Method and apparatus for resource locator identifier rewrite
View Patent ↗A method for resource locator identifier rewrite in which a network security proxy insures that a resource locator identifier of a response indicates a resource access protocol that should govern a corresponding request. A security device receives from a resource host over a non-secure hypertext transfer protocol (HTTP) session a response to a request received from a client over a secure HTTP session. The response includes a uniform resource locator (URL) that is supposed to be for a resource host, but the URL does not designate a secure resource access protocol and the resource host requires the secure resource access protocol. The URL is located in the response and modified to designate the secure resource access protocol. After modification, the response is transmitted via the secure resource access protocol session to the client.
1. A method in a network device comprising:
determining if a resource locator identifier (RLI) in a response indicates an appropriate request governing resource access protocol, wherein the appropriate request governing resource access protocol is the resource access protocol to govern a request for a resource indicated by the RLI, wherein the appropriate request governing resource access protocol is determined from a configuration file; and
rewriting the RLI to indicate the appropriate request governing resource access protocol if the RLI does not indicate the appropriate request governing resource access protocol; and
preventing a client that receives the response from relying on the content length indicated in the response by effectively removing a content length field in the response, wherein effectively removing the content length field comprises modifying the content length field in the response to be unrecognizable.
2. The method of claim 1 wherein the appropriate request governing resource access protocol is a secure resource access protocol.
3. The method of claim 1 wherein the appropriate request governing resource access protocol is a non-secure resource access protocol.
4. A method in a network device comprising:
modifying a response with a resource locator identifier (RLI) to indicate a first resource access protocol if the RLI indicates a second resource access protocol and the network device has been configured to insure that a request for a resource indicated by the RLI is in accordance with the first resource access protocol;
effectively removing a content length field in the response, wherein effectively removing the content length field comprises modifying the content length field in the response to be unrecognizable; and
transmitting the modified response to a client.
5. The method of claim 4 wherein the first resource access protocol is a secure resource access protocol and the second resource access protocol is a non-secure resource access protocol.
6. The method of claim 4 further comprising disabling persistent connection and chunked transfer encoding.
7. The method of claim 4 further comprising:
preserving persistent connection and chunked transfer encoding features available to the client; and
disabling chunked transfer encoding features for a resource host transmitting the response.
8. A method in a network security device comprising:
receiving a response with a resource locator identifier (RLI) that indicates a first resource access protocol;
determining that the first resource access protocol should not govern a request for a resource indicated by the RLI;
rewriting the RLI to indicate a second resource access protocol that should govern the request;
encapsulating a set of one or more fragments of the response with transport layer information;
effectively removing a content length field in the response, wherein effectively removing the content length field comprises modifying the content length field in the response to be unrecognizable; and
transmitting the encapsulated set of fragments to a client.
9. The method of claim 8 wherein rewriting the RLI includes adding port information to the RLI.
10. The method of claim 8 wherein the first resource access protocol is a secure resource access protocol and the second resource access protocol is a non-secure resource access protocol.
11. The method of claim 8 further comprising disabling persistent connection and chunked transfer encoding.
12. The method of claim 8 further comprising:
preserving persistent connection and chunked transfer encoding features available to the client; and
disabling chunked transfer encoding features for a resource host transmitting the response.
13. A machine-readable medium that provides instructions, executable by a set of one or more processors to cause said set of processors to perform operations comprising:
receiving a resource response message;
scanning the resource response message for a set of one or more resource locator identifiers and determining if each of the set of resource locator identifiers indicates a resource access protocol that should govern a request for their indicated resource;
rewriting those of the set of resource locator identifiers that are determined to not indicate the resource access protocol that should govern a request for their indicated resource to indicate an appropriate request governing resource access protocol; and
effectively removing a content length indicated in the resource response message, wherein effectively removing the content length field comprises modifying the content length field in the resource response message to be unrecognizable.
14. The machine-readable medium of claim 13 further comprising transmitting the response without scanning and rewriting if the content type of the response is not text.
15. The machine-readable medium of claim 13 further comprising transmitting the response without scanning and rewriting if the header of the response does not include a content encoding field.
16. The machine-readable medium of claim 13 wherein rewriting the set of resource locator identifiers comprises including a corresponding port.
17. The machine-readable medium of claim 13 wherein determining comprises comparing the resource host identifier of each of the set of resource locator identifiers against a configuration file that designates appropriate request governing resource access protocols for resource hosts.
18. A machine-readable medium that provides instructions, executable by a set of one or more processors to cause said set of processors to perform operations comprising:
determining if a resource locator identifier (RLI) in a response indicates an appropriate request governing resource access protocol, wherein the appropriate request governing resource access protocol is the resource access protocol to govern a request for a resource indicated by the RLI, wherein the appropriate request governing resource access protocol is determined from a configuration file; and
rewriting the RLI to indicate the appropriate request governing resource access protocol if the RLI does not indicate the appropriate request governing resource access protocol; and
preventing a client that receives the response from relying on the content length indicated in the response by effectively removing a content length field in the response, wherein effectively removing the content length field comprises modifying the content length field in the response to be unrecognizable.
19. The machine-readable medium of claim 18 wherein the appropriate request governing resource access protocol is a secure resource access protocol.
20. The machine-readable medium of claim 18 wherein the appropriate request governing resource access protocol is a non-secure resource access protocol.
21. A machine-readable medium that provides instructions, executable by a set of one or more processors to cause said set of processors to perform operations comprising:
modifying a response with a resource locator identifier (RLI) to indicate a first resource access protocol if the RLI indicates a second resource access protocol and the network device has been configured to insure that a request for a resource indicated by the RLI is in accordance with the first resource access protocol;
effectively removing the content length field in the response, wherein effectively removing the content length field comprises modifying the content length field in the response to be unrecognizable; and
transmitting the modified response to a client.
22. The machine-readable medium of claim 21 wherein the first resource access protocol is a secure resource access protocol and the second resource access protocol is a non-secure resource access protocol.
23. The machine-readable medium of claim 21 further comprising disabling persistent connection and chunked transfer encoding.
24. The machine-readable medium of claim 21 further comprising:
preserving persistent connection and chunked transfer encoding features available to the client; and
disabling chunked transfer encoding features for a resource host transmitting the response.