For our time tracking software we provide a feature that allows users to show their time recordings in their calendar application. Therefor we provide a special URL that includes a unique token to allow access to the entries of the user. The URL looks like

https://troii.timr.com/timr/cal/workingtime-1b9119c3-42a2-a5d4-5e97b8f4cda2.ics

It includes a token that authenticates the user and does not need extra login information to access the calendar.

Lately we had some support requests saying that Outlook 2013 asks for a username and a password when using this URL to subscribe to a “internet calendar”. We looked into our log files and found the following:

112.xx.xx.xxx - - [11/May/2014:06:30:00 +0200] "GET /timr/cal/workingtime-1b9119c3-42a2-a5d4-5e97b8f4cda2.ics%20 HTTP/1.1" 200 15217 "-" "Microsoft Office/15.0 (Windows NT 6.2; Microsoft Outlook 15.0.4605; Pro)" 874863 "-" "-" 0

The interesting thing here is the %20 at the end of the URL - it seems there is a space at the end of the URL. We thought it is not possible to add a space to the end of an URL because if you do this in the URL field of a browser it always strips the space character from the URL.

As it turns out this is not the case with Outlook - when you enter an URL that ends with space character it is sent to server like that, which is invalid.

I hope this is a bug and Microsoft fixes it in the next versions because I can not see why this should be a feature.