Granted Patent B2

US 12,500,935 · App. 18/066,842 · Granted Dec 16, 2025

Inventors: Itamar Azulay (Mishmar Ayalon, IL); Nitzan Frogel (Tel Aviv, IL); Meir Baruch Blachman (Beer-Sheva, IL); Tomer Cherni (Gany Tikva, IL)

Assignee: MICROSOFT TECHNOLOGY LICENSING, LLC

H04L63/20H04L63/10

Abstract

Claims (78)

1 . A computing device that includes a proxy server, the proxy server comprising:

a processor; and

a memory device that stores program code structured to cause the processor to:

receive a request associated with a client web browser, the request comprising a request header and a request body;

receive a response associated with a web server, the response comprising a response header and a response body, the response header indicating a response header context and the response body indicating a response body context;

inspect the response header for the response header context;

inspect the response body for the response body context;

determine, based at least on context detection rules, whether to mark the response header to indicate the response header context;

determine, based at least on the context detection rules, whether to mark the response body to indicate the response body context; and

forward to the client a response indicating at least one of the response header context or the response body context.

2 . The computing device of claim 1 ,

wherein at least one of the response header context or the response body context indicates the restricted context; and

wherein at least one of the response header context or the response body context indicates an unrestricted context.

3 . The computing device of claim 2 ,

wherein the restricted context indicates a download action; and

wherein the unrestricted context indicates a webpage rendering resource.

4 . The computing device of claim 2 ,

wherein the unrestricted context in the response header context indicates whether a navigation response header in the response corresponds to a navigate resource; and

wherein the unrestricted context in the response body context indicates whether resource indicators in the response correspond to hypertext markup language (HTML) resources, JavaScript resources, style sheet resources, or image resources.

5 . The computing device of claim 1 , wherein the request is created based at least on the forwarded response.

6 . The computing device of claim 1 , wherein the program code is further structured to cause the processor to:

inspect the request header for an indication of a request context;

enforce a policy against the request in response to a determination the indication of the request context indicates a restricted context; and

inject code into the forwarded response, wherein the injected code is configured to cause the client web browser to mark the request with at least a portion of the request context.

7 . The computing device of claim 6 , wherein the injected code is configured to cause the client web browser to mark the request with at least a portion of the request context for dynamically generated request content.

8 . The computing device of claim 6 , wherein the injected code is configured to cause the client web browser to mark the request with at least a portion of the request context in response to a determination the request is captured by a client-side service worker.

9 . The computing device of claim 1 , wherein the program code is further structured to cause the processor to:

inspect the request header for an indication of a request context;

enforce a policy against the request in response to a determination the indication of the request context indicates a restricted context;

receive a plurality of requests associated with a plurality of client web browsers, including the request, where the request comprises a fetch metadata request header and at least one of the other plurality of requests does not comprise a fetch metadata request header; and

map an indication in the fetch metadata request header to the restricted context or to an unrestricted context.

10 . The computing device of claim 1 , wherein the client is an unmanaged client.

11 . A computer-implemented method comprising:

receiving a request associated with a client web browser, the request comprising a request header and a request body;

receiving a response associated with a web server, the response comprising a response header and a response body, the response header indicating a response header context and the response body indicating a response body context;

inspecting the response header for the response header context;

inspecting the response body for the response body context;

determining based at least on context detection rules whether to:

mark the response header to indicate the response header context;

mark the response body to indicate the response body context; or

inject code into the response, wherein the injected code is configured to cause the client web browser to mark the request with at least a portion of the request context; and

forwarding to the client a response indicating at least one of the response header context, the response body context, or including the injected code.

12 . The computer-implemented method of claim 11 ,

wherein at least one of the response header context or the response body context indicates, by marking or not marking, a download action; and

wherein at least one of the response header context or the response body context indicates, by marking or not marking, a webpage rendering resource.

13 . The computer-implemented method of claim 11 ,

wherein the header context indicates whether a navigation response header in the response corresponds to a navigate resource; and

wherein the response body context indicates whether resource indicators in the response correspond to hypertext markup language (HTML) resources, JavaScript resources, style sheet resources, or image resources.

14 . The computer-implemented method of claim 11 , further comprising:

inspecting the request header for an indication of a request context; and

enforcing a policy against the request in response to a determination the indication of the request context indicates a restricted context;

wherein the injected code is configured to cause the client web browser to mark the request with at least a portion of the request context for dynamically generated request content.

15 . The computer-implemented method of claim 11 , further comprising:

inspecting the request header for an indication of a request context; and

enforcing a policy against the request in response to a determination the indication of the request context indicates a restricted context;

wherein the injected code is configured to cause the client web browser to mark the request with at least a portion of the request context in response to a determination the request is captured by a client-side service worker.

16 . The computer-implemented method of claim 11 , further comprising:

inspecting the request header for an indication of a request context;

enforcing a policy against the request in response to a determination the indication of the request context indicates a restricted context;

receiving a plurality of requests associated with a plurality of client web browsers, including the request, where the request comprises a fetch metadata request header and at least one of the other plurality of requests does not comprise a fetch metadata request header; and

mapping an indication in the fetch metadata request header to the restricted context or to an unrestricted context.

17 . A computer-readable storage medium having program instructions recorded thereon that, when executed by a processing circuit, perform a method comprising:

receiving a request associated with a client web browser, the request comprising a request header and a request body;

inspecting the request header for an indication of a request context;

enforcing a policy against the request in response to a determination the indication of the request context indicates a restricted context;

receiving a response associated with a web server, the response comprising a response header and a response body, the response header indicating a response header context and the response body indicating a response body context;

inspecting the response header for the response header context;

inspecting the response body for the response body context;

determining based at least on context detection rules to inject code into a forwarded response, wherein the injected code is configured to cause the client web browser to mark the request with at least a portion of the request context; and

forwarding to the client a response indicating the injected code.

18 . The computer-readable storage medium of claim 17 ,

wherein at least one of the response header context or the response body context indicates, by marking or not marking, a download action; and

wherein at least one of the response header context or the response body context indicates, by marking or not marking, a webpage rendering resource.

19 . The computer-readable storage medium of claim 17 ,

wherein the header context indicates whether a navigation response header in the response corresponds to a navigate resource; and

wherein the response body context indicates whether resource indicators in the response correspond to hypertext markup language (HTML) resources, JavaScript resources, style sheet resources, or image resources.

20 . The computer-readable storage medium of claim 17 , the method further comprising:

receiving a plurality of requests associated with a plurality of client web browsers, including the request, where the request comprises a fetch metadata request header and at least one of the other plurality of requests does not comprise a fetch metadata request header; and mapping an indication in the fetch metadata request header to the restricted context or to an unrestricted context.

Assignments (1)

Continuity (1)

References Cited (31)