41 lines
2.5 KiB
Markdown
41 lines
2.5 KiB
Markdown
# Windows browser transport containment
|
|
|
|
Electron's HTTP request hooks do not intercept WebTransport payloads. A native
|
|
receiver test with Electron 44.7.0 demonstrated data from both a page and a
|
|
dedicated worker bypassing those hooks, including with the tested QUIC/Blink
|
|
disable flags. The implementation therefore forces every managed browser URL
|
|
through a private non-DIRECT Chromium proxy, with implicit loopback bypass removed.
|
|
The tested Chromium HTTP/3 WebTransport client rejects that proxy route before
|
|
opening its UDP connection. Ordinary HTTP and HTTPS remain available.
|
|
|
|
`local-dlp-relay.cjs` binds numeric loopback only and authenticates Chromium with
|
|
an ephemeral capability. It forwards approved HTTP or CONNECT traffic; it is not
|
|
a replacement for the native content-DLP gates. Native hooks still inspect text,
|
|
files and headers before release. Policy replacement, quarantine and shutdown
|
|
invalidate relay authority and terminate pending/live sockets. Resolution uses
|
|
the approved Chromium resolver and numeric connection addresses.
|
|
|
|
The management session retains the centrally configured system/fixed/PAC proxy.
|
|
The relay resolves upstream routes through that session. DIRECT, HTTP PROXY and
|
|
HTTPS PROXY routes are supported; an unsupported or failed route never silently
|
|
falls back to DIRECT. SOCKS and integrated upstream NTLM/Kerberos authentication
|
|
currently fail closed and require an additional integration. Optional Basic
|
|
credentials require `SAFETYNET_PROXY_AUTH_HOST` and `SAFETYNET_PROXY_AUTH_PORT`
|
|
to match the selected upstream endpoint, in addition to protected deployment
|
|
username/password variables. They are not distributed in policy bundles.
|
|
|
|
Native evidence: `artifacts/webtransport-native-proof.json`. The receiver got
|
|
zero packets/bytes with the private relay while ordinary HTTP loaded. The
|
|
Windows core DLP and real restart fixtures also passed with relay integration.
|
|
Chromium upgrades must repeat this receiver proof; it is version-specific.
|
|
The native rejection still occurs before HTTP/relay callbacks. A private native
|
|
observer now supplies real lifecycle records for the tested Window/dedicated
|
|
Worker paths through enrollment and policy changes. See
|
|
[native transport observation](native-transport-observability.md). These are
|
|
Created/Closed observations, not inspected-payload decisions or universal
|
|
transport coverage. The relay remains the release boundary.
|
|
|
|
Inspected WebSocket/WebRTC support remains the intended compatibility goal.
|
|
Uninspected transports remain restricted until their content gates have their
|
|
own actual receiver and bypass tests.
|