2

I use the BlueCoat ProxyClient filter in a small office network (< 50 computers). We have it set for category based filtering and it works perfectly on almost all sites. However, sometimes, we have a site that

  1. Even if it's in an allowed category
  2. Even if we add it explicitly to a whitelist
  3. Even though we can navigate to it in a browser,
  4. It still does not function properly unless we add it to the "SSL intercept bypass" list.

What does this "bypass" actually do and why is it necessary?

Example

  1. We installed Visual Studio 2015 Community on one of our computers
  2. When we tried to update our license using our MS account, we got the message "Failed to update license".
  3. Using Fiddler we found that VS was trying to access https://app.vssps.visualstudio.com. That's flagged as Technology/Internet by BlueCoat which is on our allowed category list.
  4. We added it to our explicit whitelist and it still didn't help.
  5. We enabled the HTTPS decrypt setting in Fiddler and found that it was sending a lot of requests to https://app.vssps.visualstudio.com/_api with an Authenticate header that looked valid, but the response was coming back as 401 Not Authenticated.
  6. We finally added app.vssps.visualstudio.com to the SSL bypass list and it suddenly started working.
  • Do you have any hardware firewalls? – xorist Mar 14 '16 at 18:28
  • @l1thal No, just the ProxyClient. – just.another.programmer Mar 14 '16 at 20:33
3

My guess is that your Proxy is stripping off the Authenticate header from the request. I did a quick Google search on the issue and found this forum page. From the same page:

It is by design if the proxy sees an Authorization header and the proxy have authentication enabled or used in the policy, the proxy will consumed the Authorization header, thus the Authorization header will not be forwarded to the upstream device.

In this case, the Authorization header was generated from the client and NOT due to the proxy's authentication challenge, this is why it failed. So in order to 'tell' the proxy not to suppress the Authorization header, we would need to disable authentication for this URL and forward the Authorization header to the upstream as what the CPL suggested will be doing"

I believe the issue you are having is kind of similar. The solution proposed on the forum:

Solution at present would be to have "security force-credential-forwarding" enabled or use the CPL to bypass Auth for the domain. Since the command will affect the "Proxy-Authorization" headers too.

Hope this helps.

  • This sounds like it might be accurate. I don't have any upstream device to capture the traffic and verify if the Authenticate header was stripped. Why would they want to strip the Authenticate header in the first place? How does it help their filter? – just.another.programmer Mar 14 '16 at 20:34
  • Not sure why'd they want to do that. I don't have first hand experience dealing with it. Sorry. But, the forum provides solution to prevent this from happening. You can try it out. – Rahil Arora Mar 14 '16 at 21:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.