Access denied 403, when I use new Web() from "@pnp/sp"

[ahamedfazil]

Hi, Recently I came across a requirement, where I need to access multiple sites (site collection) from react app. I am using below code and it works fine after deploying into SharePoint. let web = new Web("https://fazildev.sharepoint.com/sites/sppals/spfx"); const userID = await web.currentUser.get().then(u => { return u.Id; }); console.log("TCL: getFollowedSiteUri -> userID", userID);

But during dev, I use sp-rest-proxy and I am getting below error,

Is it possible to make this work through sp-rest-proxy or any workaround?

Thank you in advance

[koltyakov]

Hi @ahamedfazil,

Getting current user via /_api/web/currentuser endpoint works through the proxy.

Can it be you're using Add-In Only Permissions or the account used for authentication actually has no permissions to the web?

[ahamedfazil]

Hi @koltyakov Thank you for your prompt response. Actually I don't have issue in accessing currentuser. But when I access it from differ Web, then it throws 403. I do have access to the Web, because the same code works when it run from sharepoint page.

And I am using SAML authentication strategy

[koltyakov]

Oh, I got you. When you use new Web ('[REAL_ABS_URL]') the request actually goes not through the proxy but directly to the web and ends up obviously not authorized.

You should use new Web ('[PROXY_HOST_ABS_URL]') (e.g. new Web ('http://localhost:8080/sites/sppals/spfx')).

In the code, there should be a branch logic which builds proxy's URL (when locally hosted) or SP URL based on hostname for example. You can use loadPageContext helper for this purpose.

[ahamedfazil]

great, it works. Thank you @koltyakov

I have bunch of site collection URL's in a variable, I think in this case loadPageContext may not be useful. Right now, I am using localhost:8080 for local development and replace localhost using string-replace-loader when I deploy to SP.