Selectively altering references within encrypted pages using man in the middle

1. A computer-implemented method executed by one or more processors, the method comprising:

receiving, from a client device within a network, a request addressed to a particular resource on a server outside the network;

determining that the request should be redirected to a man-in-the-middle gateway within the network;

redirecting the request to a man-in-the-middle gateway within the network responsive to determining that the request should be redirected;

establishing a first encrypted connection between the client device and the man-in-the-middle gateway, and a second encrypted connection between the man-in-the-middle gateway and the server;

retrieving, by the man-in-the-middle-gateway, the particular resource from the server;

modifying the particular resource into a modified resource by changing pointers within the particular resource to point to a location in a domain associated with the man-in-the-middle gateway within the network; and

serving, by the man-in-the-middle-gateway to the client device, the modified resource.

2. The method of claim 1 , wherein the request is a first request and the client device is a first client device, the method further comprising:

receiving, from a second client device within the network, a second request addressed to the particular resource;

determining that the second request should not be redirected to the man-in-the-middle gateway within the network;

responsive to determining that the second request should not be redirected to the man-in-the-middle gateway, redirecting the second request to a proxy service outside of the network configured to:

establish a third encrypted connection between the second client device and the proxy service, and a fourth encrypted connection between the proxy service and the server;

retrieve the particular resource from the server;

modify the particular resource into a second modified resource by changing pointers within the particular resource; and

serve the second modified resource to the second client device.

3. The method of claim 2 , the method further comprising:

receiving, from a third client device within the network, a third request addressed to an address of a second resource on a second server outside the network; and

routing the request to the address of the second resource.

4. The method of claim 1 , wherein modifying the particular resource into the modified resource comprises modifying the particular resource based on a security policy.

5. The method of claim 1 , wherein modifying the particular resource into the modified resource comprises replacing the resource with a different resource.

6. The method of claim 1 , wherein modifying the particular resource into the modified resource comprises replacing Hypertext Transfer Protocol (HTTP) links in the particular resource with different HTTP links.

7. The method of claim 1 , wherein modifying the particular resource into the modified resource comprises replacing the resource with an HTTP status code object.

8. The method of claim 1 , the method further comprising determining that a security policy of the network identifies the particular resource for inspection upon entry to the network.

9. A system comprising:

a processor configured to execute computer program instructions; and

a tangible, non-transitory computer storage medium encoded with computer program instructions that, when executed by the processor, cause the system to perform operations comprising:

receiving, from a client device within a network, a request addressed to a particular resource on a server outside the network;

determining that the request should be redirected to a man-in-the-middle gateway within the network;

redirecting the request to a man-in-the-middle gateway within the network responsive to determining that the request should be redirected;

establishing a first encrypted connection between the client device and the man-in-the-middle gateway, and a second encrypted connection between the man-in-the-middle gateway and the server;

retrieving, by the man-in-the-middle-gateway, the particular resource from the server;

modifying the particular resource into a modified resource by changing pointers within the particular resource to point to a location in a domain associated with the man-in-the-middle gateway within the network; and

serving, by the man-in-the-middle-gateway to the client device, the modified resource.

10. The system of claim 9 , wherein the request is a first request and the client device is a first client device, the operations further comprising:

receiving, from a second client device within the network, a second request addressed to the particular resource;

determining that the second request should not be redirected to the man-in-the-middle gateway within the network;

responsive to determining that the second request should not be redirected to the man-in-the-middle gateway, redirecting the second request to a proxy service outside of the network.

11. The system of claim 10 , the operations further comprising:

receiving, from a third client device within the network, a third request addressed to an address of a second resource on a second server outside the network; and

routing the request to the address of the second resource.

12. The system of claim 9 , wherein modifying the particular resource into the modified resource comprises modifying the particular resource based on a security policy.

13. The system of claim 9 , wherein modifying the particular resource into the modified resource comprises replacing the resource with a different resource.

14. The system of claim 9 , wherein modifying the particular resource into the modified resource comprises replacing Hypertext Transfer Protocol (HTTP) links in the particular resource with different HTTP links.

15. The system of claim 9 , wherein modifying the particular resource into the modified resource comprises replacing the resource with an HTTP status code object.

16. The system of claim 9 , the operations further comprising determining that a security policy of the network identifies the particular resource for inspection upon entry to the network.

17. A non-transitory computer-readable medium storing instructions operable when executed to cause at least one processor to perform operations comprising:

receiving, from a client device within a network, a request addressed to a particular resource on a server outside the network;

determining that the request should be redirected to a man-in-the-middle gateway within the network;

redirecting the request to a man-in-the-middle gateway within the network responsive to determining that the request should be redirected;

establishing a first encrypted connection between the client device and the man-in-the-middle gateway, and a second encrypted connection between the man-in-the-middle gateway and the server;

retrieving, by the man-in-the-middle-gateway, the particular resource from the server;

modifying the particular resource into a modified resource by changing pointers within the particular resource to point to a location in a domain associated with the man-in-the-middle gateway within the network; and

serving, by the man-in-the-middle-gateway to the client device, the modified resource.

18. The non-transitory computer-readable medium of claim 17 , wherein the request is a first request and the client device is a first client device, the operations further comprising:

receiving, from a second client device within the network, a second request addressed to the particular resource;

determining that the second request should not be redirected to the man-in-the-middle gateway within the network;

responsive to determining that the second request should not be redirected to the man-in-the-middle gateway, redirecting the second request to a proxy service outside of the network configured to:

establish a third encrypted connection between the second client device and the proxy service, and a fourth encrypted connection between the proxy service and the server;

retrieve the particular resource from the server;

modify the particular resource into a second modified resource by changing pointers within the particular resource; and

serve the second modified resource to the second client device.

19. The non-transitory computer-readable medium of claim 18 , the operations further comprising:

receiving, from a third client device within the network, a third request addressed to an address of a second resource on a second server outside the network; and

routing the request to the address of the second resource.

20. The non-transitory computer-readable medium of claim 17 , wherein modifying the particular resource into the modified resource comprises modifying the particular resource based on a security policy.

21. The non-transitory computer-readable medium of claim 17 , wherein modifying the particular resource into the modified resource comprises replacing the resource with a different resource.

22. The non-transitory computer-readable medium of claim 17 , wherein modifying the particular resource into the modified resource comprises replacing Hypertext Transfer Protocol (HTTP) links in the particular resource with different HTTP links.

23. The non-transitory computer-readable medium of claim 17 , wherein modifying the particular resource into the modified resource comprises replacing the resource with an HTTP status code object.

24. The non-transitory computer-readable medium of claim 17 , the operations further comprising determining that a security policy of the network identifies the particular resource for inspection upon entry to the network.