3.1 KiB
Outgoing header DLP
The managed browser intercepts final outgoing HTTP headers in its privileged
session onBeforeSendHeaders listener. This stage runs before HTTP data is sent,
according to the Electron WebRequest contract.
It supplements the existing URL, body, DNS and destination gates.
Chromium may already have opened a TCP connection before this callback; the
guarantee concerns release of HTTP data, not preventing a connection attempt.
All fields are inspected, including custom headers, Cookie, Authorization,
Proxy-Authorization and Referer. There is no credential-field exemption. Ordinary
opaque session cookies, Basic credentials and JWT bearer strings remain usable
unless they match a central rule. Recognizable sk- or GitHub API tokens match
the existing generic secret detector even when used as direct API credentials;
approved AI integrations should use the controlled gateway.
The browser copies and validates at most 128 fields and 64 KiB, bounded further by the signed DLP byte limit. Invalid fields, inaccessible snapshots and scanner failures block. Each value is scanned separately for exact document fingerprints; joined values catch literals split across fields; the serialized complete snapshot is also inspected. Existing core percent decoding and phrase normalization apply. This is not a claim of decoding arbitrary compression, encryption or encodings.
Signed-policy semantic and YARA inspection runs locally on the complete header snapshot when enabled. An enabled upload ICAP connector also inspects this snapshot, including credential fields: administrators must treat the configured company scanner as trusted infrastructure. Scanners require a complete allow result. Revocation, expiry, policy replacement, source navigation or the 40-second deadline prevent release. Chromium receives the exact frozen snapshot approved by the gate. Mutable byte buffers are wiped after inspection; JavaScript string copies are garbage-collected and cannot be reliably overwritten.
Ordinary audit receives only the existing rule ID and destination hostname on
block. browser.request.headers exports field count, byte count, timing and request
type under a browser.request parent. Header values, names, token hashes and cookie
contents are not added to security audit or diagnostic traces.
The native deadline cancels exactly once and records the static
headers-inspection-timeout reason. A late scanner approval cannot release the
request, and a failed audit write cannot turn the cancellation into an allow.
This covers the final header fields exposed by Electron for the managed session. For WebSockets, this stage inspects handshake headers only; it does not inspect subsequent frames. WebSockets remain disabled by the baseline policy, and a delegated exception does not establish full frame-level DLP coverage. It does not establish protection against arbitrary transformed covert channels, other OS applications or every network layer generated internally by Chromium. Native receiver tests must prove prohibited requests never reach their destination.