Managing content uploads
Providing policy check functionality to file uploads is disclosed. An attempted file upload is detected at a browser isolation system. A user of a client is prompted to provide a credential associated with the file and usable to access contents of the file. A policy is applied to the file upload.
1. A system, comprising:
a processor configured to:
receive, at a browser isolation system situated between: (1) a client device that is part of an enterprise network, and (2) a server, an indication that a user of a browser executing on the client device is attempting to upload a first file to a destination website served by the server;
obtain a copy of the first file from the client device;
prompt, in response to determining by the browser isolation system that a credential is required for the browser isolation system to access contents of the first file, the user of the client device for the credential in the browser;
determine a policy to apply to the user's attempted upload of the first file to the destination website, wherein applying the policy includes determining, by the browser isolation system, that the first file should be transmitted to a service configured to alter the first file in accordance with a requirement specified by an administrator of the enterprise network and transmitting the first file to the service, wherein the service is configured to: selectively perform at least one of: (1) adding material to or (2) deleting material from contents of the first file to from the modified version of the first file; and
receive the modified version of the first file from the service and transmit, by the browser isolation system, the modified version of the first file to the server; and
a memory coupled to the processor and configured to provide the processor with instructions.
2. The system of claim 1 , wherein prompting the user of the client device for the credential includes serving a password entry portal page by the browser isolation system to the browser executing on the client device.
3. The system of claim 1 , wherein determining that the credential is required for the browser isolation system to access the contents of the first file includes determining that the first file is encrypted.
4. The system of claim 3 , wherein the processor is further configured to decrypt the first file using the credential.
5. The system of claim 1 , wherein applying the policy includes making the contents of the first file accessible to an auditor.
6. The system of claim 1 , wherein the service is configured to redact a type of information from the first file.
7. The system of claim 1 , wherein the modified version of the first file is generated from the first file by a third party utility.
8. The system of claim 1 , wherein the processor is configured to transmit a decrypted copy of the first file to an external server and receive, from the external server, the modified version of the first file.
9. The system of claim 1 , wherein applying the policy includes determining a categorization of the destination website.
10. The system of claim 1 , wherein the user is prompted using a thin client executing in the browser.
11. The system of claim 1 , wherein the first file comprises an archive and wherein the processor is configured to determine that an included file contained within the archive is encrypted and in response to determining that the included file contained within the archive is encrypted, prompt the user for a credential associated with the included file contained within the archive.
12. The system of claim 1 , wherein determining the policy to apply to the user's attempted upload of the first file to the destination website includes determining that the first file be archived by the browser isolation system.
13. The system of claim 1 , wherein the service is configured to add a watermark to the first file.
14. A method, comprising:
receiving, at a browser isolation system situated between: (1) a client device that is part of an enterprise network, and (2) a server, an indication that a user of a browser executing on the client device is attempting to upload a first file to a destination website served by the server;
obtaining a copy of the first file from the client device;
prompting, in response to determining by the browser isolation system that a credential is required for the browser isolation system to access contents of the first file, the user of the client device for the credential in the browser;
determining a policy to apply to the user's attempted upload of the first file to the destination website, wherein applying the policy includes determining, by the browser isolation system, that the first file should be transmitted to a service configured to alter the first file in accordance with a requirement specified by an administrator of the enterprise network and transmitting the first file to the service, wherein the service is configured to: selectively perform at least one of: (1) adding material to or (2) deleting material from the contents of the first file to form a modified version of the first file; and
receiving the modified version of the first file from the service and transmitting, by the browser isolation system the modified version of the first file to the server.
15. A computer program product embodied in a non-transitory computer readable storage medium and comprising computer instructions for:
receiving, at a browser isolation system situated between: (1) a client device that is part of an enterprise network, and (2) a server, an indication that a user of a browser executing on the client device is attempting to upload a first file to a destination website served by the server;
obtaining a copy of the first file from the client device;
prompting, in response to determining by the browser isolation system that a credential is required for the browser isolation system to access contents of the first file, the user of the client device for the credential in the browser;
determining a policy to apply to the user's attempted upload of the first file to the destination website, wherein applying the policy includes determining, by the browser isolation system, that the first file should be transmitted to a service configured to alter the first file in accordance with a requirement specified by an administrator of the enterprise network and transmitting the first file to the service, wherein the service is configured to: selectively perform at least one of: (1) adding material to or (2) deleting material from the contents of the first file to form a modified version of the first file; and
receiving the modified version of the first file from the service and transmitting, by the browser isolation system, the modified version of the first file to the server.
16. The method of claim 15 , wherein the service is configured to redact a type of information from the first file.
17. The method of claim 15 , wherein prompting the user of the client device for the credential includes serving a password entry portal page by the browser isolation system to the browser executing on the client device.
18. The method of claim 15 , wherein determining that the credential is required for the browser isolation system to access the contents of the first file includes determining that the first file is encrypted.
19. The method of claim 18 , further comprising decrypting the first file using the credential.
20. The method of claim 15 , wherein applying the policy includes making the contents of the first file accessible to an auditor.
21. The method of claim 15 , wherein the modified version of the first file is generated from the first file by a third party utility.
22. The method of claim 15 , further comprising transmitting a decrypted copy of the first file to an external server and receiving, from the external server, the modified version of the first file.
23. The method of claim 15 , wherein applying the policy includes determining a categorization of the destination website.
24. The method of claim 15 , wherein the user is prompted using a thin client executing in the browser.
25. The method of claim 15 , wherein the first file comprises an archive, determining that an included file contained within the archive is encrypted, and in response to determining that the included file contained within the archive is encrypted, prompting the user for a credential associated with the included file contained within the archive.
26. The method of claim 15 , wherein determining the policy to apply to the user's attempted upload of the first file to the destination website includes determining that the first file be archived by the browser isolation system.
27. The method of claim 15 , wherein the service is configured to add a watermark to the first file.