Why are cookies unrecognized when a link is clicked from an external source (i.e. Excel, Word, etc…)

by

This is because MS Office is using Hlink.dll component to lookup if the link is Office document or something else. MS Office expect to open the document linked within documents without the aid of external browser (using Hlink.dll component of IE6).

If session cookie protects website Hlink naturally is being redirected to login page and having reached HTML page and not able to “understand” it opens it in external browser. Note that it opens not original URL (expected behavior) but the result of redirect, even if it was 302 redirect.

Microsoft has that bug in unsupported component (Hlink.dll), instead of recognizing the bug they turn it over to our head (trying to convince us that it is flaw of SSO system we use, i.e. session cookies) and refuses to upgrade it. It offers workaround that turns off the lookup functionality of MS Office:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
  Office\9.0\Common\Internet\ForceShellExecute:DWORD=1

Or offer us to workaround serverside, to avoid HTTP redirects and change into Javascript redirects or META REFRESH redirects (i.e. to have Hlink get text/html page on original URL and make it run external browser to handle it).

More Related Contents:

  1. Set cookies for cross origin requests
  2. Token Authentication vs. Cookies
  3. How does cookie based authentication work?
  4. OWIN – Authentication.SignOut() doesn’t seem to remove the cookie
  5. Sending cookie session id with Swagger 3.0
  6. How to use Python to login to a webpage and retrieve cookies for later usage?
  7. What’s the difference between OpenID and OAuth?
  8. Where to store JWT in browser? How to protect against CSRF?
  9. Cross domain cookies
  10. PHP login system: Remember Me (persistent cookie) [duplicate]
  11. Single Sign On across multiple domains [closed]
  12. Asp.Net Forms Authentication when using iPhone UIWebView
  13. Handling Browser Authentication using Selenium
  14. Why is there an “Authorization Code” flow in OAuth2 when “Implicit” flow works so well?
  15. how to implement login auth in node.js
  16. What is the purpose of a “Refresh Token”?
  17. LDAP: error code 49 – 80090308: LdapErr: DSID-0C0903A9, comment: AcceptSecurityContext error, data 52e, v1db1
  18. Kafka SASL zookeeper authentication
  19. What are the main differences between JWT and OAuth authentication?
  20. Keycloak retrieve custom attributes to KeycloakPrincipal
  21. Is Facebook an OpenID provider?
  22. What is the Authorized Javascript Origin for a webapp powered by Google Script?
  23. asp.net cookies, authentication and session timeouts
  24. REST API Token-based Authentication
  25. Microservice Authentication strategy
  26. Spring security: adding “On successful login event listener”
  27. Single sign-on flow using JWT for cross domain authentication
  28. Web authentication state – Session vs Cookie?
  29. Multiple IdentityServer Federation : Error Unable to unprotect the message.State
  30. How can I use persisted cookies from a file using phantomjs

Leave a Comment