Method and apparatus for resource locator identifier rewrite
View Patent ↗A method and apparatus for resource locator identifier rewrite have been presented. A security device receives from a resource host over a non-secure hypertext transfer protocol (HTTP) session a response to a request received from a client over a secure HTTP session. The response includes a uniform resource locator (URL) that is supposed to be for a resource host, but the URL does not designate a secure resource access protocol and the resource host requires the secure resource access protocol. The URL is located in the response and modified to designate the secure resource access protocol. After modification, the response is transmitted via the secure resource access protocol session to the client.
1. A method for rewriting resource locator identifiers, the method comprising:
decrypting a request received from a client over a secure hypertext transfer protocol (HTTP) session;
forwarding the decrypted request to a resource host over a non-secure HTTP session;
receiving a response from the resource host over the non-secure HTTP session; and
determining whether a content type of the response is text,
wherein the response is sent directly to the client when the content type is not text, the response sent via the secure resource access protocol, and
wherein the response is modified when the content type is text, the modification comprising:
identifying one or more URLs in the response that does not designate the secure resource protocol;
modifying the URLs to designate the secure resource access protocol,
wherein the response including the modified URLs is sent via the secure resource access protocol session to the client.
2. The method of claim 1 , wherein the URL is modified when the response includes a header indicating “Content-Encoding”.
3. The method of claim 1 , wherein the modification further comprises removing from the response an indication that persistent connection is supported.
4. The method of claim 3 , wherein removing the indication from the response further comprises:
downgrading a version of HTTP indicated in a header of the response; and
modifying a connection field in the header or inserting a new field in the header.
5. The method of claim 1 , further comprising determining that a type of transfer encoding is supported by the resource host.
6. The method of claim 1 , wherein the modification further comprises removing from the response an indication that chunked transfer encoding is supported.
7. The method of claim 6 , wherein removing the indication from the response further comprises downgrading a version of HTTP indicated in a header of the response.
8. The method of claim 1 , wherein the modification further comprises modifying the request to indicate that the requesting client does not support chunked transfer encoding while preserving persistent connection and chunked transfer encoding in the response when the client supports persistent connection and chunked transfer encoding.
9. The method of claim 1 , wherein the modification further comprises modifying the response to prevent the client from using a content length indicated in the response.
10. A non-transitory machine-readable medium that provides instructions, executable by a set of one or more processors in a network security device to perform a method for rewriting resource locator identifiers, the method comprising:
decrypting a request received from a client over a secure hypertext transfer protocol (HTTP) session;
forwarding the decrypted request to a resource host over a non-secure HTTP session;
receiving a response from the resource host over the non-secure HTTP session; and
determining whether a content type of the response is text,
wherein the response is sent directly to the client when the content type is not text, the response sent via the secure resource access protocol and
wherein the response is modified when the content type is text, the modification comprising:
identifying one or more URLs in the response that does not designate the secure resource protocol;
modifying the URLs to designate the secure resource access protocol,
wherein the response including the modified URLs is sent via the secure resource access protocol session to the client.
11. The non-transitory machine-readable medium of claim 10 , wherein the URL is modified when the response includes a header indicating “Content-Encoding”.
12. The non-transitory machine-readable medium of claim 10 , further comprising executable instructions for removing from the response an indication that persistent connection is supported.
13. The non-transitory machine-readable medium of claim 12 , wherein removing the indication from the response further comprises:
downgrading a version of HTTP indicated in a header of the response; and
modifying a connection field in the header or inserting a new field in the header.
14. The non-transitory machine-readable medium of claim 10 , further comprising executable instructions for determining that a type of transfer encoding is supported by the resource host.
15. The non-transitory machine-readable medium of claim 10 , further comprising executable instructions for removing from the response an indication that chunked transfer encoding is supported.
16. The non-transitory machine-readable medium of claim 15 , wherein removing the indication from the response further comprises downgrading the version of HTTP indicated in a header of the response.
17. The non-transitory machine-readable medium of claim 10 , wherein the modification further comprises modifying the request to indicate that the requesting client does not support chunked transfer encoding while preserving persistent connection and chunked transfer encoding in the response when the client supports persistent connection and chunked transfer encoding.
18. The non-transitory machine-readable medium of claim 10 , wherein the modification further comprises modifying the response to prevent the client from using a content length indicated in the response.
19. A network security device comprising:
a set of one or more machine processors for executing instructions stored in memory to decrypt a request received from a client device over a secure hypertext transfer protocol (HTTP) session;
a set of one or more interfaces for:
forwarding the decrypted request to a resource host over a non-secure HTTP session; and
receiving a response from the resource host over the non-secure HTTP session, and
memory storing a resource access protocol module executable by one of the machine processors to:
determine whether a content type of the response is text,
wherein the response is sent directly to the client when the content type is not text, the response sent via the secure resource access protocol, and
wherein the response is modified when the content type is text, the modification comprising:
identifying one or more URLs in the response that does not designate the secure resource protocol;
modifying the URLs to designate the secure resource access protocol,
wherein the response including the modified URLs is sent via the secure resource access protocol session to the client.
20. The network security device of claim 19 , wherein the URL is modified when the response includes a header indicating “Content-Encoding”.