Is there a way around running a custom script before all scripts on any web page in SharePoint Online Development?

Question

Hi,

Is there a way around running a custom script before all scripts on any web page in SharePoint Online Development?

I know how to create extension component and web parts with SharePoint Framework (SPFx), but I found its scripts is loaded by the framework and is executed too late.

So I want to find a way to load my script for any page, including classic and modern pages, in order to take over the data (what data are allowed to be fetched). Besides, my script doens't depend on SharePoint Online objects, and replace the service worker (progressive web apps - Can I have multiple service workers both intercept the same fetch request? - Stack Overflow).

After referring to Key features of the SharePoint Framework

Important The SharePoint page HTML DOM is not an API. You should avoid taking any dependencies on the page DOM structure or CSS styles, which are subject to change and potentially break your solutions. SharePoint Framework provides a rich API to customize the SharePoint experience in reliable ways and is the only supported means to interact with the SharePoint page HTML DOM.

I found that it is best to do the client-side control by the public REST interfaces used by PnP JS (a safe API for interacting with SharePoint REST APIs and Microsoft Graph APIs) because I think SPFx is mainly applicable for UI function (beautification) after data reach the client browser.

Thanks!

Answer 1

Hi @kekkou,

Hope all is well.

After a further search and testing, there is no way for us to run our custom scripts before all the scripts on the SharePoint page.

SharePoint REST API or Microsoft Graph API are used to manage resources in SharePoint Online, such as lists or document libraries. Before we can use these APIs, we have to make the script file a resource by saving it to our site. So before running custom scripts, we had to run SharePoint related scripts to initialize the site and get the script file.

Using the Rest API to run a custom script as an example, we need to specify where to save the script file.

In addition, to protect your property, SharePoint does not provide us with a proper interface to run custom scripts before we run all SharePoint scripts. This can easily lead to script injection hazards.

SharePoint cannot recognize what scripts are inserted, where they are inserted and who inserted them. If a dangerous or malicious script is inserted, the only way you can stop it is to delete the page hosting it. This can lead to data loss.

Since PnP JS is beyond the scope of our support, we don't have any more relevant resources to determine if PnP JS will solve your problem. Currently, it would be advisable to post a new question in this PnP JS community.

Note: Non-official， just for reference.

Please kindly notice that I am always on standby to support you. Please feel free to let me know if you have any concerns.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. It will be beneficial to more community members reading here.