Citrix Browser Content Redirection

Overview

The Internet contains and delivers more multimedia content than ever before, particularly since Covid-19. A real-world example is the car sales industry whereby car dealerships are harnessing social media to sell their stock by way of videos.

Video content itself is also very much part of our daily lives whether it be watching YouTube videos, news clips, training videos, or video conferencing using Microsoft Teams.

Video content is also taxing on CPU first and foremost, so for a Citrix environment that may really impact the overall user experience for video playback amongst all the other activities.

Thankfully there is a solution which allows a business to offload that video to the endpoint itself using what we call Browser Content Redirection, which is available to all Virtual Apps and Desktops licensed customers whether on-premises or using Citrix Cloud. Simply, an extension is installed on to the VDA, and Workspace app as always will be on the client endpoint. When a website is enabled for BCR using an allow list controlled via Studio policies, and the user browses to that website:

1. A CTXCSB virtual channel informs Workspace app that redirection is required and provides the URL.
2. The viewport is redirected to the endpoint.
3. The endpoint fetches the content (optional) and renders it.
4. Then, the viewport is blended back into the virtual desktop seamlessly. The end-user will not necessarily know that it is their endpoint doing the fetching and rendering of the web content.

The viewport contains the main part of your browser window that shows the web page content itself, as shown below. The address bar etc is not redirected and remains on the VDA.

This is all achieved by the overlay browser (HdxBrowsercef.exe), a Chromium based browser built into Workspace app, and the Browser Content Redirection extension which runs on Chrome or the newer Chromium based Microsoft Edge.

BCR Scenarios

Server fetch and server render

This is basically how things work without BCR, or if you don’t add a site to the allow list. The Citrix VDA fetches and renders the webpage.

This equals to potentially high RAM and CPU consumption on the VDA, as well as network consumption.

Server fetch and client render

In this scenario, the CTXPFWD virtual channel is used by Workspace app to fetch webpage content through the VDA, and then the endpoint renders that content. This can be useful if the endpoint doesn’t have internet access, or if you want to ensure that any security policies/web filtering is still applied to those web resources.

This equals to network consumption on the VDA, but with low RAM and CPU consumption.

Client fetch and client render

Workspace app contacts the web server directly and renders the web content.

This equals to low CPU, RAM, and network consumption on the VDA for a better end-user experience.

Disabling fallback

As mentioned, the option of server fetch and server render is typically what you have whenever BCR is not used at all. However, if you have BCR configured for YouTube for example, and redirection of that URL to the endpoint fails for a reason such as internet not being available on the endpoint, you can disable fallback/prevent the VDA fetching and processing the web content by setting the Windows Media fallback prevention Citrix Studio policy to Play all content only on client or Play only client-accessible content on client.

BCR Requirements

Windows Endpoints

• Windows 10.
• Workspace app 1809 for Windows or later. Note that Workspace app 1912 LTSR for Windows does not support BCR.

Linux Endpoints

• Thin client terminals must include WebKitGTK+.
• Workspace app 1808 for Linux or later.

Citrix

• Virtual Apps and Desktops 7 1808 or later for Current Release.
• XenApp and XenDesktop 7.15 CU3 or later for Long Term Service Release.
• Desktop OS VDA running Windows 10 1607 or newer.
• Server OS VDA running 2012 R2, 2016 or 2019.
• For Google Chrome: v66 or later running on the VDA.
• For Microsoft Edge: v83.0.478.37 or later running on the VDA.

Citrix Virtual Apps and Desktops 7 2109

Starting with VDA 2109, Citrix have changed the way in which JavaScript is injected into a webpage for BCR, resulting in an enhanced and simplified outcome.

BCR used to inject the HdxVideo.js JavaScript into BCR enabled webpages almost on the fly as it detected the need. This could sometimes cause issues and fail redirection if the JavaScript was not being injected quickly enough. Now, when a user visits a BCR enabled URL, that URL is redirected to blank HTML document that contains the running JavaScript, which then performs redirection. With this new approach, redirection is much more successful and has fixed some issues with redirecting certain resources that were having issues in previous releases.

Enabling and configuring BCR

Browser Content Redirection is enabled for YouTube by default. The main policy that enables BCR is Browser Content Redirection.

Further to this policy, the allow list, known as Browser Content Redirection ACL Configuration, is where you specify the URLs that you wish to be redirected.

As shown in the above screenshot, you can use a wildcard but not in the protocol or the domain address part of the URL.

• Allowed:
  • http://domain.com/index.html
  • http://domain.com/*
  • http://domani.com/*index*
• Not allowed:
  • http://*.domain.com

There are some additional policies relating to BCR:

• Browser Content Redirection Authentication Sites – Not all websites are the same. Some websites redirect you to other URLs, especially when authentication is required. For example, when you visit https://teams.microsoft.com, you are redirected to https://login.microsoftonline.com to authenticate. From there, you could be redirected to an IdP or back to Teams. In such scenarios, we need to tell BCR to remain active (redirected) to allow the authentication (child sites) to be handled correctly by BCR.
• Browser Content Redirection Blacklist Configuration – The blacklist takes precedence, and the web content will be fetched and rendered on the server, even if the same URL is added to Browser Content Redirection ACL Configuration. You can also use a wildcard here with the same rules as the ACL Configuration policy.
• Browser Content Redirection Proxy Configuration – I mentioned the BCR scenario server fetch and client render earlier in the article. It is this policy you would use to configure the server fetch piece. With this policy you can specify an explicit proxy address, PAC/WPAD file address, or specify Direct/Transparent.
  • Explicit example: http://proxy.domain.com:8080
  • PAC file example: http://proxy.domain.com/files/proxy.pac
  • WPAD file example: http://proxy.domain.com/files/wpad.dat
  • Direct/Transparent example: Type the word DIRECT into the policy text box.

XenApp and XenDesktop 7.15 Customers

Citrix backported BCR for those running with the 7.15 release of XenApp and XenDesktop. To use BCR, the following steps are required:

1. Install the VDA software using the command line and switch /FEATURE_DISABLE_HTML5.
   1. This removes the HTML5 video redirection feature, which must be done before installing BCR.msi. BCS.msi adds the feature back during installation, along with adding the browser content redirection services.
2. Install BCR.msi
   1. Confirm that the Citrix HDX HTML5 Video Redirection Service shows under services.msc.
3. Citrix Studio does not contain the BCR policies. Download the ADMX template for BCR from the Downloads page over at Citrix.

Installing the BCR extension on Google Chrome – Manual