Resolve File Upload and Download Failures in Chromebook Client SWG

Introduction

This document describes how to resolve file upload and download failures in Umbrella Chromebook Client SWG.

Overview

When you use Secure Web Gateway (SWG) for Umbrella Chromebook Client (UCC), file uploads and downloads for applications such as Gmail and Google Drive can fail with an error message like "Attachment failed." This behavior occurs because of how the SWG proxy and authentication process works at the ChromeOS layer.

How SWG Umbrella Chromebook Client Works

The SWG extension registers the client with Umbrella, downloads the proxy configuration, and sets up a proxy on ChromeOS. This setup protects the device from online threats by proxying web traffic from the Chrome browser and any installed applications to Umbrella.

• The SWG Umbrella Chromebook Client sets the proxy at the ChromeOS layer.
• All web traffic—including from Chrome and other apps—is proxied to Umbrella.
• The UCC for SWG manages proxy authentication challenges.
• Some applications, such as Google Drive, cannot handle proxy authentication challenges.

Process Steps for SWG Umbrella Chromebook Client

1. The UCC SWG extension sets up the proxy using the chrome.proxy API request.
2. The UCC SWG extension sends requests forhttp://407.checkumbrella.comto the SWG proxy server.
3. The SWG proxy server detects the special domain407.checkumbrella.comand responds with an HTTP 407 status, prompting a proxy authentication challenge.
4. The Google Chrome browser understands HTTP 407 and calls theonAuthRequiredfunction in the UCC SWG extension to obtain authentication headers.
5. The Chrome browser caches the authentication header.
6. The browser sends a second request for407.checkumbrella.com, this time with authentication headers.
7. When you open Gmail in Chrome, requests frommail.google.comare proxied to the SWG proxy server with the cached authentication headers.
8. When you upload a local or cached file in Gmail, the upload works because requests include authentication headers.

Why Does File Upload and Download Fail from Android Apps?

1. When you upload a non-cached file from Google Drive installed on the Chromebook, Google Drive attempts to download the file fromgoogleapis.com.
2. This request is proxied to the SWG proxy server. However, because Google Drive does not have the cached authentication headers from Chrome, thegoogleapis.comrequest is sent without authentication headers.
3. The SWG proxy server rejects the request with a 401 unauthorized error, preventing Google Drive from downloading the file.
4. Because the file cannot be downloaded from Google Drive, uploading the file to Gmail also fails.

Resolution

To resolve file upload issues for Android applications such as Google Drive, use the external domains management list to bypass the domain googleapis.com.