0

I have a direct link that I grabbed from Firefox's Download section after downloading the file. I can plug this link into any browser whether I previously logged in to OneDrive Business or not and I get the file.

I can see this in the output: Access+denied.+Before+opening+files+in+this+location%2c+you+must+first+browse+to+the+web+site+and+select+the+option+to+login+automatically. but I don't understand why when I can use the link in private browser sessions with no prior cookies.

For some reason, I am unable to get the file using wget with the same link:

:~$ wget -d "https://[PATH].sharepoint.com/personal/[USER]_[PATH]_com/_layouts/15/download.aspx?SourceUrl=%2Fpersonal%2F[USER]%5F[PATH]%5Fcom%2FDocuments%2FShared%20with%20Everyone%2F[PATH]%2F[PATH]%5F[PATH]%2Etar%2Egz"
DEBUG output created by Wget 1.17.1 on linux-gnu.

Reading HSTS entries from /home/[USER]/.wget-hsts
URI encoding = ‘UTF-8’
--2017-07-20 16:16:29--  https://[PATH].sharepoint.com/personal/[USER]_[PATH]_com/_layouts/15/download.aspx?SourceUrl=%2Fpersonal%2F[USER]%5F[PATH]%5Fcom%2FDocuments%2FShared%20with%20Everyone%2F[PATH]%2F[PATH]%5F[PATH]%2Etar%2Egz
Resolving [PATH].sharepoint.com ([PATH].sharepoint.com)... [IP]
Caching [PATH].sharepoint.com => [IP]
Connecting to [PATH].sharepoint.com ([PATH].sharepoint.com)|[IP]|:443... connected.
Created socket 3.
Releasing 0x0000563fdf6db010 (new refcount 1).
Initiating SSL handshake.
Handshake successful; connected socket 3 to SSL handle 0x0000563fdf6dbff0
certificate:
  subject: CN=*.sharepoint.com,OU=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
  issuer:  CN=Microsoft IT SSL SHA2,OU=Microsoft IT,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
X509 certificate successfully verified and matches host [PATH].sharepoint.com

---request begin---
GET /personal/[USER]_[PATH]_com/_layouts/15/download.aspx?SourceUrl=%2Fpersonal%2F[USER]%5F[PATH]%5Fcom%2FDocuments%2FShared%20with%20Everyone%2F[PATH]%2F[PATH]%5F[PATH]%2Etar%2Egz HTTP/1.1
User-Agent: Wget/1.17.1 (linux-gnu)
//Accept: */*
Accept-Encoding: identity
Host: [PATH].sharepoint.com
Connection: Keep-Alive

---request end---
HTTP request sent, awaiting response... 
---response begin---
HTTP/1.1 403 Forbidden
Content-Length: 13
Content-Type: text/plain; charset=utf-8
Server: Microsoft-IIS/10.0
P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
X-SharePointHealthScore: 0
X-Forms_Based_Auth_Required: https://[PATH].sharepoint.com/_forms/default.aspx?ReturnUrl=/_layouts/15/error.aspx&Source=%2f_layouts%2f15%2fdownload.aspx%3fSourceUrl%3d%252Fpersonal%252F[USER]%255F[PATH]%255Fcom%252FDocuments%252FShared%2520with%2520Everyone%252F[PATH]%252F[PATH]%255F[PATH]%252Etar%252Egz
X-Forms_Based_Auth_Return_Url: https://[PATH].sharepoint.com/_layouts/15/error.aspx
X-MSDAVEXT_Error: 917656; Access+denied.+Before+opening+files+in+this+location%2c+you+must+first+browse+to+the+web+site+and+select+the+option+to+login+automatically.
SPRequestGuid: [ID]
request-id: [ID]
Strict-Transport-Security: max-age=31536000
X-FRAME-OPTIONS: SAMEORIGIN
SPRequestDuration: 90
SPIisLatency: 3
X-IDCRL_AUTH_PARAMS_V1: IDCRL Type="BPOSIDCRL", EndPoint="/personal/[USER]_[PATH]_com/_vti_bin/idcrl.svc/", RootDomain="sharepoint.com", Policy="MBI"
X-Powered-By: ASP.NET
MicrosoftSharePointTeamServices: 16.0.0.6712
X-Content-Type-Options: nosniff
X-MS-InvokeApp: 1; RequireReadOnly
X-MSEdge-Ref: Ref A: [ID] Ref B: [ID] Ref C: 2017-07-20T20:16:28Z
Date: Thu, 20 Jul 2017 20:16:27 GMT

---response end---
403 Forbidden
Registered socket 3 for persistent reuse.
Parsed Strict-Transport-Security max-age = 31536000, includeSubDomains = false
Updated HSTS host: [PATH].sharepoint.com:443 (max-age: 31536000, includeSubdomains: false)
URI content encoding = ‘utf-8’
Skipping 13 bytes of body: [403 FORBIDDEN] done.
2017-07-20 16:16:29 ERROR 403: Forbidden.

Saving HSTS entries to /home/[USER]/.wget-hsts
Enigma
  • 283
  • 2
    Maybe try setting the user agent and/or referrer headers to something more browser-like. – Jason C Jul 27 '17 at 19:23
  • You may want to ask this on https://sharepoint.stackexchange.com/.

    In addition to @JasonC comment, see https://unix.stackexchange.com/questions/139698/why-would-curl-and-wget-result-in-a-403-forbidden.

    This question could be considered a duplicate of 139698.

    – Deathgrip Jul 27 '17 at 19:41
  • @JasonC I did try setting the user agent to Mozilla - same result. – Enigma Jul 27 '17 at 20:59
  • @Deathgrip I did post this question there originally but since it pertains to wget/curl it seemed more apt here. Also got no responses in a week. – Enigma Jul 27 '17 at 21:00
  • Yes this does appear to be a duplicate in that sense. I think my sharepoint server requires a cookie. – Enigma Jul 27 '17 at 21:09

0 Answers0