2.4 KiB
Windows browser transport containment
Electron's HTTP request hooks do not intercept WebTransport payloads. A native receiver test with Electron 44.7.0 demonstrated data from both a page and a dedicated worker bypassing those hooks, including with the tested QUIC/Blink disable flags. The implementation therefore forces every managed browser URL through a private non-DIRECT Chromium proxy, with implicit loopback bypass removed. The tested Chromium HTTP/3 WebTransport client rejects that proxy route before opening its UDP connection. Ordinary HTTP and HTTPS remain available.
local-dlp-relay.cjs binds numeric loopback only and authenticates Chromium with
an ephemeral capability. It forwards approved HTTP or CONNECT traffic; it is not
a replacement for the native content-DLP gates. Native hooks still inspect text,
files and headers before release. Policy replacement, quarantine and shutdown
invalidate relay authority and terminate pending/live sockets. Resolution uses
the approved Chromium resolver and numeric connection addresses.
The management session retains the centrally configured system/fixed/PAC proxy.
The relay resolves upstream routes through that session. DIRECT, HTTP PROXY and
HTTPS PROXY routes are supported; an unsupported or failed route never silently
falls back to DIRECT. SOCKS and integrated upstream NTLM/Kerberos authentication
currently fail closed and require an additional integration. Optional Basic
credentials require SAFETYNET_PROXY_AUTH_HOST and SAFETYNET_PROXY_AUTH_PORT
to match the selected upstream endpoint, in addition to protected deployment
username/password variables. They are not distributed in policy bundles.
Native evidence: artifacts/webtransport-native-proof.json. The receiver got
zero packets/bytes with the private relay while ordinary HTTP loaded. The
Windows core DLP and real restart fixtures also passed with relay integration.
Chromium upgrades must repeat this receiver proof; it is version-specific.
WebTransport-specific denial audit events are not yet observed because the
native rejection occurs before existing HTTP/relay callbacks. Do not claim
complete transport-attempt SIEM coverage from the ordinary DLP event pipeline.
Inspected WebSocket/WebRTC support remains the intended compatibility goal. Uninspected transports remain restricted until their content gates have their own actual receiver and bypass tests.