Sign in
Stable

Filtering that works without decrypting HTTPS page content

Enforce domain, category and allow/deny policy on the browser-extension path without decrypting HTTPS page content.

Steps

Follow these in order.

  1. 01Policy is decided before traffic exitsThe gateway applies domain/category rules and workspace overrides before routing the browser request through an approved egress location.
  2. 02A blocked click should explain the policyWhen a user clicks a phishing or disallowed work link, the block page should say what was blocked and which policy class made the decision, without exposing internal rule internals.
  3. 03Host/category filtering, not HTTPS inspectionBusinessProxy does not decrypt HTTPS page bodies on the browser path and does not provide DLP classification. If a page is allowed by domain/category policy, its encrypted content stays encrypted through the proxy path.

Reference

Implementation details for setup and review.

Domain and category policyBusinessProxy evaluates the domain, a local versioned category baseline and workspace allow/deny rules before managed browser traffic leaves through an approved route.
  • Domain and host metadata
  • Versioned local category feed
  • Workspace allow/deny overrides
  • No TLS content inspection
Policy is decided before traffic exitsThe gateway applies domain/category rules and workspace overrides before routing the browser request through an approved egress location.
  • Local category baseline: The category source is versioned so decisions are reproducible and reviewable.
  • Workspace overrides: Admins can adapt the baseline with allow and deny rules that match their environment.
  • Routing context: Routing mode and selected egress region remain part of the policy context.
A blocked click should explain the policyWhen a user clicks a phishing or disallowed work link, the block page should say what was blocked and which policy class made the decision, without exposing internal rule internals.
  • Use clear category names for user-facing blocks.
  • Keep admin overrides auditable.
  • External threat-feed lookups run only when enabled for that customer.
Host/category filtering, not HTTPS inspectionBusinessProxy does not decrypt HTTPS page bodies on the browser path and does not provide DLP classification. If a page is allowed by domain/category policy, its encrypted content stays encrypted through the proxy path.
  • No TLS MITM on the browser path.
  • No DOM or form-content inspection.
  • This is not full DLP or content classification.