Microsoft Office pre-fetches hyperlinks using an internal DLL Show archive.org snapshot (which doesn't know about your cookies), follows all redirects and opens your browser with the result. This is because of stupidity.

Do you need DevOps-experts?

Your development team has a full backlog? No time for infrastructure architecture? Our DevOps team is ready to support you!

• We build reliable cloud solutions with Infrastructure as code
• We are experts in security, Linux and databases
• We support your dev team to perform

Read more Show archive.org snapshot

The "fix" is to not redirect but just render a text like "access denied" with 200 OK when you see that request.env['HTTP_USER_AGENT'].include?('ms-office').