title: How to get request digest value from provider hosted app?
body: <p>I am developing SharePoint 2013 Provider hosted app using javascript REST Api.  In order to perform create (POST), or update (MERGE) operations on sharepoint items I need to set the 'X-RequestDigest' header with the request.</p>
  
  <p>When in SharePoint-hosted apps I was able to use the <a href="http://contoso.sharepoint.com/SharePointHostedApp/_api/contextinfo" rel="noreferrer">http://contoso.sharepoint.com/SharePointHostedApp/_api/contextinfo</a> service to retrieve the request digest value; however, I am having trouble getting that value when in a provider hosted app.</p>
  
  <p>The first difference of provider hosted app is that now we need to make a cross-domain request since we are not running in a sharepoint site, but in a different domain hosted on a different server.  To be clear: instead of </p>
  
  <pre><code>$.ajax({
      url: appWebUrl + '/_api/contextinfo',
      method: "POST",
      headers: { "Accept": "application/json; odata=verbose" }
  })
  </code></pre>
  
  <p>I assumed we need to use the <code>SP.RequestExecutor</code> to execute a cross domain request. 
  When I construct the request it looks like the following (I've changed the actual urls to something fake, but basically we're telling the proxy to use the host web has the target and get the <code>/_api/contextinfo</code> endpoint):</p>
  
  <p><code>https://contoso-6f921c6addc19f.sharepoint.com/ProviderHostedApp/_api/SP.AppContextSite(@target)/contextinfo?@target=%27https://contoso.sharepoint.com%27</code></p>
  
  <p>However, I receive this error: <code>Cannot find resource for the request contextinfo.</code> meaning that the endpoint does not exist.</p>
  
  <p>I made sure to use the POST method with the correct <code>application/json;odata=verbose</code> headers with an empty body.</p>
  
  <p><strong>How do I get the request digest value from the <code>/_api/contextinfo</code> service to the provider hosted app?</strong></p>
  
  <p>Based on what I've researched:</p>
  
  <ul>
  <li>We can't use <code>$('#__REQUESTDIGEST').val()</code>; because that is not available to a provider hosted app. </li>
  <li>We need to use some from of cross-domain request since I'm running outside of sharepoint.</li>
  <li>I have tried setting the target of the cross-domain request to both the hostWebUrl and the appWebUrl and both give the same error.</li>
  </ul>
  
  <p>There must be some way to get this value, otherwise we would only be limited to read operations when using JavaScript. <strong>Has anyone else solved this using javascript?</strong></p>
  
  <p>Technically I could try to implement the needed services using the CSOM on server and exposing them using WebAPI or WCF but it seem unreasonable to have to implement that.</p>
  
  <p><strong>UPDATE:</strong></p>
  
  <p>I went ahead and tried adding a WebAPI controller which exposes a service that retrieves the request digest value. This actually does retrieve a request digest value; however, when attempting to use this in the header of future calls I receive the error: <code>"The security validation for this page is invalid and might be corrupted. Please use your web browser's Back button to try your operation again."</code>  I'm guessing that the request digest value has some referer header information in it which indicates it was requested by the server; however, the future requests made with it are from the browser, and this mismatch might be an acceptable reason for it be invalid.</p>
  
  <p>Few more notes on the attempt at adding the webAPI controller.
  I based my code off of this example: <a href="http://code.msdn.microsoft.com/SharePoint-2013-Perform-335d925b" rel="noreferrer">http://code.msdn.microsoft.com/SharePoint-2013-Perform-335d925b</a> but converted it to use the newer HttpClient.
  I overloaded the Page_Load method, stored the contextTokenString in a variable that could be accessed by the WebAPI controller then parsed/used it when requesting the contextinfo.  </p>
  
  <p>Does anyone know if this is a correct diagnosis of that error?  Is there something encoded in the request digest value that would prevent it from be able to be retrieved like I suggested?</p>
  
  <p>I have also opened a related question on the MSDN forums since I'm desperate to find an answer: 
  <a href="http://social.msdn.microsoft.com/Forums/sharepoint/en-US/f601fddd-3747-4152-b2d1-4e89f0a771c4/question-about-limitation-of-providerhosted-apps-is-it-possible-to-make-rest-calls-with-javascript?forum=sharepointdevelopmentprevious" rel="noreferrer">http://social.msdn.microsoft.com/Forums/sharepoint/en-US/f601fddd-3747-4152-b2d1-4e89f0a771c4/question-about-limitation-of-providerhosted-apps-is-it-possible-to-make-rest-calls-with-javascript?forum=sharepointdevelopmentprevious</a></p>
  
  <p>I find it very hard to believe this could be a limitation of provider hosted applications, but given all testing I've done, I'm starting to doubt the viability of provider-hosted applications when you want to write in javascript.</p>
  
  <p><strong>Begging for Help!</strong></p>