Reauthentication for zero trust WebSocket connections
Systems and methods for providing a smart reauthentication process for prolonged WebSocket sessions which may present a risk to cloud environments. The various embodiments can include monitoring a WebSocket session associated with a user, detecting one or more triggers associated with an authentication of the WebSocket session, and initiating an authentication process based on the one or more triggers. The authentication process can disconnect an existing WebSocket session and force the user to reauthenticate in order to continue the session.
1 . A method comprising steps of:
monitoring a WebSocket session associated with a user;
detecting one or more triggers associated with an authentication of the WebSocket session; and
initiating an authentication process based on the one or more triggers, wherein the authentication process includes:
receiving, at a customized browser Java script executing in a browser of the user, an explicit reauthentication expiry message produced by a service server endpoint;
disconnecting the WebSocket session in response to the customized browser Java script interpreting the explicit reauthentication expiry message; and
forcing the user to reauthenticate,
wherein (i) the explicit reauthentication expiry message is an explicit WebSocket message that identifies expiration of a preconfigured authentication timeout for an authenticated session, (ii) the customized browser Java script, in response to interpreting the explicit reauthentication expiry message, initiates an HTTP reauthentication flow via one or more HTTP redirects, and (iii) the WebSocket session is disconnected prior to completion of the HTTP reauthentication flow.
2 . The method of claim 1 , wherein the user is prompted to reauthenticate with HTTP redirects.
3 . The method of claim 1 , wherein the user is allowed to upgrade a newly authenticated session to a WebSocket connection.
4 . The method of claim 1 , wherein the one or more triggers include the explicit reauthentication expiry message.
5 . The method of claim 1 , wherein the steps are performed within a cloud-based system utilizing a zero trust architecture.
6 . A non-transitory computer-readable medium comprising instructions that, when executed, cause one or more processors to perform steps of:
monitoring a WebSocket session associated with a user;
detecting one or more triggers associated with an authentication of the WebSocket session; and
initiating an authentication process based on the one or more triggers, wherein the authentication process includes:
receiving, at a customized browser Java script executing in a browser of the user, an explicit reauthentication expiry message produced by a service server endpoint;
disconnecting the WebSocket session in response to the customized browser Java script interpreting the explicit reauthentication expiry message; and
forcing the user to reauthenticate,
wherein (i) the explicit reauthentication expiry message is an explicit WebSocket message that identifies expiration of a preconfigured authentication timeout for an authenticated session, (ii) the customized browser Java script, in response to interpreting the explicit reauthentication expiry message, initiates an HTTP reauthentication flow via one or more HTTP redirects, and (iii) the WebSocket session is disconnected prior to completion of the HTTP reauthentication flow.
7 . The non-transitory computer-readable medium of claim 6 , wherein the user is prompted to reauthenticate with HTTP redirects.
8 . The non-transitory computer-readable medium of claim 6 , wherein the user is allowed to upgrade a newly authenticated session to a WebSocket connection.
9 . The non-transitory computer-readable medium of claim 6 , wherein the one or more triggers include the explicit reauthentication expiry message.
10 . The non-transitory computer-readable medium of claim 6 , wherein the steps are performed within a cloud-based system utilizing a zero trust network architecture.
11 . A cloud-based system comprising:
one or more processors and memory storing instructions that, when executed, cause the one or more processors to:
monitor a WebSocket session associated with a user;
detect one or more triggers associated with an authentication of the WebSocket session; and
initiate an authentication process based on the one or more triggers, wherein the authentication process includes:
receiving, at a customized browser Java script executing in a browser of the user, an explicit reauthentication expiry message produced by a service server endpoint;
disconnecting the WebSocket session in response to the customized browser Java script interpreting the explicit reauthentication expiry message; and
forcing the user to reauthenticate,
wherein (i) the explicit reauthentication expiry message is an explicit WebSocket message that identifies expiration of a preconfigured authentication timeout for an authenticated session, (ii) the customized browser Java script, in response to interpreting the explicit reauthentication expiry message, initiates an HTTP reauthentication flow via one or more HTTP redirects, and (iii) the WebSocket session is disconnected prior to completion of the HTTP reauthentication flow.
12 . The cloud-based system of claim 11 , wherein the user is prompted to reauthenticate with HTTP redirects.
13 . The cloud-based system of claim 11 , wherein the user is allowed to upgrade a newly authenticated session to a WebSocket connection.
14 . The cloud-based system of claim 11 , wherein the one or more triggers include the explicit reauthentication expiry message.
15 . The method of claim 1 , wherein the steps further comprise, subsequent to disconnecting the WebSocket session in response to the customized browser Java script interpreting the explicit reauthentication expiry message and upon successful reauthentication, reestablishing the WebSocket session by upgrading a newly authenticated HTTP session to a WebSocket connection,
wherein the upgrading comprises establishing the newly authenticated HTTP session via the one or more HTTP redirects and then initiating a WebSocket upgrade handshake using the newly authenticated HTTP session.
16 . The method of claim 1 , wherein the WebSocket session is part of a clientless browser-based session for privileged remote access via a cloud-based system,
wherein the clientless browser-based session provides zero trust access to an end system over a zero trust network architecture model.
17 . The method of claim 1 , wherein the explicit reauthentication expiry message is produced upon detecting expiration of a preconfigured authentication timeout for the authenticated session,
wherein the service server endpoint is enhanced to detect the expiration of the preconfigured authentication timeout and to produce the explicit reauthentication expiry message in response to the detecting.
18 . The method of claim 1 , wherein the service server endpoint is accessed via a service edge node that is an enforcement node of a cloud-based system,
wherein the enforcement node is configured to execute policy for the user based on policy received from a central authority.
19 . The method of claim 1 , wherein the steps further comprise enforcing policy in supplement to the reauthentication, the policy being tenant-specific policy calculated by a central authority and distributed as a highly compressed bitmap to enforcement nodes of a cloud-based system,
wherein enforcing the policy comprises, at the enforcement node, applying the tenant-specific policy to traffic associated with the clientless browser-sed session.
20 . The method of claim 1 , wherein the authentication process further comprises triggering a restart of the authentication process after detecting an expired authentication,
wherein detecting the expired authentication comprises the customized browser Java script detecting the explicit reauthentication expiry message and, in response, initiating the HTTP reauthentication flow via the one or more HTTP redirects.