word online file unlock bug (office online server 2016-05)

Question

Hello.
I'm implementing a WOPI host.
It does not support COBALT (fsshttp, fsshttpb) so it sets "SupportsCobalt:false" for CheckFileInfo response.
Currently, it just responds 200 OK to every lock and unlock requests.
But while in tests, I found strange behavior of word online that seems to be a bug.
Belows are results of three tests. I opened pptx, xlsx, docx files in edit mode and closed office online webapp right after.

----- pptx

1. request lock
{
X-WOPI-Lock: {"F":4,"E":2,"L":"e4c2bba6790f408095b43bd8340e8826"}
X-WOPI-Override: LOCK
}

2. rename lock
{
X-WOPI-OldLock: {"F":4,"E":2,"L":"e4c2bba6790f408095b43bd8340e8826"}
X-WOPI-Lock: {"F":6,"E":2,"M":"e4c2bba6790f408095b43bd8340e8826","P":"2EE7D83D-84ED-48D6-8120-6C4D71FDF072","L":"e4c2bba6790f408095b43bd8340e8826"}
X-WOPI-Override: LOCK
}

3. on close, request unlock
{
X-WOPI-Lock: {"F":6,"E":2,"M":"e4c2bba6790f408095b43bd8340e8826","P":"2EE7D83D-84ED-48D6-8120-6C4D71FDF072","L":"e4c2bba6790f408095b43bd8340e8826"}
X-WOPI-Override: UNLOCK
}

------ xlsx

1. request lock
{
X-WOPI-Lock: {"F":4,"E":2,"C":"","L":"e4c2bba6790f408095b43bd8340e8826"}
X-WOPI-Override: LOCK
}

2. rename lock
{
X-WOPI-OldLock: {"F":4,"E":2,"C":"","L":"e4c2bba6790f408095b43bd8340e8826"}
X-WOPI-Lock: {"F":6,"E":2,"M":"e4c2bba6790f408095b43bd8340e8826","P":"35DCD4EF-F7F2-42FE-A758-3FFA27330695","L":"e4c2bba6790f408095b43bd8340e8826"}
X-WOPI-Override: LOCK
}

3. on close, request unlock
{
X-WOPI-Lock: {"F":6,"E":2,"M":"e4c2bba6790f408095b43bd8340e8826","P":"35DCD4EF-F7F2-42FE-A758-3FFA27330695","L":"e4c2bba6790f408095b43bd8340e8826"}
X-WOPI-Override: UNLOCK
}

---------- docx

1. request lock
{
X-WOPI-Lock: {"S":"da3613ea-b27b-42a6-adb4-4a6d89c4842e","F":4}
X-WOPI-Override: LOCK
}

2. rename lock
{
X-WOPI-OldLock: {"S":"da3613ea-b27b-42a6-adb4-4a6d89c4842e","F":4}
X-WOPI-Lock: {"S":"da3613ea-b27b-42a6-adb4-4a6d89c4842e","F":6,"E":2,"M":"e4c2bba6790f408095b43bd8340e8826","P":"BF334F9E-7899-4E39-9EA4-6EFF019F57DC"}
X-WOPI-Override: LOCK
}

3. on close, request unlock
{
X-WOPI-Lock: {"S":"da3613ea-b27b-42a6-adb4-4a6d89c4842e"}
X-WOPI-Override: UNLOCK
}

but there is no lock named {"S":"da3613ea-b27b-42a6-adb4-4a6d89c4842e"},
it shoud be {"S":"da3613ea-b27b-42a6-adb4-4a6d89c4842e","F":6,"E":2,"M":"e4c2bba6790f408095b43bd8340e8826","P":"BF334F9E-7899-4E39-9EA4-6EFF019F57DC"}.
because of this bug, when I use office online server with sharepoint 2013,
and set "SupportsCobalt:false" somehow,
word file modification is not adjusted because the file is forever locked.
(after about 30 minutes, the file is automatically unlocked,
but it seems sharepoint discards changes because of the transaction failure.)

I think this is an obvious bug and I want to know when I can get the fixed version of office online server.

Answer 1

Hi mm,

This forum is used to discuss about Office development, your issue is related with implementing a custom WOPI host, I will move this thread to the more related forum.

Reference: https://social.msdn.microsoft.com/Forums/en-US/home?forum=os_office

Thanks for your understanding.

Best Regards,

Edward

---

We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place.
Click HERE to participate the survey.

Answer 2

I don't know which forum is more related, but

my issue is not about custom WOPI host.

it's about office online server product's bug.

my WOPI host was used to test the case

but, this problem can be occured with any WOPI hosts. (even sharepoint server)

Answer 3

Hi,

Thank you for contacting the Microsoft Open Protocols Support forum.  We have received the request and reviewing further.  Someone from the protocols support team will be in contact and will follow-up on the bug report.

Thank you,

Nathan Manis

Microsoft Open Protocols Documentation Support

Answer 4

Hello mmnnmmnn

Thank you for contacting Microsoft Support. Can you please drop me a mail at [e-mail] so that we can exchange traces and debugging logs?

Regards

---

Tarun Chopra | Escalation Engineer | Open Specifications Support Team

Answer 5

To be specific, please send us fiddler trace for the scenario at [e-mail]

---

Tarun Chopra | Escalation Engineer | Open Specifications Support Team

Answer 6

I sended an email with attachments.

thank you.

Answer 7

Thanks mmnnmmnn. We have received your email and reply back. Let's continue communicating through dochelp and circle back with the final conclusion on this forum thread to close the loop.

---

Tarun Chopra | Escalation Engineer | Open Specifications Support Team

Answer 8

I found something in tests.
"X-WOPI-Lock" http header item in 409 conflict response can make change.
when I add "X-WOPI-Lock" header item with current lock string in 409 conflict response,
scenario is changed like below.

1. request lock
{
X-WOPI-Lock: {"S":"538ee65c-a043-4a19-add2-cd436bdd3aca","F":4}
X-WOPI-Override: LOCK
}

2. unlock and relock
{
X-WOPI-OldLock: {"S":"538ee65c-a043-4a19-add2-cd436bdd3aca","F":4}
X-WOPI-Lock: {"S":"538ee65c-a043-4a19-add2-cd436bdd3aca","F":6,"E":2,"M":"5fe35c9a905e474c9c8b564cc969ace7","P":"5369E98F-5211-48E3-AFDF-A2793357EC4B"}
X-WOPI-Override: LOCK
}

3. edit and save -> putfile
{
X-WOPI-Lock: {"S":"538ee65c-a043-4a19-add2-cd436bdd3aca","F":4}
X-WOPI-Override: PUT
} ==> 409 Conflict

4. retry putfile
{
X-WOPI-Lock: {"S":"538ee65c-a043-4a19-add2-cd436bdd3aca","F":6,"E":2,"M":"5fe35c9a905e474c9c8b564cc969ace7","P":"5369E98F-5211-48E3-AFDF-A2793357EC4B"}
X-WOPI-Override: PUT
}

5. on close, unlock
{
X-WOPI-Lock: {"S":"538ee65c-a043-4a19-add2-cd436bdd3aca"}
X-WOPI-Override: UNLOCK
} ==> 409 conflict

6. retry unlock
{
X-WOPI-Lock: {"S":"538ee65c-a043-4a19-add2-cd436bdd3aca","F":6,"E":2,"M":"5fe35c9a905e474c9c8b564cc969ace7","P":"5369E98F-5211-48E3-AFDF-A2793357EC4B"}
X-WOPI-Override: UNLOCK
}

question 1.
http://officeonline.readthedocs.io/projects/wopirest/en/latest/files/Lock.html page says
X-WOPI-Lock header must be included.
but https://msdn.microsoft.com/en-us/library/hh623363(v=office.12).aspx page doesn't.
is officeonline.readthedocs.io the official reference? should I believe it?
I don't know whether I should follow officeonline.readthedocs.io because I know it's incorrect.
"UserId" is not required property but officeonline.readthedocs.io says it is.
http://officeonline.readthedocs.io/projects/wopirest/en/latest/files/CheckFileInfo.html
https://msdn.microsoft.com/en-us/library/hh622920(v=office.12).aspx

question 2.
if X-WOPI-Lock header must be included, why sharepoint server doesn't do so?
(sharepoint server 2016 does so only for Lock request. not PutFile or Unlock)

question 3.
without X-WOPI-Lock header, excel online and powerpoint online runs well.
they even don't receive 409 conflict response at all because they use correct lock string in requests.
why only word online forget its lock string?

question 4.
I can't understand fixed scenario. it's behavior is correct but, I think it is unsafe.
like this.

A sets its vault's password to ABCD
A resets its vault's password to ABCDEFG
A tries to open its vault with password ABC
vault says "you gave me wrong password. current password is ABCDEFG"
A tries to open its vault with password ABCDEFG

Answer 9

Hey mmnnmmnn,

We're discussing this offline in email and once we address all your questions, we'll reply back to this forum thread to update the community.

Best regards,
Tom Jebo
Sr Escalation Engineer
Microsoft Open Specifications

Answer 10

Just an update to for the community:

Question 1: I have filed a bug against the [MS-WOPI] specification, section 3.3.5.1.3 "Lock" to add the required X-WOPI-Lock header for the 409 response. The question of which documentation set to use: the readthedocs.io project is primarily aimed at WOPI host implementers integrating with the Office Online (cloud), however, it does contain equivalent WOPI wire protocol specifications. [MS-WOPI] on MSDN is purely the wire protocol for WOPI and references on-prem deployments of Office web applications but will be suitable (from the WOPI protocol perspective) to interact with Office Online in the cloud.

Question 4: There is no safety issue here regarding the response containing the correct lock. Authorization and permissions are done via the access_token parameter sent with requests and also proof keys provide assurance of communication with Office Online.

I am still looking into questions 2 and 3.

Thanks,

Tom

Answer 11

Hello, I am experiencing exactly the same problem (incorrect lock value when unlocking). 

So I am asking - has the problem been fixed? We have local Office Online Server and because of

the issue it is not much usable.

Thanks,

Ivan

Answer 12

Hi Ivan,

Thanks for the question. Since it's been a few months let me check on this and update you shortly.

Best regards,
Tom Jebo 
Sr Escalation Engineer
Microsoft Open Specifications Support

Answer 13

Hi Ivan,

Thank you for your question. One of our Protocols support engineers will respond shortly.

Thanks,

---

Jeff McCashland | Microsoft Protocols Open Specifications Team

Answer 14

Hi Ivan, 

If you are referring to the following from the original posts:

“question 3. without X-WOPI-Lock header, excel online and powerpoint online runs well. they even don't receive 409 conflict response at all because they use correct lock string in requests. why only word online forget its lock string?”

We explained this to the OP offline but didn't actually post for the community. I apologize. Here is the explanation:

This is by design for Word Online. When booting the Word Editor, it will often lock conflict with itself.  That’s because the client part and the server part get created asynchronously at the same time, so the client gets created before it knows the lock that the server will take.  So the server locks it, then the client makes its first call to the server without knowing either the current lock string or the server that runs its session.  It learns both of those from the 409 and then happily joins its session.  Excel and PPT don’t share this behavior.  

Best regards,
Tom Jebo
Sr Escalation Engineer
Microsoft Open Specifications

Answer 15

Hello Tom,

Thank you for the explanation. It was bug in my WOPI implementation. I am sorry for not relevant post.

Regards,

Ivan

Answer 16

Thank you for the follow-up Ivan.