Take the 2-minute tour ×

I have a custom url protocol handler for urls of the form myhandler://path/to/something. This is registered to a locally installed client application that handles the requests and does "the right thing".

However, when I have a link of that form in outlook (2007), outlook displays a big scary warning that says:

Microsoft office has identified a potential security concern This location may be unsafe ... Hyperlinks can be harmful to your computer and data. To protect your computer, click only those hyperlinks from trusted sources.

Do you want to continue?

I am aware of the outlook registry key that would enable me to disable these warnings entirely (http://support.microsoft.com/?kbid=925757), but I don't want to be a "bad citizen" on the machine.

Is there some way that I can "whitelist" my url protocol handler to indicate that I have done due security diligence without opening up access to other URL protocol handlers on the machine that might not be hardened to malicious user input?

Outlook does not prompt for URLs of the form http: https: mailto: (and perhaps others). Is this list hardcoded somewhere deep in the bowels of office or is there some way to add my specific protocol to the list?

share|improve this question

3 Answers 3

I recently had the same problem and could resolve it. The registry keys where you have to register your protocol handler are described in this kb article.

Note that it refers to a hotfix which needs to be installed, but for me it worked without installing anything. Maybe the hotfix was already distributed with the windows update service.

share|improve this answer
As for installing the hotfix or not, I believe that it was included in Office 2007 SP3. The article on the hotfix says that SP1 or SP2 is a prerequisite. This worked for me without installing the hotfix. –  kevinpo Feb 4 '13 at 14:04

Since you've got things squared for when the url is opened in a browser (but not Outlook), my work-around suggestion is:

Give people what they expect, a regular http url. Then have your server re-direct to the special url with the special handler. Or give them a file url and have the contents of the file be a Javascript re-direct to the real place.

I believe Apple does something similar in its references to iTunes-handled links such as http://phobos.apple.com/WebObjects/MZStore.woa/wa/viewPodcast?id=80028216

Added, this technique also enables you to show a splash page in the browser with instructions on what to do if your software has not been installed/configured yet on the local machine.

share|improve this answer
I like the idea, but one of my requirements is to be able to operate when not connected to a network (the offline scenario). –  StarBright Feb 11 '10 at 18:26
Re: offline: use the file:// handler to load a local html file with javascript in it to redirect to your custom handler –  Larry K Feb 11 '10 at 22:37

Maybe it wasn't there to start with, but the link you quoted above (http://support.microsoft.com/?kbid=925757), now has the answer you were looking for - further down under the heading "How to enable or disable hyperlink warnings per protocol", which has similar information to Zarat's answer except that it is specific to both Office 2007 and 2010 and doesn't require the hotfix.

Also, as the registry keys indicate this works for ALL Office applications, not just Outlook.

Worked first time for me in Excel 2010

share|improve this answer

Your Answer


