Site with streaming content fails to load

Products

• Cloud Secure Web Gateway - Cloud SWG

Issue/Introduction

The specific site fails to load in the browser.

Upon reviewing the proxy logs for the affected site, we observed that the Result shows as FAILED and the Action is TCP_NC_MISS_RST only for requests with the Content-Type "text/event-stream". However, other requests to the same site with different Content-Type show a Result of ALLOWED. Please refer to the following snapshot for more details.

Environment

Cloud SWG

Cause

The issue occurred because OCS was sending data as a text/event-stream, indicating a continuous data stream. As per the proxy’s expected behavior, it waits to receive the entire data from OCS before forwarding it for content scanning and post content scanning it will then forward it back to client. While proxy was still receiving data from OCS continuously, the client closed the connection causing the issue.

Resolution

This is the expected behavior of the proxy for "text/event-stream" data. As a best practice, continuous event streams (e.g., audio, video, etc...) should not be forwarded from the proxy to content scanning.

Once we added the specific site/domain to the content scanning exemption, the site began loading correctly.