Authentication prompt while opening excel files

Last month we’ve received bug report from our customer. Web-application for this customer was created several years ago and there wasn’t any bug reported for a while. Problem was that after user logs in the app and tries to download generated excel file new credentials prompt is opened for him.

After a few calls with system administrator we have found out that new office (version 2010) had been installed for users in this company. With previous version there was no problem while downloading files. But now user is asked to insert his credentials before downloading.
I’ve tried it myself and there are interesting facts about this behaviour:

• problem only appears when browser used is ie 8, works fine with firefox and chrome (I haven’t tried it with other versions of ie as this is only browser used by our customer)
• ie downloads file before prompt is displayed
• excel makes request to server where file resides (I think this request invokes prompt) but it doesn’t download file itself
• file is opened even when user inputs wrong credentials

I’ve searched internet and some forums to find out that microsoft has changed security model in office 2010. It seems that there is a lot of systems which encountered this problem and Microsoft developers thinks this behaviour is ok.

Even if you use basic authentication the file isn’t opened at all. If you use for example NTLM (which was our case) than prompt is displayed.

Solution was relatively simple. I’ve changed content disposition header from inline to attachment and voila, everything works like a charm.

Posted in Uncategorized