Url protocol handler security warnings

Question

I have a custom url protocol handler for urls of the form myhandler://path/to/something. This is registered to a locally installed client application that handles the requests and does "the right thing".

However, when I have a link of that form in outlook (2007), outlook displays a big scary warning that says:

Microsoft office has identified a potential security concern This location may be unsafe ... Hyperlinks can be harmful to your computer and data. To protect your computer, click only those hyperlinks from trusted sources.

Do you want to continue?

I am aware of the outlook registry key that would enable me to disable these warnings entirely (http://support.microsoft.com/?kbid=925757), but I don't want to be a "bad citizen" on the machine.

Is there some way that I can "whitelist" my url protocol handler to indicate that I have done due security diligence without opening up access to other URL protocol handlers on the machine that might not be hardened to malicious user input?

Outlook does not prompt for URLs of the form http: https: mailto: (and perhaps others). Is this list hardcoded somewhere deep in the bowels of office or is there some way to add my specific protocol to the list?

Answer 1

Since you've got things squared for when the url is opened in a browser (but not Outlook), my work-around suggestion is:

Give people what they expect, a regular http url. Then have your server re-direct to the special url with the special handler. Or give them a file url and have the contents of the file be a Javascript re-direct to the real place.

I believe Apple does something similar in its references to iTunes-handled links such as http://phobos.apple.com/WebObjects/MZStore.woa/wa/viewPodcast?id=80028216

Added, this technique also enables you to show a splash page in the browser with instructions on what to do if your software has not been installed/configured yet on the local machine.