Support Article
Word merge functionality not working with load balancer
SA-31916
Summary
Introduction of load balancer (LB) into the networking environment results in an error while application exercises Word merge functionality.
Error Messages
Failed to re-attach server session.
Steps to Reproduce
Run any flow action that attempts Word merge.
Root Cause
Load Balancer sets a cookie with the HTTPONLY attribute.
Using HTTPONLY cookie attribute interferes with Pega or PRPC integration with MS Office applications on desktop.
This statement is based on fundamental nature of HTTPONLY security feature and applies to:
- All released Pega / PRPC versions up to Pega 7.2.2 or any future release.
- Any desktop level integration of Pega with MS Office implemented using ActiveX and Silverlight plugins.
Technical explanation:
- HTTPONLY attribute instructs browser to store cookie in hidden storage and do not share with JavaScript or any plugin / control loaded into the browser.
- Desktop integration requires ALL cookies to be fetched from the browser and transferred to the companion MS Office application (Word in this case) so that it can communicate via HTTP with the same requestor object on the server.
- When Office application tries to establish HTTP connection with the Pega server, missing HTTPONLY cookie will force security proxy (load balancer in this case) to disrupt this attempt.
- One limited exception to the above conclusion:
- Microsoft provided “back door” to fetch cookies hidden by HTTPONLY attribute, InternetGetCookieEx WinInet API.
- Both Pega ActiveX and Silverlight controls use that API.
- This API works only in about 20% cases in real life. In case it does not work, there is no other recourse available to fetch hidden cookies. In this case this API did not work.
Here is a sample reference article on PDN: https://pdn.pega.com/troubleshooting-microsoft-office-integration-fails-http-only-cookies.
Resolution
Using HTTPONLY attribute and support of Word merge functionality is a trade-off.
The enterprise has to make a judicial choice between extra security provided by HTTPONLY and the application need to use Word merge functionality.
Published January 11, 2017 - Updated October 8, 2020
Have a question? Get answers now.
Visit the Collaboration Center to ask questions, engage in discussions, share ideas, and help others.