Best IT Recipes

Why cookies are not recognized when clicking a link from an external source (e.g. Excel, Word, etc.)

I noticed that when a link is called externally from a web browser, for example from Excel or Word, my session file is initially unrecognized, even if the link opens in a new tab in the same browser window.

The browser eventually finds out about its cookie, but I am puzzled by why this start link from Excel or Word does not work. To make it even more complex, clicking the link works fine in Outlook.

Does anyone know why this might happen? I am using Zend Framework with PHP 5.3.

+60
authentication cookies internet-explorer-6 ms-office
Apr 16 2018-10-16T00:
source share
19 answers

This is due to the fact that MS Office uses the Hlink.dll component to search if the link is an Office document or something else. MS Office plans to open a document linked inside documents without using an external browser (using the Hlink.dll IE6 component).

If the cookie cookie protects the website, Hlink naturally redirects to the login page, and, having reached the HTML page and is unable to "understand", it opens in an external browser. Please note that it does not open the original URL (expected behavior), but the result of the redirect, even if it was redirected to 302.

Microsoft has this error in an unsupported component (Hlink.dll), instead of recognizing the error, turn it on its head (trying to convince us that this is a flaw in the SSO system that we use, i.e. session cookies) and refuses update it. It offers a workaround that disables the search functionality in MS Office:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Office\9.0\Common\Internet\ForceShellExecute:DWORD=1

Or offer us some workarounds to avoid HTTP redirection and changes in Javascript redirects or META REFRESH redirects (i.e. to get Hlink to get the text / html page at the source URL and force it to start an external browser to process it).

+77
Apr 29 '10 at 11:21
source share

We had the same problem, and we wrote an open source stone to help those using rails: https://github.com/spilliton/fix_microsoft_links

You can use the same approach that we used in any environment:

  • Detect if user agent from Microsoft product
  • Retrieve a blank html page with a meta refresh tag that will force the browser to refresh the page with the correct cookies.

Sample code here: https://github.com/spilliton/fix_microsoft_links/blob/master/lib/fix_microsoft_links.rb

+17
May 08 '12 at 19:28
source share

On the server side, this worked for me in IIS (using the rewrite rule)

 <rule name="WordBypass" enabled="true" stopProcessing="true"> <match url=".*" /> <conditions> <add input="{HTTP_USER_AGENT}" pattern="Word|Excel|PowerPoint|ms-office" /> </conditions> <action type="CustomResponse" statusCode="200" statusReason="Refresh" statusDescription="Refresh" /> </rule>
+12
May 05 '16 at 15:34
source share

Here is a solution for C # ASP.NET based on spilliton answer above. In Global.asax.cs add the following:

  private static string MSUserAgentsRegex = @"[^\w](Word|Excel|PowerPoint|ms-office)([^\w]|\z)"; protected void Application_OnPostAuthenticateRequest(object sender, EventArgs e) { if (System.Text.RegularExpressions.Regex.IsMatch(Request.UserAgent, MSUserAgentsRegex)) { Response.Write("<html><head><meta http-equiv='refresh' content='0'/></head><body></body></html>"); Response.End(); } }
+6
Jul 24 '15 at 19:35
source share

Fixed for VB.NET:

 Dim userAgent As String = System.Web.HttpContext.Current.Request.UserAgent If userAgent.Contains("Word") Or userAgent.Contains("Excel") Or userAgent.Contains("PowerPoint") Or userAgent.Contains("ms-office") Then System.Web.HttpContext.Current.Response.Clear() System.Web.HttpContext.Current.Response.Write("<html><head><meta http-equiv='refresh' content='0'/></head><body></body></html>") System.Web.HttpContext.Current.Response.End() End If

This basically forces the browser to refresh the page, so the request comes with the help of the browser user agent and all the correct cookies.

+5
Feb 20 '14 at 10:59
source share

PHP solution:

This prevents recognition of redirection by the MS product. Therefore, MS launches the browser from the necessary links.

 if (isset($_SERVER['HTTP_USER_AGENT'])) { $http_user_agent = $_SERVER['HTTP_USER_AGENT']; if (preg_match('/Word|Excel|PowerPoint|ms-office/i', $http_user_agent)) { // Prevent MS office products detecting the upcoming re-direct .. forces them to launch the browser to this link die(); } }

.. redirect after this code

+5
Jul 29 '15 at 8:56
source share

1. From the excel / word expression in http://example.com/from_excel.php

2.In "from_excel.php" redirect to the page where you are using the session

 <script>document.location.href = "http://example.com/page_with_session.php"; </script>
+2
Jan 31 '14 at 10:56
source share

We see a problem in that when you click the URL in MS Word, two Chrome tabs open and JavaScript is redirected to the page that opens: window.location.href=blabla

By debugging from the server side, we confirmed that in addition to the Chrome application, requests are sent from the Office application. This is so strange.

But in any case, by checking the header of the User-Agent request and returning a blank page to Office applications, our problem with two tabs has been resolved. This is definitely right!

+2
Oct 29 '18 at 15:21
source share

Here is my solution for this in WordPress. Add this to functions.php in your theme or another plugin file.

This can be useful if your system, such as WP, sends registered users to the login page with a redirect to the page they were trying to access. Word sent users to this page, but then WP did not correctly handle the case when the user was already logged in. This code checks if there is a current user and the redirect_to parameter is passed. If so, it is redirected to the redirect_to location.

 function my_logged_in_redirect_to() { global $current_user; if($current_user->ID && $_REQUEST['redirect_to']) { wp_redirect($_REQUEST['redirect_to']); exit; } } add_action('wp', 'my_logged_in_redirect_to');
+1
May 28 '11 at 15:49
source share

Here's the VBA fix for Excel. The same concept can be applied to Microsoft Word. Basically, instead of disabling the link from Excel, the code executes the link from within the shell. Here is the code:

 Private Sub Worksheet_FollowHyperlink(ByVal objLink As Hyperlink) Application.EnableEvents = False Dim strAddress As String strAddress = "explorer " & objLink.TextToDisplay Dim dblReturn As Double dblReturn = Shell(strAddress) Application.EnableEvents = True End Sub
  • For an Excel worksheet that contains links, right-click the worksheet tab and click View Code . The VBA editor will appear.
  • Paste the code into the window and close the editor.
  • Change each link on the page to just point to the cell in which it is located. For this:
  • Right-click the link and click Edit Hyperlink . The "Edit Hyperlink" window will appear.
  • Click Place in this document .
  • Click the sheet name.
  • For Enter a cell link , enter a cell link (for example, A4).
  • Click OK .

A few notes:

  • You will need to save the table as a table with macro support (.xlsm). When users open a spreadsheet, they will be prompted to enable macros. If they say no, the links will not work.
  • These instructions are based on Excel 2010. Presumably, later versions are similar.
+1
Jan 24 '17 at 21:22
source share

I can’t believe that they call it a function. However, here is the fix for Apache:

 RewriteEngine On # Send a 200 to MS Office so it just hands over control to the browser # It does not use existing session cookies and would be redirected to the login page otherwise # https://www.wimpyprogrammer.com/microsoft-office-link-pre-fetching-and-single-sign-on/ RewriteCond %{HTTP_USER_AGENT} ;\sms-office(\)|;) RewriteRule .* - [R=200,L]

There may not be the best performance, since the whole page is sent instead of a blank answer, but I did not want to add other Apache modules only to fix such an idiotic function ^ H ^ H ^ H ^ H.

+1
Jun 08 '18 at 7:53
source share

Here is an example patch using the dotnet kernel middleware:

 public class MicrosoftOfficeLinksHandlingMiddleware { private static readonly Regex MsUserAgentsRegex = new Regex(@"[^\w](Word|Excel|PowerPoint|ms-office)([^\w]|\z)"); private readonly RequestDelegate _next; public MicrosoftOfficeLinksHandlingMiddleware(RequestDelegate next) { _next = next; } public async Task Invoke(HttpContext context) { string userAgent = context.Request.Headers["User-Agent"].FirstOrDefault(); if (userAgent != null && MsUserAgentsRegex.IsMatch(userAgent)) { // just return an empty response to the office agent return; } await _next(context); } }
+1
Apr 11 '19 at 11:45
source share

I had to solve this problem for an ASP.NET site, but I only wanted to use javascript / jQuery:

 var isCoBrowse = ('<%= Session["user"].ToString().ToLower() %>' != '0'); if (isCoBrowse && window.location.href.indexOf('ReturnUrl=') >= 0 && window.location.href.indexOf('dllCheq') == -1) { //redirect to the ReturnUrl & add dllCheq to the URI var toRedirect = decodeURIComponent(gup('ReturnUrl', window.location.href)) + '&dllCheq'; window.location = toRedirect; }

I got the gup function: How to get the value from the URL parameter?

0
Oct 28 '15 at 13:32
source share

Use the hotfix provided by the Microsoft® link below. https://support.microsoft.com/en-us/kb/218153

0
Nov 03 '15 at 8:33
source share

Here's how to get around this with Java and Spring through a filter:

 /** * To see why this is necessary, check out this page: * https://support.microsoft.com/en-gb/help/899927. */ public class MicrosoftFilter extends OncePerRequestFilter { @Override protected void doFilterInternal(final HttpServletRequest request, final HttpServletResponse response, final FilterChain filterChain) throws ServletException, IOException { //Serve up a blank page to anything with a Microsoft Office user agent, forcing it to open the //URL in a browser instead of trying to pre-fetch it, getting redirected to SSO, and losing //the path of the original link. if (!request.getHeader("User-Agent").contains("ms-office")) { filterChain.doFilter(request, response); } } } /** * Security configuration. */ @Configuration public class SecurityConfiguration { @Bean public FilterRegistrationBean microsoftFilterRegistrationBean() { FilterRegistrationBean<MicrosoftFilter> registrationBean = new FilterRegistrationBean<>(); registrationBean.setFilter(new MicrosoftFilter()); registrationBean.setOrder(Ordered.HIGHEST_PRECEDENCE); return registrationBean; } }
0
Aug 24 '18 at 7:06
source share

I found a fix for Office 2013 and later. You can install the following fix: https://support.microsoft.com/en-us/help/218153/error-message-when-clicking-hyperlink-in-office-cannot-locate-the-inte

This solution worked for me.

0
Apr 04 '19 at 15:47
source share

Computers never suck.they don't do how supost they are to do.they are good just for watching porn play games that will rot the brain But still we still get fucked until we go crazy

0
Apr 05 '19 at 23:41
source share

NGINX solution below:

 if ($http_user_agent ~* Word|Excel|PowerPoint|ms-office) { return 200 '<html><head><meta http-equiv="refresh" content="0"/></head><body></body></html>'; }

You can put it in a server or location block. It works like a charm.

0
Oct 02 '19 at 0:47
source share

I suspect this is a question of how you set cookies.

Due to the nature of the creation of the website, example.com is not regarded as the same domain as www.example.com ; therefore: you can log in to www.example.com and not log in to example.com .

In other words, check the URL in your word or excel file - is this the same domain that you entered into your browser?

There are two fixes / solutions to this cookie inconsistency: 1. redirect anyone trying to load your site without www. to the same page from www. (or vice versa), or 2. When you set a cookie, be sure to specify the domain argument as ".example.com". A leading dot indicates that the cookie must be valid for all subdomains of this domain.

I suspect the reason the browser will eventually acknowledge that this is because you are likely to end up with a URL with the same domain structure as you are logged in to.

Hope this helps.

-2
Apr 18 '10 at 14:35
source share


More articles:


All Articles