none
word online file unlock bug (office online server 2016-05) RRS feed

  • Question

  • Hello.
    I'm implementing a WOPI host.
    It does not support COBALT (fsshttp, fsshttpb) so it sets "SupportsCobalt:false" for CheckFileInfo response.
    Currently, it just responds 200 OK to every lock and unlock requests.
    But while in tests, I found strange behavior of word online that seems to be a bug.
    Belows are results of three tests. I opened pptx, xlsx, docx files in edit mode and closed office online webapp right after.

    ----- pptx

    1. request lock
    {
    X-WOPI-Lock: {"F":4,"E":2,"L":"e4c2bba6790f408095b43bd8340e8826"}
    X-WOPI-Override: LOCK
    }

    2. rename lock
    {
    X-WOPI-OldLock: {"F":4,"E":2,"L":"e4c2bba6790f408095b43bd8340e8826"}
    X-WOPI-Lock: {"F":6,"E":2,"M":"e4c2bba6790f408095b43bd8340e8826","P":"2EE7D83D-84ED-48D6-8120-6C4D71FDF072","L":"e4c2bba6790f408095b43bd8340e8826"}
    X-WOPI-Override: LOCK
    }

    3. on close, request unlock
    {
    X-WOPI-Lock: {"F":6,"E":2,"M":"e4c2bba6790f408095b43bd8340e8826","P":"2EE7D83D-84ED-48D6-8120-6C4D71FDF072","L":"e4c2bba6790f408095b43bd8340e8826"}
    X-WOPI-Override: UNLOCK
    }

    ------ xlsx

    1. request lock
    {
    X-WOPI-Lock: {"F":4,"E":2,"C":"","L":"e4c2bba6790f408095b43bd8340e8826"}
    X-WOPI-Override: LOCK
    }

    2. rename lock
    {
    X-WOPI-OldLock: {"F":4,"E":2,"C":"","L":"e4c2bba6790f408095b43bd8340e8826"}
    X-WOPI-Lock: {"F":6,"E":2,"M":"e4c2bba6790f408095b43bd8340e8826","P":"35DCD4EF-F7F2-42FE-A758-3FFA27330695","L":"e4c2bba6790f408095b43bd8340e8826"}
    X-WOPI-Override: LOCK
    }

    3. on close, request unlock
    {
    X-WOPI-Lock: {"F":6,"E":2,"M":"e4c2bba6790f408095b43bd8340e8826","P":"35DCD4EF-F7F2-42FE-A758-3FFA27330695","L":"e4c2bba6790f408095b43bd8340e8826"}
    X-WOPI-Override: UNLOCK
    }

    ---------- docx

    1. request lock
    {
    X-WOPI-Lock: {"S":"da3613ea-b27b-42a6-adb4-4a6d89c4842e","F":4}
    X-WOPI-Override: LOCK
    }

    2. rename lock
    {
    X-WOPI-OldLock: {"S":"da3613ea-b27b-42a6-adb4-4a6d89c4842e","F":4}
    X-WOPI-Lock: {"S":"da3613ea-b27b-42a6-adb4-4a6d89c4842e","F":6,"E":2,"M":"e4c2bba6790f408095b43bd8340e8826","P":"BF334F9E-7899-4E39-9EA4-6EFF019F57DC"}
    X-WOPI-Override: LOCK
    }

    3. on close, request unlock
    {
    X-WOPI-Lock: {"S":"da3613ea-b27b-42a6-adb4-4a6d89c4842e"}
    X-WOPI-Override: UNLOCK
    }

    but there is no lock named {"S":"da3613ea-b27b-42a6-adb4-4a6d89c4842e"},
    it shoud be {"S":"da3613ea-b27b-42a6-adb4-4a6d89c4842e","F":6,"E":2,"M":"e4c2bba6790f408095b43bd8340e8826","P":"BF334F9E-7899-4E39-9EA4-6EFF019F57DC"}.
    because of this bug, when I use office online server with sharepoint 2013,
    and set "SupportsCobalt:false" somehow,
    word file modification is not adjusted because the file is forever locked.
    (after about 30 minutes, the file is automatically unlocked,
    but it seems sharepoint discards changes because of the transaction failure.)

    I think this is an obvious bug and I want to know when I can get the fixed version of office online server.
    Thursday, May 12, 2016 2:29 AM

Answers

  • Just an update to for the community:

    Question 1: I have filed a bug against the [MS-WOPI] specification, section 3.3.5.1.3 "Lock" to add the required X-WOPI-Lock header for the 409 response. The question of which documentation set to use: the readthedocs.io project is primarily aimed at WOPI host implementers integrating with the Office Online (cloud), however, it does contain equivalent WOPI wire protocol specifications. [MS-WOPI] on MSDN is purely the wire protocol for WOPI and references on-prem deployments of Office web applications but will be suitable (from the WOPI protocol perspective) to interact with Office Online in the cloud.

    Question 4: There is no safety issue here regarding the response containing the correct lock. Authorization and permissions are done via the access_token parameter sent with requests and also proof keys provide assurance of communication with Office Online.

    I am still looking into questions 2 and 3.

    Thanks,

    Tom

    Wednesday, June 1, 2016 5:20 PM
    Moderator

All replies

  • Hi mm,

    This forum is used to discuss about Office development, your issue is related with implementing a custom WOPI host, I will move this thread to the more related forum.

    Reference: https://social.msdn.microsoft.com/Forums/en-US/home?forum=os_office

    Thanks for your understanding.

    Best Regards,

    Edward


    We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place.
    Click HERE to participate the survey.


    Friday, May 13, 2016 3:02 AM
  • I don't know which forum is more related, but

    my issue is not about custom WOPI host.

    it's about office online server product's bug.

    my WOPI host was used to test the case

    but, this problem can be occured with any WOPI hosts. (even sharepoint server)

    Friday, May 13, 2016 7:24 AM
  • Hi,

    Thank you for contacting the Microsoft Open Protocols Support forum.  We have received the request and reviewing further.  Someone from the protocols support team will be in contact and will follow-up on the bug report.

    Thank you,

    Nathan Manis

    Microsoft Open Protocols Documentation Support

    Friday, May 13, 2016 1:47 PM
    Moderator
  • Hello mmnnmmnn

    Thank you for contacting Microsoft Support. Can you please drop me a mail at dochelp@microsoft.com so that we can exchange traces and debugging logs?

    Regards


    Tarun Chopra | Escalation Engineer | Open Specifications Support Team

    Friday, May 13, 2016 3:35 PM
  • To be specific, please send us fiddler trace for the scenario at dochelp@microsoft.com

    Tarun Chopra | Escalation Engineer | Open Specifications Support Team

    Friday, May 13, 2016 10:05 PM
  • I sended an email with attachments.

    thank you.

    Monday, May 16, 2016 5:35 AM
  • Thanks mmnnmmnn. We have received your email and reply back. Let's continue communicating through dochelp and circle back with the final conclusion on this forum thread to close the loop.

    Tarun Chopra | Escalation Engineer | Open Specifications Support Team

    Monday, May 16, 2016 3:38 PM
  • I found something in tests.
    "X-WOPI-Lock" http header item in 409 conflict response can make change.
    when I add "X-WOPI-Lock" header item with current lock string in 409 conflict response,
    scenario is changed like below.

    1. request lock
    {
    X-WOPI-Lock: {"S":"538ee65c-a043-4a19-add2-cd436bdd3aca","F":4}
    X-WOPI-Override: LOCK
    }

    2. unlock and relock
    {
    X-WOPI-OldLock: {"S":"538ee65c-a043-4a19-add2-cd436bdd3aca","F":4}
    X-WOPI-Lock: {"S":"538ee65c-a043-4a19-add2-cd436bdd3aca","F":6,"E":2,"M":"5fe35c9a905e474c9c8b564cc969ace7","P":"5369E98F-5211-48E3-AFDF-A2793357EC4B"}
    X-WOPI-Override: LOCK
    }

    3. edit and save -> putfile
    {
    X-WOPI-Lock: {"S":"538ee65c-a043-4a19-add2-cd436bdd3aca","F":4}
    X-WOPI-Override: PUT
    } ==> 409 Conflict

    4. retry putfile
    {
    X-WOPI-Lock: {"S":"538ee65c-a043-4a19-add2-cd436bdd3aca","F":6,"E":2,"M":"5fe35c9a905e474c9c8b564cc969ace7","P":"5369E98F-5211-48E3-AFDF-A2793357EC4B"}
    X-WOPI-Override: PUT
    }

    5. on close, unlock
    {
    X-WOPI-Lock: {"S":"538ee65c-a043-4a19-add2-cd436bdd3aca"}
    X-WOPI-Override: UNLOCK
    } ==> 409 conflict

    6. retry unlock
    {
    X-WOPI-Lock: {"S":"538ee65c-a043-4a19-add2-cd436bdd3aca","F":6,"E":2,"M":"5fe35c9a905e474c9c8b564cc969ace7","P":"5369E98F-5211-48E3-AFDF-A2793357EC4B"}
    X-WOPI-Override: UNLOCK
    }

    question 1.
    http://officeonline.readthedocs.io/projects/wopirest/en/latest/files/Lock.html page says
    X-WOPI-Lock header must be included.
    but https://msdn.microsoft.com/en-us/library/hh623363(v=office.12).aspx page doesn't.
    is officeonline.readthedocs.io the official reference? should I believe it?
    I don't know whether I should follow officeonline.readthedocs.io because I know it's incorrect.
    "UserId" is not required property but officeonline.readthedocs.io says it is.
    http://officeonline.readthedocs.io/projects/wopirest/en/latest/files/CheckFileInfo.html
    https://msdn.microsoft.com/en-us/library/hh622920(v=office.12).aspx

    question 2.
    if X-WOPI-Lock header must be included, why sharepoint server doesn't do so?
    (sharepoint server 2016 does so only for Lock request. not PutFile or Unlock)

    question 3.
    without X-WOPI-Lock header, excel online and powerpoint online runs well.
    they even don't receive 409 conflict response at all because they use correct lock string in requests.
    why only word online forget its lock string?

    question 4.
    I can't understand fixed scenario. it's behavior is correct but, I think it is unsafe.
    like this.

    A sets its vault's password to ABCD
    A resets its vault's password to ABCDEFG
    A tries to open its vault with password ABC
    vault says "you gave me wrong password. current password is ABCDEFG"
    A tries to open its vault with password ABCDEFG
    Tuesday, May 24, 2016 7:40 AM
  • Hey mmnnmmnn,

    We're discussing this offline in email and once we address all your questions, we'll reply back to this forum thread to update the community.

    Best regards,
    Tom Jebo
    Sr Escalation Engineer
    Microsoft Open Specifications

    Tuesday, May 24, 2016 10:39 PM
    Moderator
  • Just an update to for the community:

    Question 1: I have filed a bug against the [MS-WOPI] specification, section 3.3.5.1.3 "Lock" to add the required X-WOPI-Lock header for the 409 response. The question of which documentation set to use: the readthedocs.io project is primarily aimed at WOPI host implementers integrating with the Office Online (cloud), however, it does contain equivalent WOPI wire protocol specifications. [MS-WOPI] on MSDN is purely the wire protocol for WOPI and references on-prem deployments of Office web applications but will be suitable (from the WOPI protocol perspective) to interact with Office Online in the cloud.

    Question 4: There is no safety issue here regarding the response containing the correct lock. Authorization and permissions are done via the access_token parameter sent with requests and also proof keys provide assurance of communication with Office Online.

    I am still looking into questions 2 and 3.

    Thanks,

    Tom

    Wednesday, June 1, 2016 5:20 PM
    Moderator
  • Hello, I am experiencing exactly the same problem (incorrect lock value when unlocking). 

    So I am asking - has the problem been fixed? We have local Office Online Server and because of

    the issue it is not much usable.

    Thanks,

    Ivan


    • Edited by Ivan Luska Tuesday, November 8, 2016 2:24 PM
    Tuesday, November 8, 2016 2:23 PM
  • Hi Ivan,

    Thanks for the question. Since it's been a few months let me check on this and update you shortly.

    Best regards,
    Tom Jebo 
    Sr Escalation Engineer
    Microsoft Open Specifications Support


    Tuesday, November 8, 2016 7:13 PM
    Moderator
  • Hi Ivan,

    Thank you for your question. One of our Protocols support engineers will respond shortly.

    Thanks,


    Jeff McCashland | Microsoft Protocols Open Specifications Team

    Tuesday, November 8, 2016 7:13 PM
    Moderator
  • Hi Ivan, 

    If you are referring to the following from the original posts:

    question 3. without X-WOPI-Lock header, excel online and powerpoint online runs well. they even don't receive 409 conflict response at all because they use correct lock string in requests. why only word online forget its lock string?”

    We explained this to the OP offline but didn't actually post for the community. I apologize. Here is the explanation:

    This is by design for Word Online. When booting the Word Editor, it will often lock conflict with itself.  That’s because the client part and the server part get created asynchronously at the same time, so the client gets created before it knows the lock that the server will take.  So the server locks it, then the client makes its first call to the server without knowing either the current lock string or the server that runs its session.  It learns both of those from the 409 and then happily joins its session.  Excel and PPT don’t share this behavior.  


    Best regards,
    Tom Jebo
    Sr Escalation Engineer
    Microsoft Open Specifications


    Wednesday, November 9, 2016 4:55 AM
    Moderator
  • Hello Tom,

    Thank you for the explanation. It was bug in my WOPI implementation. I am sorry for not relevant post.

    Regards,

    Ivan

    Wednesday, November 16, 2016 9:38 AM
  • Thank you for the follow-up Ivan.
    Wednesday, November 16, 2016 3:28 PM
    Moderator