Non-HTTP layer 7 protocol applications running in the browser
Layer 7 protocol (non-HTTP) client applications are executed in the browser. The non-HTTP layer 7 protocol client application connects to a compute server that proxies layer 4 packets to the origin network that has the non-HTTP layer 7 protocol service. As an example, an SSH client (a non-HTTP layer 7 protocol) can execute in the browser and the TCP packets (layer 4 packets) are proxied by a compute server to the origin network that has the appropriate SSH server. The non-HTTP layer 7 protocol client application allows users to run commands or otherwise interact with the client as if they were using a native application (one that is not executed within the browser) without any client-side configuration or agent.
1. A method, comprising:
receiving, at a compute server from a browser executing on a client device, an HTTP request for a resource identified at a domain;
determining, based on a set of one or more policies configured for the domain, that the HTTP request is allowed to be processed;
transmitting, to the browser executing on the client device, a response to the HTTP request, wherein the response includes code that when executed by the browser executing on the client device, executes a non-HTTP layer 7 protocol client that communicates with a non-HTTP layer 7 protocol service at an external network;
receiving, from the non-HTTP layer 7 protocol client executing in the browser, data related to the non-HTTP layer 7 protocol service; and
proxying the data related to the non-HTTP layer 7 protocol service over a layer 4 tunnel that is interfaced with the non-HTTP layer 7 protocol service.
2. The method of claim 1 , wherein the code is in a WebAssembly format.
3. The method of claim 1 , wherein the non-HTTP layer 7 protocol client is a Secure Shell Protocol (SSH) client, wherein the non-HTTP layer 7 protocol service is a SSH server, and wherein the SSH client executes in a tab of the browser.
4. The method of claim 1 , further comprising:
logging event data received from the non-HTTP layer 7 protocol client executing in the browser.
5. The method of claim 1 , wherein the data related to the non-HTTP layer 7 protocol service is received over a WebSocket between the browser and the compute server.
6. The method of claim 1 , wherein the set of one or more policies are based on one or more of identity, device posture, location, and/or risk signals.
7. The method of claim 1 , further comprising:
authenticating a user of the non-HTTP layer 7 protocol client with the non-HTTP layer 7 protocol service.
8. The method of claim 7 , wherein authenticating the user includes performing one of: presenting a login prompt, presenting a prompt for a public key, and automatically performing a certificate generation and authentication.
9. A non-transitory machine-readable storage medium that provides instructions that, if executed by a processor, will cause said processor to perform the following operations:
receiving, at a compute server from a browser executing on a client device, an HTTP request for a resource identified at a domain;
determining, based on a set of one or more policies configured for the domain, that the HTTP request is allowed to be processed;
transmitting, to the browser executing on the client device, a response to the HTTP request, wherein the response includes code that when executed by the browser executing on the client device, executes a non-HTTP layer 7 protocol client that communicates with a non-HTTP layer 7 protocol service at an external network;
receiving, from the non-HTTP layer 7 protocol client executing in the browser, data related to the non-HTTP layer 7 protocol service; and
proxying the data related to the non-HTTP layer 7 protocol service over a layer 4 tunnel that is interfaced with the non-HTTP layer 7 protocol service.
10. The non-transitory machine-readable storage medium of claim 9 , wherein the code is in a WebAssembly format.
11. The non-transitory machine-readable storage medium of claim 9 , wherein the non-HTTP layer 7 protocol client is a Secure Shell Protocol (SSH) client, wherein the non-HTTP layer 7 protocol service is a SSH server, and wherein the SSH client executes in a tab of the browser.
12. The non-transitory machine-readable storage medium of claim 9 , wherein the operations further comprise:
logging event data received from the non-HTTP layer 7 protocol client executing in the browser.
13. The non-transitory machine-readable storage medium of claim 9 , wherein the data related to the non-HTTP layer 7 protocol service is received over a WebSocket between the browser and the compute server.
14. The non-transitory machine-readable storage medium of claim 9 , wherein the set of one or more policies are based on one or more of identity, device posture, location, and/or risk signals.
15. The non-transitory machine-readable storage medium of claim 9 , wherein the operations further comprise:
authenticating a user of the non-HTTP layer 7 protocol client with the non-HTTP layer 7 protocol service.
16. The non-transitory machine-readable storage medium of claim 15 , wherein authenticating the user includes performing one of: presenting a login prompt, presenting a prompt for a public key, and automatically performing a certificate generation and authentication.
17. A server, comprising:
a processor; and
a non-transitory machine-readable storage medium that provides instructions that, if executed by the processor, will cause the server to perform the following operations:
receiving, at a compute server from a browser executing on a client device, an HTTP request for a resource identified at a domain;
determining, based on a set of one or more policies configured for the domain, that the HTTP request is allowed to be processed;
transmitting, to the browser executing on the client device, a response to the HTTP request, wherein the response includes code that when executed by the browser executing on the client device, executes a non-HTTP layer 7 protocol client that communicates with a non-HTTP layer 7 protocol service at an external network;
receiving, from the non-HTTP layer 7 protocol client executing in the browser, data related to the non-HTTP layer 7 protocol service; and
proxying the data related to the non-HTTP layer 7 protocol service over a layer 4 tunnel that is interfaced with the non-HTTP layer 7 protocol service.
18. The server of claim 17 , wherein the code is in a WebAssembly format.
19. The server of claim 17 , wherein the non-HTTP layer 7 protocol client is a Secure Shell Protocol (SSH) client, wherein the non-HTTP layer 7 protocol service is a SSH server, and wherein the SSH client executes in a tab of the browser.
20. The server of claim 17 , wherein the operations further comprise:
logging event data received from the non-HTTP layer 7 protocol client executing in the browser.
21. The server of claim 17 , wherein the data related to the non-HTTP layer 7 protocol service is received over a WebSocket between the browser and the compute server.
22. The server of claim 17 , wherein the set of one or more policies are based on one or more of identity, device posture, location, and/or risk signals.
23. The server of claim 17 , wherein the operations further comprise:
authenticating a user of the non-HTTP layer 7 protocol client with the non-HTTP layer 7 protocol service.
24. The server of claim 23 , wherein authenticating the user includes performing one of: presenting a login prompt, presenting a prompt for a public key, and automatically performing a certificate generation and authentication.