Systems and methods for inline hypertext transfer protocol (HTTP) cookie encryption
AssigneeZscaler, Inc.
InventorYaroslav Rosomakho
Life of this patent
Estimating the term…
Abstract
Systems and methods for inline HTTP cookie encryption include responsive to a user authenticating to a web service, intercepting a response form the web service; encrypting an HTTP cookie in the response; and forwarding the response to the user, the response comprising the encrypted HTTP cookie. Responsive to intercepting a subsequent request from the user to the web service, wherein the subsequent request includes the encrypted HTTP cookie; decrypting the encrypted HTTP cookie; and forwarding the subsequent request to the web service with the decrypted HTTP cookie.
Claims18
A method comprising steps of:
- responsive to a user authenticating to a web service, at a cloud-based security node having one or more processors, intercepting a response form the web service;
- encrypting, via an inline encryption engine of the cloud-based security node, a Hypertext Transfer Protocol (HTTP) cookie contained in the response, the encrypting rendering the HTTP session cookie opaque to an endpoint device of the user by applying an HTTPOnly flag and storing the original cookie in secure memory inaccessible to the endpoint device;
- forwarding the response to the user, the response comprising the encrypted HTTP cookie;
- and
- enforcing zero trust access policies during subsequent requests from the endpoint device by intercepting the subsequent requests at the cloud-based security node, decrypting the encrypted HTTP session cookie using a tenant-specific key, and conditionally forwarding the decrypted HTTP session cookie to the web service only when the zero trust access policies, wherein the user does not receive, and does not have access to the HTTP cookie in the response, the response comprising an encrypted cookie with an HTTPOnly flag such that no application programming interface of the endpoint device can access the cookie.
A non-transitory computer-readable medium comprising instructions that, when executed by one or more processors of a cloud-based security node, cause the one or more processors to perform steps of:
- responsive to a user authenticating to a web service, intercepting a response form the web service;
- encrypting, via an inline encryption engine of the cloud-based security node, a Hypertext Transfer Protocol (HTTP) cookie contained in the response, including applying an HTTPOnly flag to ensure that the encrypted cookie is opaque to endpoint applications and inaccessible to the user;
- forwarding the response to the user, the response comprising the encrypted HTTP cookie;
- and
- intercepting subsequent requests from the user, decrypting the encrypted HTTP session cookie using a key stored in secure memory of the cloud-based security node, enforcing one or more zero trust access policies based on user group membership or device context, and forwarding the decrypted cookie with the request to the web service only if the zero trust access policies are satisfied, wherein the user does not receive, and does not have access to the HTTP cookie in the response, the response comprising an encrypted cookie with an HTTPOnly flag such that no application programming interface of the endpoint device can access the cookie.
Dependencies are inferred from the claim text.