SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am currently trying to intercept the request SharePoint sends for viewing a document in a document library with a HttpModule to do custom processing.

Unfortunately, SharePoint seems to send the requests through an ActiveX control (OpenDocuments) when you use the "Name (linked to an element)" field and the HttpModule does not see those requests.

What i'm trying to do here is:
1- intercept the request
2- Verify if current user has permission to open documents (custom permission level).
3- If user doesn't have permissions, transfer request to access denied page.

My question is: Is there any way to do this (with or without the httpmodule)?

Current Code for reference:

public class ViewOnlyModule : IHttpModule
    HttpApplication App;

    public void Init(HttpApplication context)
        context.BeginRequest += new EventHandler(PreventAccessToFile);
        //context.PreRequestHandlerExecute += new EventHandler(PreventAccessToFile);

    public void Dispose()


    private void PreventAccessToFile(Object sender, EventArgs e)




<modules runAllManagedModulesForAllRequests="true">
  <add name="VictrixModule" type="Victrix.SP.Modules.ViewOnlyModule,Victrix.SP.Modules, Version=, Culture=neutral, PublicKeyToken=e6ae758afa22123f" />

Don't get me wrong, it does trigger requests, but none to the document itself.


share|improve this question
There is no reason that the activex won't trigger the httpmodule. Check with fiddler what is exactely the requested ressources, and also check that you setup properly the http module (can you show us the web.config?) – Steve B Dec 14 '12 at 16:11
Look at my original post for response. I don't know what is fiddler, can you give me more informations about it please? – Pascal Robillard Dec 14 '12 at 17:04
Fiddler is one of the must have tool of any SharePoint Developer (actually, every Web developer). It acts as a http proxy, and allow to see and alter all request that are handled by this virtual proxy. In your case, it may help you to track what are the SharePoint urls, and verb, that are targeted by the office application. – Steve B Dec 17 '12 at 9:07
I have to ask ... why not just remove the users permissions in SharePoint to not let them have view access to these documents? – Chris Johnson Jan 25 '13 at 18:33

OpenDocuments is an ActiveX control for IE, How it works is when you try to download/open a document from SP using IE. IE opens Word first and then Word tries to download the document, hence you see a prompt for credentials,

Firefox on the other hand, first downloads the document and then hands over the document to Word for viewing.

Depending on your setup, whether the site in on the Intranet enviornment or Internet. If it is Intranet then my guess is you would use NTLM and authentication would be handled and the documents will be security trimmed.

If the site is an Internet site, then you can use use javascript to manipulate the url based on the file type and use _layouts/download.aspx page I have done a blog post on this method, take a look here

Look at the method: rectifyOfficeDocumentLinks()

bare in mind that this was done for an Internet Facing site, when users where getting credential prompts when opening office documents.

If it is an Intranet scenario then you can use Javascript to check if a user is Authenticated and redirect if they do not have access to the page:

Here is how:

Keep in mind that the user can disable scripts on the browser but again they could disable the OpenDocuments IE ActiveX control, so pay attention to security.

Hope it helps, do let me know how you go, an interesting task you have, indeed.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.