Problems reading from a list on a public site with anonymous access

Aug 6, 2013 at 11:21 AM

I'm trying to use SPServices to read from a list, store the data in some arrays and call the data back onto a page when it's needed. This works in the back-end version of our site (where our authors edit their pages and then they must be approved by admins before they're published and made live), but when published out this error shows on the page:
Access denied. You do not have permission to perform this action or access this resource.
I'm calling the script through a Content Editor Web Part via a text file. Anonymous access is enabled on the text file as well as the lists that the script is referencing. Does anyone have any idea as to what might be causing this and how to get around it?

Thanks in advance,

Aug 6, 2013 at 12:19 PM

The key is probably where that message shows up. Is it in the results of the GetListItems call? In the page when it loads? etc. You need to identify what object has the permission problem.

Aug 6, 2013 at 3:22 PM
Edited Aug 6, 2013 at 3:23 PM
Thanks for the prompt reply Marc, and congratulations on SPServices by the way, it's a fantastic tool.

I've managed to get it half working, the access denied error has disappeared since I inherited permissions on the folder where the script sits, but SPServices doesn't seem to be talking to the lists and where the data should display on the page it just says 'undefined'. The lists have anonymous access enabled so I'm struggling to work out what's stopping it from getting the data.

If you want to have a look you can see the page here and the script here (I'm no expert so you'll probably cringe when you see it!)


Aug 6, 2013 at 3:53 PM
Boy are you working hard. Way too hard. You don't need all of those arrays. The pin that I click is what determines what data it is and what list, etc. In other words, you only need one instance, not one per location. Think about the work you'd need to do if you add a new location. If you write it correctly, then adding a new location means zero code editing.

All that said, when I click on a pin, there are exactly zero calls to the Web Services happening. I haven't tried to trace things, but basically, the call to GetListItems doesn't even happen. I can see this by looking at the Net tab in Firebug.

Sep 5, 2013 at 7:46 PM
Ash, I am trying to solve the same problem. When I saw the "Access Denied" error I also noticed that ( inspite of referencing jQuery 1.8 in my masterpage) the error was coming from jQuery 1.4 When I added a reference to the newer jQuery and SP Services libs on my page, the error went away.

Now while no errors are thrown, I am still not getting anything returned.
Sep 9, 2013 at 9:28 AM
Hi DCoutts. This was a project for work which is no longer going ahead, so I never got to the bottom of it unfortunately. Still, it'd be interesting to hear if you have any more developments. If I've ever got some spare time at work (which is looking pretty unlikely for the near future), then I might carry on looking into it as it's something we'll probably have a need for again in the future.

Also, thanks Marc for your help with this.
Sep 9, 2013 at 2:37 PM
Funnily enough, another piece of work came in this morning which SPServices is perfect for, so I decided to do some more testing. After all that faffing around, it turned out to be that I hadn't published SPServices in the document library. Doh!
Sep 9, 2013 at 2:55 PM
Doh! indeed!

So you no longer have the problem, Ash?

Sep 9, 2013 at 3:10 PM
No, it seems to be working perfectly now, thanks. I am going to look at streamlining that code when I've got time though.
Sep 9, 2013 at 3:16 PM
Excellent, Ash.

DCoutts, what about you?

Sep 9, 2013 at 6:45 PM
Marc, Ash,

Thanks for you questions/comments.

I solved my immediate problem by using a Swiss Army Knife (aka DFWP) but I would have much preferred to us SP Services...and I'd like to see if I can use on future similar problems.

I''ve used the GetListItems method on other sites and reused that code here. However this is the 1st time I tried using this method on a site with anonymous access. When I stepped through the execution using IE debug, it executed without error but returned nothing. I double checked that an anonymous user can browse to read the list items that I am trying to retrieve. I even tried copying some sample code from this site (and changing the list name only) but still no luck.

After receiving your emails, I went back to verify the basic set up. I was able to verify that $().SPServices.Version works fine on the site.

I would appreciate additional suggestions.

Sep 10, 2013 at 4:02 PM

You ought to be able to retrieve items for a list if anonymous access is enabled. When you say "returns nothing", do you mean that the results show ItemCount="0" or that there is an error coming back from the server?

Sep 15, 2013 at 1:08 AM

Before getting back to you I wanted to do a little more digging and testing.

I created a custom list on a site without anonymous access and created a page with some script to read the Title field from each item in the list.
This is my script:
<asp:Content ContentPlaceHolderId="PlaceHolderMain" runat="server">
    <script type="text/javascript" src="/SiteAssets/script/jquery-1.8.3.min.js"></script>
    <script type="text/javascript" src="/SiteAssets/script/jquery.SPServices-2013.01.min.js"></script>  

<script type="text/javascript"> 

    function readLookupItems(lookupList) { 
        var strListItems = [];
        var k = 0;
            operation: "GetListItems",
            async: false,
            listName: lookupList,
            completefunc: function (xData, Status){
                    strListItems[k] = $(this).attr("ows_Title");
                    k = k + 1;
        alert("items read: " + k);
        for (var i=0; i<k; i++){
    }//end readLookupItems

        // Read the query string parameters
        alert("SPServices Version: " + $().SPServices.Version());

No surprise here. There are multiple alerts:
  • the SP Services version
  • the correct number of list items
  • the Title field from each list item
Then I copied the list (as a template with content) and the page to another site in the same site collection. This site is configured with anonymous access. I verified that I could read the same list from a browser when I was not logged in. (I verified this from an iPad too.) However when my page loads, the alerts include only:
  • the SP Services version
  • zero list items returned
There are no other errors reported (on the F12 Console window)

SP Services is GREAT! Perhaps this is simply something to work on for future release. Of course, I would be happy to find out that I missed something obvious to others :-)

Sep 15, 2013 at 6:33 PM

You should get the same results if anonymous access is allowed, so I'm not sure what's going on. However, since you are setting k = 0 before the call, the SPServices call may well be getting an error which you would never see. (There would be no z:row elements in the error.)

You should look at the returned XML to see if the call is successful. You can add an alert into the completefunc - alert(xData.responseText); - or better, look at the Net traffic with Firebug or Fiddler.

Sep 20, 2013 at 12:03 AM
I used the equivalent Chrome dev tool to look a the Net traffic. With the code as is, Lists.asmx

Name: Lists.asmx _vti_bin
Type: (failed)
Type: Pending
Initiator: jquery-1.8.3.min.js:2 Script

This was the request header:

Request URL:https://_vti_bin/Lists.asmx
Request Headersview source
Access-Control-Request-Headers:accept, origin, content-type
User-Agent:Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/29.0.1547.76 Safari/537.36

Interesting that the access method is POST. I would have guessed GET for a read operation.

There was no response.

From the other details provided, it looks like jquery through an error part way through processing this request.

Any suggestions?

Sep 20, 2013 at 3:05 AM

I think this is the problem:
Request URL:https://_vti_bin/Lists.asmx

I'm guessing you are making the call in the root site of the Web App? Try adding the parameter:
        webURL: "/"
I have a bug in 2013.01 when the call is in the root site.