Cloud-based web content processing system providing client threat isolation and data integrity

1. A non-transitory computer-readable medium comprising instructions that, when executed, cause one or more processors to perform the steps of:

receiving a request for resources that are one of web content and a cloud application from a user device;

determining the request requires isolation based on any of policy, category of the web content, type of the user device, and location of the user device, wherein app gating provides the capability to tag/detect endpoint and transparently redirect Software as a Service (SaaS) apps to isolation using a Security Assertion Markup Language (SAML) proxy, wherein the policy is configured to enforce tagging of the user device by generating and sending a cryptographically secure cookie to a native browser of the user device, thereby providing a mechanism to recognize the native browser for the determining;

in response to the request for resources being from the web content that requires isolation, creating an isolated session by rendering the web content associated with the request in a cloud based secure environment that is isolated from the user device and providing image content to the user device based on the web content rendered, the image content based on the web content rendered being graphics files including passive, safe pixels;

in response to the request for resources being the cloud application that requires isolation, creating an isolated session by isolating the cloud application in the cloud based secure environment and providing image content to the user device based on data from the cloud application, the image content based on the data from the cloud application being graphics files including passive, safe pixels; and

taking one or more snapshots at one of regular intervals or before a logout event of a user of cookies and the isolated session created, wherein the snapshots include user-related information and information associated with the isolated session environment, and wherein the snapshots are encrypted and stored for future use.

2. The non-transitory computer-readable medium of claim 1 , wherein the user device executes a web browser that loads the image content utilizing a JavaScript application and that interacts with the image content by sending keyboard and mouse inputs via a WebSocket channel.

3. The non-transitory computer-readable medium of claim 1 , wherein the resources are the cloud application and the user device is one or more of i) located outside an enterprise's network and ii) a non-enterprise device, and the cloud application is provided in isolation to avoid data exfiltration on the user device.

4. The non-transitory computer-readable medium of claim 1 , wherein the determining is performed by a secure web gateway.

5. The non-transitory computer-readable medium of claim 1 , wherein the instructions that, when executed, further cause the one or more processors to perform the steps of

fetching and decrypting one or more snapshots from storage; and

persisting or creating a safe and isolated session of the cloud application in the secure environment, for use after the user device logs out and logs back in based on the cookies and isolated session information in the one or more snapshots.

6. The non-transitory computer-readable medium of claim 1 , wherein the instructions that, when executed, further cause the one or more processors to perform the steps of

receiving a second request for resources that are one of web content and a cloud application from a user device, wherein the request is a first request;

determining the second request does not require isolation,

rendering the first request in isolation in a first tab of a web browser; and

providing access to the second request directly without isolation in a second tab of the same web browser.

7. The non-transitory computer-readable medium of claim 1 , wherein the instructions that, when executed, further cause the one or more processors to perform the steps of

subsequent to a logout or exiting a web browser, for the request, destroying the secure environment.

8. The non-transitory computer-readable medium of claim 1 , wherein the secure environment is a virtual browser in isolation that performs the request, and wherein the instructions that, when executed, further cause the one or more processors to perform the steps of

receiving a response to the request in the virtual browser; and

converting the response to the image content.

9. An apparatus comprising:

one or more processors; and

memory storing instructions that, when executed, cause the one or more processors to

receive a request for resources that are one of web content and a cloud application from a user device;

determine the request requires isolation based on any of policy, category of the web content, type of the user device, and location of the user device, wherein app gating provides the capability to tag/detect endpoint and transparently redirect Software as a Service (SaaS) apps to isolation using a Security Assertion Markup Language (SAML) proxy, wherein the policy is configured to enforce tagging of the user device by generating and sending a cryptographically secure cookie to a native browser of the user device, thereby providing a mechanism to recognize the native browser for the determining;

in response to the request for resources being from the web content that requires isolation, creating an isolated session by rendering the web content associated with the request in a cloud based secure environment that is isolated from the user device and providing image content to the user device based on the web content rendered, the image content based on the web content rendered being graphics files including passive, safe pixels;

in response to the request for resources being the cloud application that requires isolation, creating an isolated session by isolating the cloud application in the cloud based secure environment and providing image content to the user device based on data from the cloud application, the image content based on the data from the cloud application being graphics files including passive, safe pixels; and

take one or more snapshots at one of regular intervals or before a logout event of a user of cookies and the isolated session created, wherein the snapshots include user-related information and information associated with the isolated session environment, and wherein the snapshots are encrypted and stored for future use.

10. The apparatus of claim 9 , wherein the user device executes a web browser that loads the image content utilizing a JavaScript application and that interacts with the image content by sending keyboard and mouse inputs via a WebSocket channel.

11. The apparatus of claim 9 , wherein the resources are the cloud application and the user device is one or more of i) located outside an enterprise's network and ii) a non-enterprise device, and the cloud application is provided in isolation to avoid data exfiltration on the user device.

12. The apparatus of claim 9 , wherein the apparatus is a secure web gateway.

13. The apparatus of claim 9 , wherein the instructions that, when executed, further cause the one or more processors to

fetch and decrypt one or more snapshots from storage; and

persist or create a safe and isolated session of the cloud application in the secure environment, for use after the user device logs out and logs back in based on the cookies and isolated session information in the one or more snapshots.

14. The apparatus of claim 9 , wherein the instructions that, when executed, further cause the one or more processors to

receive a second request for resources that are one of web content and a cloud application from a user device, wherein the request is a first request;

determine the second request does not require isolation;

render the first request in isolation in a first tab of a web browser; and

provide access to the second request directly without isolation in a second tab of the same web browser.

15. The apparatus of claim 9 , wherein the instructions that, when executed, further cause the one or more processors to

subsequent to a logout or exiting a web browser, for the request, destroy the secure environment.

16. The apparatus of claim 9 , wherein the secure environment is a virtual browser in isolation that performs the request, and wherein the instructions that, when executed, further cause the one or more processors to

receive a response to the request in the virtual browser; and

convert the response to the image content.

17. A method comprising:

receiving a request for resources that are one of web content and a cloud application from a user device;

determining the request requires isolation based on any of policy, category of the web content, type of the user device, and location of the user device, wherein app gating provides the capability to tag/detect endpoint and transparently redirect Software as a Service (SaaS) apps to isolation using a Security Assertion Markup Language (SAML) proxy, wherein the policy is configured to enforce lagging of the user device by generating and sending a cryptographically secure cookie to a native browser of the user device, thereby providing a mechanism to recognize the native browser for the determining;

in response to the request for resources being from the web content that requires isolation, creating an isolated session by rendering the web content associated with the request in a cloud based secure environment that is isolated from the user device and providing image content to the user device based on the web content rendered, the image content based on the web content rendered being graphics files including passive, safe pixels;

in response to the request for resources being the cloud application that requires isolation, creating an isolated session by isolating the cloud application in the cloud based secure environment and providing image content to the user device based on data from the cloud application, the image content based on the data from the cloud application being graphics files including passive, safe pixels; and

taking one or more snapshots at one of regular intervals or before a logout event of a user of cookies and the isolated session created, wherein the snapshots include user-related information and information associated with the isolated session environment, and wherein the snapshots are encrypted and stored for future use.

18. The method of claim 17 , wherein the user device executes a web browser that loads the image content utilizing a JavaScript application and that interacts with the image content by sending keyboard and mouse inputs via a WebSocket channel.

19. The method of claim 17 , wherein the resources are the cloud application and the user device is one or more of i) located outside an enterprise's network and ii) a non-enterprise device, and the cloud application is provided in isolation to avoid data exfiltration on the user device.

20. The method of claim 17 , further comprising

receiving a second request for resources that are one of web content and a cloud application from a user device, wherein the request is a first request;

determining the second request does not require isolation;

rendering the first request in isolation in a first tab of a web browser, and

providing access to the second request directly without isolation in a second tab of the same web browser.