error:

Failed to load resource: the server responded with a status of 403 (FORBIDDEN) http://app-4e3210d8daa297.abc.com/MyList/_vti_bin/client.svc/ProcessQuery

The error handlers for the JSOM calls return an "undefined" error message.

But if I reload the page, or the app-part itself (with a javascript code), then it works.

Why the JSOM calls are forbidden only for the first loading of the page? How do I solve this?

have you tried waiting with the script or trying it multiple times? When does your script start? — Nils, May 20 '16 at 11:09
The script waits for some sharepoint javascript files and the dom to be loaded. To solve this problem, I catch the error in the error handler of the jsom calls and then reload the app by changing the url of the iframe containing it (I add &reload=true to avoid a loop). This feels like quick and dirty fix though. — Cyril, May 23 '16 at 10:19
Be aware, that when using console.log in your code, this works in IE only, when developer console is open, otherwise it cancels the code. — Nils, May 23 '16 at 10:26
I would recommend you to use ExecuteOrDelayUntilScriptLoaded() — Nils, May 23 '16 at 10:31

Cyril · Answer 1 · 2016-05-23T10:40:00.903

This is a quick fix to solve temporarily this problem, but I am sure there is a better way.

    //error handler of the jsom call that fails
    function onErrorLoadList(data, error, errorMessage) {
        console.log("Could not complete cross-domain call: " + errorMessage);
        // in anonymous mode, for the first load of the app
        // the JSOM calls fail and errorMessage is undefined
        if (typeof errorMessage == 'undefined') {
            // we will reload the app by adding reload=true in the url
            // if it fails again, we won't do it to avoid a loop
            if (!location.href.match(/reload=true/)) {
                console.log("The app reloads.");
                location.href = location.href + "&amp;reload=true";
            }
        }
    }

JSOM calls forbidden in apps in anonymous mode on the first load of the page (a reload solves it)

1 Answers1