# US 8,543,726 B1 · Web relay > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,543,726 B1 - Document ID: US8543726B1 - Status: Granted - Kind: B1 - Application number: 11/101,797 - Filed: 2005-04-08 - Granted: 2013-09-24 - Earliest claimed: 2005-04-08 - Assignees: Citrix Systems, Inc. - Applicants: Jong J. Kann; Pierre P. Rafiq; Marco A. Murgia - Inventors: Jong J. Kann; Pierre P. Rafiq; Marco A. Murgia - Web page: https://patentgrep.com/patent/US8543726B1 ## CPC - H04L 63/0281: {Proxies} - H04L 63/101: {Access control lists [ACL]} - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method, system, and apparatus are presented in which a web relay/client proxy module is downloaded to a client browser from a Network Security Appliance (NSA). The web relay module intercepts requests from the browser for network resources, and redefines the addresses within those requests so that the NSA can access protected resources on behalf of the client. ## Claims ### Claim 1 A method for redirecting, by a web relay, requests of a client to a network security appliance, the method comprising: a) intercepting, by a web relay of a client, a request of the client for a resource of a server, the client in communication with a network security appliance, the network security appliance intermediary to the client and the server, the request comprising a uniform resource locator (URL) of the server; b) determining, by the web relay based on one or more rules received from the network security appliance, that the resource of the server is a protected resource that is not to be directly accessed by the client but must be accessed only via the network security appliance; c) establishing, by the web relay responsive to the determination, a secure tunnel to the network security appliance; d) rewriting, by the web relay prior to transmission from the client, the request destined to the server for transmission to the server via the network security appliance, the request rewritten to preserve a namespace of a cookie of the request by concatenating an address of the network security appliance with the uniform resource locator (URL) of the server of the request while not rewriting the cookie, the network security appliance using the URL of the server from the rewritten request for obtaining the resource; and e) communicating, by the web relay, the rewritten request and the preserved cookie to the network security appliance. ### Claim 2 (depends on 1) The method of claim 1, wherein step (a) further comprises intercepting, by the web relay executing in a browser of the client, the request comprising one of a uniform resource locator (URL) or a Hyper Text Transfer Protocol (HTTP) request. ### Claim 3 (depends on 1) The method of claim 1, wherein step (b) further comprises determining, by the web relay, that the resource of the request is on a list of resources that cannot be directly accessed by the client but is required to be accessed through the network security appliance. ### Claim 4 (depends on 1) The method of claim 1, wherein step (b) further comprises determining, by the web relay, that the resource of the request is a resource on a server of a private network accessed via the network security appliance. ### Claim 5 (depends on 1) The method of claim 1, wherein step (c) further comprises establishing, by the web relay for the request intercepted via a non-secure connection, a Secure Socket Layer (SSL) connection with the network security appliance. ### Claim 6 (depends on 1) The method of claim 1, wherein step (c) further comprises establishing, by the web relay of a browser responsive to intercepting an HTTP request of the client for a protected resource, a secure HyperText Transfer Protocol (HTTPS) with the network security appliance. ### Claim 7 (depends on 1) The method of claim 1, wherein step (d) further comprises rewriting, by the web relay, the uniform resource locator (URL) of the request to a secure proxy URL. ### Claim 8 (depends on 1) The method of claim 1, wherein step (d) further comprises rewriting, by the web relay, the request to comprise a network address of the network security appliance. ### Claim 9 (depends on 1) The method of claim 1, wherein step (d) further comprises rewriting, by the web relay, the request to include a cookie. ### Claim 10 (depends on 1) The method of claim 1, wherein step (c) further comprises determining, by the web relay, the client is required to use a proxy to access the resource, and establishing the SSL connection through the proxy. ### Claim 11 (depends on 10) The method of claim 10, wherein step (e) further comprises forwarding, by the web relay, the rewritten request to the network security appliance via the proxy. ### Claim 12 A method for redirecting, by a web relay, requests of a client to one of a proxy or a network security appliance, the method comprising: a) intercepting, by a web relay of a client, requests of the client for one or more resources of a server, the web relay in communication with a proxy and a network security appliance, the web relay determines whether to transmit intercepted network requests to the proxy or the network security appliance, the request comprising a uniform resource locator (URL) of the server; b) determining, by the web relay based on one or more rules received from the network security appliance, that a first request intercepted from the client is for a protected resource that is not to be directly accessed by the client but must be accessed via the network security appliance; c) establishing, by the web relay responsive to the determination of the first request, a secure tunnel to the network appliance and communicating the first request rewritten to preserve a namespace of a cookie of the request via the secure tunnel to the network security appliance by concatenating an address of the network security appliance with the uniform resource locator (URL) of the server of the first request, the network security appliance using the uniform resource locator (URL) of the server from the rewritten first request for obtaining the resource; and d) determining, by the web relay based on the one or more rules, that a second request intercepted from the client is not for the protected resource and forwarding the second request to the proxy instead of to the network security appliance. ### Claim 13 (depends on 12) The method of claim 12, wherein step (a) further comprises intercepting, by the web relay executing in a browser of the client, requests communicated via a non-secure connection and comprising one of a uniform resource locator (URL) or a Hyper Text Transfer Protocol (HTTP) request. ### Claim 14 (depends on 12) The method of claim 12, wherein step (a) further comprises determining, by the web relay, whether a resource of an intercepted request is on a list of resources that cannot be directly accessed by the client but is required to be accessed through the network security appliance. ### Claim 15 (depends on 12) The method of claim 12, wherein step (b) further comprises determining, by the web relay, that the resource of the first request is on a server of a private network accessed via the network security appliance. ### Claim 16 (depends on 12) The method of claim 12, wherein step (b) further comprises determining, by the web relay, that the resource of the first request is a protected resource required to be accessed via the network security appliance. ### Claim 17 (depends on 12) The method of claim 12, wherein step (c) further comprises establishing, by the web relay of a browser responsive to the determination of the first request of the client, a secure HyperText Transfer Protocol (HTTPS) with the network security appliance. ### Claim 18 (depends on 12) The method of claim 12, wherein step (c) further comprises rewriting, by the web relay, the uniform resource locator (URL) of the first request to a secure proxy URL. ### Claim 19 (depends on 12) The method of claim 12, wherein step (d) further comprises rewriting, by the web relay, the first request to comprise a network address of the network security appliance. ### Claim 20 (depends on 12) The method of claim 12, wherein step (d) further comprises determining, by the web relay, that the client is required to use the proxy to access the resource of the second request, and establishing a second secure connection through the proxy. ### Claim 21 A system for redirecting requests of a client to one of a proxy or a network security appliance, the system comprising: an interceptor of a web relay intercepting requests of a client for one or more resources of a server via a network, the web relay in communication with a proxy and a network security appliance; rules of the web relay to determine whether to use the proxy or the network security appliance for a resource requested by an intercepted request, the rules received from the network security appliance; a rewriter of the web relay to rewrite resources of intercepted requests to preserve a namespace of a cookie for the request, based on the rules that identify a resource that is not to be directly accessed by the client but must be accessed only via the network security appliance, for transmission to the network security appliance and concatenating an address of the network security appliance with a uniform resource locator (URL) of the server of the request, the network security appliance using a portion of the URL of the server for obtaining the resource; and a redirector of the web relay to redirect the intercepted request to the proxy or the network security appliance based on the rules. ### Claim 22 (depends on 21) The system of claim 21, wherein the web relay determines via the rules that a first request intercepted by the interceptor is for a protected resource to be accessed via the network security appliance. ### Claim 23 (depends on 22) The system of claim 22, wherein the web relay establishes, responsive to the determination for the first request, a secure tunnel to the network appliance and the redirector communicates the rewritten first request via the secure tunnel to the network security appliance. ### Claim 24 (depends on 22) The system of claim 22, wherein the rewriter rewrites a uniform resource locator of the rewritten first request to a secure URL. ### Claim 25 (depends on 22) The system of claim 22, wherein the web relay determines via the rules that the rewritten first request must be forwarded to the proxy via a secure connection. ### Claim 26 (depends on 21) The system of claim 21, wherein the web relay determines via the rules that a second request of the client is not for a protected resource and the redirector forwards the second request to the proxy. ### Claim 27 (depends on 21) The system of claim 21, wherein the web relay operates in a browser of the client.