Protecting web applications from untrusted endpoints using remote browser isolation

A method, comprising:

• receiving at a browser isolation system, a request from a client browser executing on a client device to connect with a remote application;
• providing, by the browser isolation system, a surrogate browser to facilitate communications between the client browser and the remote application in accordance with enforcement of a security policy, wherein the browser isolation system is configured to facilitate the communications at least in part by one of:
• (1) receiving a first data transmission from the client device comprising first data and determining whether to prevent transmission of the first data transmission, on behalf of the client device, to the remote application, based at least in part by applying the security policy to an evaluation of the first data, or
• (2) receiving a second data transmission from the remote application and determining, based on the security policy, to convert at least a portion of the second data transmission prior to transmission, on behalf of the remote application, to the client device, wherein the converting includes unzipping a zipped file;
• and
• enforcing, by the browser isolation system, the security policy.

A computer program product embodied in a non-transitory computer readable medium and comprising computer instructions for:

• receiving at a browser isolation system, a request from a client browser executing on a client device to connect with a remote application;
• providing, by the browser isolation system, a surrogate browser to facilitate communications between the client browser and the remote application in accordance with enforcement of a security policy, wherein the browser isolation system is configured to facilitate the communications at least in part by one of:
• (1) receiving a first data transmission from the client device comprising first data and determining whether to prevent transmission of the first data transmission, on behalf of the client device, to the remote application, based at least in part by applying the security policy to an evaluation of the first data, or
• (2) receiving a second data transmission from the remote application and determining, based on the security policy, to convert at least a portion of the second data transmission prior to transmission, on behalf of the remote application, to the client device, wherein the converting includes unzipping a zipped file;
• and
• enforcing, by the browser isolation system, the security policy.