title: SharePoint REST Query returns 403 forbidden error
body: <p>I'm trying to upload a file to the SharePoint directory using the REST API and the JQuery.
  Reference: <a href="https://docs.microsoft.com/en-us/sharepoint/dev/sp-add-ins/upload-a-file-by-using-the-rest-api-and-jquery" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/sharepoint/dev/sp-add-ins/upload-a-file-by-using-the-rest-api-and-jquery</a></p>
  <p>I'm trying to run the below code from the chrome browser console.</p>
  <pre><code>var CreateNewList = function() {
      var fileName = &quot;test1.txt&quot;;
      var reader = new FileReader();
      var arrayBuffer = reader.result;
      var serverUrl = &quot;https://{site}.sharepoint.com/&quot;;
      var serverRelativeUrlToFolder = 'SampleDocuments/Folder1';
      // Construct the endpoint.
      var fileCollectionEndpoint = String.format(
              &quot;{0}/_api/web/getfolderbyserverrelativeurl('{1}')/files&quot; +
              &quot;/add(overwrite=true, url='{2}')&quot;,
              serverUrl, serverRelativeUrlToFolder, fileName); 
  
      return jQuery.ajax({
          url: fileCollectionEndpoint,
          type: &quot;POST&quot;,
          data: arrayBuffer,
          processData: false,
          headers: {
            &quot;accept&quot;: &quot;application/json;odata=verbose&quot;,
            &quot;X-RequestDigest&quot;: jQuery(&quot;#__REQUESTDIGEST&quot;).val()
          }
      });
   };
  
  String.format = function() {
              var s = arguments[0];
              for (var i = 0; i &lt; arguments.length - 1; i += 1) {
                  var reg = new RegExp('\\{' + i + '\\}', 'gm');
                  s = s.replace(reg, arguments[i + 1]);
              }
              return s;
          };
  </code></pre>
  <p>The above code works fine when I run this on the SharePoint page. But the same code doesn't work when I tried from a different Web page which means the code works fine on the same domain but not on the different domain.</p>
  <p>So, tried the other example (example 1 from the above-mentioned URL) which is to upload files across the domain.</p>
  <pre><code>function addFileToFolder() {
        var fileName = &quot;test1.txt&quot;;
        var reader = new FileReader();
        var arrayBuffer = reader.result;
        var serverRelativeUrlToFolder = 'SampleDocuments/Folder1';
  
        var appWebUrl = &quot;https://{site}.sharepoint.com&quot;;
        var hostWebUrl = &quot;https://{site}.sharepoint.com&quot;;
  
        var fileCollectionEndpoint = String.format(
           &quot;{0}/_api/sp.appcontextsite(@target)/web/getfolderbyserverrelativeurl('{1}')/files&quot; +
           &quot;/add(overwrite=true, url='{2}')?@target='{3}'&quot;,
           appWebUrl, serverRelativeUrlToFolder, fileName, hostWebUrl);
  
        return jQuery.ajax({
           url: fileCollectionEndpoint,
           type: &quot;POST&quot;,
           data: arrayBuffer,
           processData: false,
           headers: {
                  &quot;accept&quot;: &quot;application/json;odata=verbose&quot;,
                  &quot;X-RequestDigest&quot;: jQuery(&quot;#__REQUESTDIGEST&quot;).val()
           }
        });
   }
  </code></pre>
  <p>This code doesn't work in any domain (failed in both SharePoint page and other pages) and returns 403 Forbidden error:</p>
  <pre><code>error:
  code: &quot;-2147024891, System.UnauthorizedAccessException&quot;
  message:
  lang: &quot;en-US&quot;
  value: &quot;Access denied. You do not have permission to perform this action or access this resource.&quot;
  </code></pre>
  <p>I tried to get <strong>appWebUrl</strong> and <strong>hostWebUrl</strong>  from the below methods, but the returned value is undefined, so just hardcoded these values in the code.</p>
  <pre><code>  // Get the add-in web and host web URLs.
    appWebUrl = decodeURIComponent(getQueryStringParameter(&quot;SPAppWebUrl&quot;));
    hostWebUrl = decodeURIComponent(getQueryStringParameter(&quot;SPHostUrl&quot;));
  
    function getQueryStringParameter(paramToRetrieve) {
       var params =
       document.URL.split(&quot;?&quot;)[1].split(&quot;&amp;&quot;);
       var strParams = &quot;&quot;;
       for (var i = 0; i &lt; params.length; i = i + 1) {
          var singleParam = params[i].split(&quot;=&quot;);
          if (singleParam[0] == paramToRetrieve)
             return singleParam[1];
       }
    }
  </code></pre>
  <p>Can anyone help me to resolve this issue?</p>