Implementing a secure web-based proxy service for Discover

This post details the technical challenges and architectural solutions for building a secure web-based proxy service (Discover) to provide free internet access. It describes the evolution from Free Basics, addressing limitations of previous approaches like subdomain allocation and IPv4-in-IPv6 encapsulation. The core innovation is an origin-collapsed domain namespace under discoverapp.com, allowing operators to easily allowlist traffic to a single domain. Key technical details include URL rewriting to encode third-party origins, server-side cookie management encrypted with a client-side key (ick), and mechanisms to prevent JavaScript-based cookie fixation and session hijacking using an outer trusted frame and localStorage for storing a derived cookie integrity token (ickt).