One would expect that opening hyperlinks from within a Word/Excel document would launch the default browser with the desired URL. Oddly enough, this is not the case – leading to undesirable side effects and making links to session- or cookie-based login-protected pages impossible in these Office programs.
The culprit is the module named “User Agent: Microsoft Office Existence Discovery” by Microsoft, which preloads the link in the background and tracks any redirects. The problem can be reproduced as follows: First, create two files called "loggedin.php" (page when logged in) and "login.php" (page for login):
5bcff34c5cecc130a0ee
5bcff34c5cecc130a0ee
After calling "loggedin.php" directly, you get directly to "login.php" in the original state, where the cookie "logged_in" is immediately set. After calling “loggedin.php” again you get the message “you are logged in”. If you link to "loggedin.php" within Word or Excel (from version 2007), you will always go directly to "login.php", regardless of whether you have already logged in before or not.
The Office programs start an Internet Explorer component in the background to check whether the URL exists. Any redirects are also tracked to the end and the last URL without a redirect (in our case “login.php”) is returned and accessed with the standard browser. A possible solution is to intercept and block the background call on the first page:
5bcff34c5cecc130a0ee