JIT Network Access Chrome extension security report

JIT Network Access makes a gated site open normally. Some internal sites are configured to stay dark: they give nothing away until the device asking for them has proved it holds an enrolled key. This extension is the browser half of that. When you navigate to a site your administrator has enrolled your device for, the extension performs the challenge-response handshake — the "knock" — in the background, and the page loads. No login form, no code to copy, nothing to click. BEFORE YOU INSTALL This extension does nothing on its own. It only works with sites your organization has already set up for JIT Network Access, and only after an administrator has enrolled your device. If that has not been done, installing this will have no effect. Your administrator will send you an enrolment link or a setup string. GETTING SET UP 1. Install the extension. 2. Open the registration link your administrator sent you. The extension recognizes it and shows its own confirmation page, listing exactly which site or sites you are about to enroll for. 3. Click Enroll. The extension asks for access to those specific sites and nothing else, then exchanges a one-time code with your server for the device key. 4. Visit the site. It opens. You can also paste a setup string on the extension's Options page. WHAT YOU'LL SEE The toolbar popup shows the current tab's state — Not protected, Locked, or Unlocked — and a "Knock now" button if you ever want to run the handshake by hand. Grants expire; when one does, your next visit re-knocks automatically. HOW YOUR DEVICE KEY IS HANDLED - The key is imported as a non-extractable WebCrypto key. Neither the extension nor any web page can read it back out. - It lives in IndexedDB. Settings are in local storage and the short-lived record of which origins are currently open is in session storage. Nothing is written to Chrome Sync, so your key never leaves the machine you enrolled it on. - The enrolment link does not contain the secret. It carries a one-time code that the extension exchanges with your own server. - The extension talks only to the origins you enrolled for. There is no analytics, no telemetry, and no third-party endpoint of any kind. SITE ACCESS The extension does not request access to all sites. Internal hostnames differ per organization and are not known when the extension is published, so site access is requested at the moment you enroll, one origin at a time, on your click, and only for the origins named in your enrolment. SECURITY DESIGN - Only top-level, main-frame navigations trigger an automatic knock. A hidden frame on a hostile page cannot make your browser knock. - A tab opened by another page does not auto-knock at its first destination, so a page cannot cause a grant you never asked for. - No web page or other extension can talk to it. The manifest declares no externally_connectable, and the extension registers no external message listeners. - Origins are matched exactly — scheme, host and port — and HTTPS only. - All code is bundled in the extension. Nothing is fetched and executed at runtime. OPEN SOURCE Licensed AGPL-3.0. The source, the protocol specification and the server-side setup instructions are public: https://github.com/Slopapalooza/jit-network-access