Skip to main content

This content has been archived and is no longer being updated. Links may not function; however, this content may be relevant to outdated versions of the product.

Support Article

Word merge functionality not working with load balancer



Introduction of load balancer (LB) into the networking environment results in an error while application exercises Word merge functionality.

Error Messages

Failed to re-attach server session.

Steps to Reproduce

Run any flow action that attempts Word merge.

Root Cause

Load Balancer sets a cookie with the HTTPONLY attribute.

Using HTTPONLY cookie attribute interferes with Pega or PRPC integration with MS Office applications on desktop.

This statement is based on fundamental nature of HTTPONLY security feature and applies to:

  • All released Pega / PRPC versions up to Pega 7.2.2 or any future release.
  • Any desktop level integration of Pega with MS Office implemented using ActiveX and Silverlight plugins.

Technical explanation:

  •  HTTPONLY attribute instructs browser to store cookie in hidden storage and do not share with JavaScript or any plugin / control loaded into the browser.
  • Desktop integration requires ALL cookies to be fetched from the browser and transferred to the companion MS Office application (Word in this case) so that it can communicate via HTTP with the same requestor object on the server.
  • When Office application tries to establish HTTP connection with the Pega server, missing HTTPONLY cookie will force security proxy (load balancer in this case) to disrupt this attempt.
  •  One limited exception to the above conclusion:
  • Microsoft provided “back door” to fetch cookies hidden by HTTPONLY attribute, InternetGetCookieEx WinInet API.
  • Both Pega ActiveX and Silverlight controls use that API.
  • This API works only in about 20% cases in real life. In case it does not work, there is no other recourse available to fetch hidden cookies. In this case this API did not work.

Here is a sample reference article on PDN:



Using HTTPONLY attribute and support of Word merge functionality is a trade-off.

​The enterprise has to make a judicial choice between extra security provided by HTTPONLY and the application need to use Word merge functionality.


Published January 11, 2017 - Updated October 8, 2020

Was this useful?

0% found this useful

Have a question? Get answers now.

Visit the Collaboration Center to ask questions, engage in discussions, share ideas, and help others.

Did you find this content helpful?

Want to help us improve this content?

We'd prefer it if you saw us at our best.

Pega Community has detected you are using a browser which may prevent you from experiencing the site as intended. To improve your experience, please update your browser.

Close Deprecation Notice
Contact us