Microsoft Office pre-fetches hyperlinks using an internal DLL Show archive.org snapshot (which doesn't know about your cookies), follows all redirects and opens your browser with the result. This is because of stupidity.

Rails Long Term Support

Rails LTS provides security patches for old versions of Ruby on Rails (2.3, 3.2, 4.2 and 5.2)

• Prevents you from data breaches and liability risks
• Upgrade at your own pace
• Works with modern Rubies

Read more Show archive.org snapshot

The "fix" is to not redirect but just render a text like "access denied" with 200 OK when you see that request.env['HTTP_USER_AGENT'].include?('ms-office').