Microsoft Office pre-fetches hyperlinks using an internal DLL Show archive.org snapshot (which doesn't know about your cookies), follows all redirects and opens your browser with the result. This is because of stupidity.

Growing Rails Applications in Practice

Check out our e-book. Learn to structure large Ruby on Rails codebases with the tools you already know and love.

• Introduce design conventions for controllers and user-facing models
• Create a system for growth
• Build applications to last

Read more Show archive.org snapshot

The "fix" is to not redirect but just render a text like "access denied" with 200 OK when you see that request.env['HTTP_USER_AGENT'].include?('ms-office').