In Office 365 how do I get a direct download link for an Excel document stored in One Drive for Business?

Question

My company uses Office 365 with OneDrive. I uploaded an Excel file there and shared via "guest link".

Is it possible to generate a link which someone could use just to download the file without further authentication?

For automation purposes, I am thinking of simple scheme:

 wget https://acmeamce.sharepoint.com/personal/myname/.../blabla.xlsx

Solution 1

Thanks to finding out OneDrive for Business is actually a re-branded Sharepoint 2013 and an answer in Sharepoint@SE I managed to get a link for programmatic download of a document.

One way to achieve is to right click on the document in the web GUI and take the URL there. It didn't work for me as this URL required authentication, but...

Taking the prefix of the URL e.g.

 https://acmeacme.sharepoint.com/personal/myname/_layouts/15/download.aspx?SourceUrl=

and the "usual" URL generated as guest link

 https://acmacme.sharepoint.com/personal/myname/_layouts/15/guestaccess.aspx?guestaccesstoken=123123%3d&docid=123123

and concatenating them turned out to work like a charm:

wget https://acmeacme.sharepoint.com/personal/myname/_layouts/15/download.aspx?SourceUrl=https://acmacme.sharepoint.com/personal/myname/_layouts/15/guestaccess.aspx?guestaccesstoken=123123%3d&docid=12312

Solution 2

All I needed to do was change the Edit Link slightly. Just replace guestaccess.aspx with download.aspx.

Solution 3

Just to add to this thread (which pointed me in the right direction - thanks!), when trying as described above I got a 403 FORBIDDEN message when trying to download, and a Office 365 login on pasting into a browser.

To resolve I copied the guestaccesstoken=... part of the second URL and made it a parameter of the first URL also.

This then authenticated fine and the download worked a treat.

Thanks! Steve

Comments

[Sun]

+1 for a creative, thoughtful, and hacky solution.

[Nemo]

How long does that token last? Doesn't seem very secure! At least I see they have HSTS, otherwise it would be very easy to collect tokens. ssllabs.com/ssltest/analyze.html?d=onedrive.com

[Jeffrey Hyer]

For those who find this answer later, like I did, the access token has a configurable expiration. When the link is generated you can choose between 'Never' or a specified length of time (e.g. 1 day, 30 days, 60 days, or a custom time frame) until the link (guest access token) expires. (@nemo)