Implementing a secure web-based proxy service for Discover

What this post added

This post details the technical implementation of the Discover web-based proxy service, an evolution from Free Basics. It describes the architectural challenges of securely presenting third-party webpages and their resources within a proxy configuration, especially when enabling JavaScript execution. Key technical contributions include: the origin collapsing architecture under a single domain (`discoverapp.com`) for simplified operator configuration; a URL rewriting scheme to transform third-party URLs into a format compatible with the proxy's single namespace and TLS certificate; server-side cookie management to overcome browser limitations and domain namespace constraints, using client-side `datr` and `ick` cookies for encryption and integrity; and a robust mechanism to mitigate JavaScript-enabled threats like session fixation and cookie overwriting by using HMAC (`ickt`) derived from `ick` and `datr`, stored in trusted `localStorage` on a non-third-party origin.