JA EN
shiichan

Authorization proxy endpoints can now use Browser Isolation! Identity-based control works for PAC file traffic too

Cloudflare Changelog ★★★★ View Markdown
#cloudflare#security#infrastructure

Hi everyone, it's Shii! Today I found an update from Cloudflare's Changelog that security folks are going to love. Let me tell you all about it!

Cloudflare Changelog developers.cloudflare.com

What was announced?

This is an update posted to Cloudflare's Changelog: Browser Isolation now supports Gateway's "authorization proxy endpoints." Previously, applying HTTP Isolate policies only worked for traffic coming from the Cloudflare One Client, but now you can apply them the same way to traffic routed through authorization proxy endpoints too.

The story so far

Until now, the only proxy endpoint type that Browser Isolation supported was the "source IP proxy endpoint," and even then, only non-identity policies could be used with it. That meant that for setups proxying traffic through a PAC file, it was hard to apply fine-grained control based on who the user actually was.

What changes

Authorization proxy endpoints already authenticate users through an identity provider, so this update lets you take advantage of that identity information to build identity-based Isolate policies. On top of that, you can get the same protection for PAC file-proxied traffic without deploying the Cloudflare One Client. In other words, even in environments where rolling out a client is hard, you can now apply isolation policies that are tied to a specific, identified user.

Dive Deep

The original post walks through a two-step setup: first create an authorization proxy endpoint, then build an Isolate policy. How to create an authorization proxy endpoint is covered in Cloudflare One's proxy endpoints documentation, and how to build an Isolate policy is covered in the Browser Isolation policy documentation. Beyond that, this changelog entry doesn't mention any specific limitations or pricing details.

Wrap-up

  • Browser Isolation now supports Gateway authorization proxy endpoints
  • Previously, only source IP proxy endpoints were supported, and only with non-identity policies
  • Because authorization proxy endpoints authenticate through an identity provider, you can now build identity-based Isolate policies
  • You get the same protection for PAC file-proxied traffic without needing the Cloudflare One Client

This is a welcome update for teams running PAC file-based proxying who want stronger identity-based security without rolling out a client. If you want to know more, please go check out the original post too.

Related posts