Closing the browser gap for non-HTTP resources
Cloudflare for Teams has added a browser-based terminal to its Zero Trust platform, extending the same controls that protect web applications to services like SSH. The feature lets users launch a fully functional console from their browser, authenticate through their organization's SSO, and have Cloudflare's edge enforce the team's Zero Trust rules before granting access.
Once authenticated, users run commands over SSH as if they were using a native terminal—no client-side configuration or agent required. Cloudflare's network accelerates the connection, applies data-transfer rules, and records the session for administrators to audit. The initial release covers SSH, with plans to extend the platform to nearly any application type, including RDP.
Cloudflare built the offering after hearing from customers struggling to secure and deliver applications that live outside the browser. Developers spoke of the burden of supporting SSH connections into machines, and of extending legacy applications to large remote workforces.
Why non-web applications are a security blind spot
Zero Trust is harder outside the browser
Web applications can be placed behind a reverse proxy like Cloudflare, with users visiting a public DNS address while the proxy checks identity. Cloudflare Access builds on that to add Zero Trust rules to any web app in less than ten minutes.
Traditional thick-client applications are a different problem. They expect to reach a private IP over a specific protocol, and exposing that IP publicly is a non-starter for most organizations. Authentication also relies on legacy approaches—long-lived SSH keys, sticky-note RDP passwords—that don't integrate with SSO or device posture checks.
A logging and data-control gap
Cloudflare can log every authentication event and HTTP request and response for web applications without server-side code changes. But customers report a data-control and logging gap for everything else. Non-browser applications remain a blind spot even in teams that have made significant investments in web application security.
UX and configuration friction
Any application that doesn't run in a browser forces trade-offs. Some teams ship dedicated hardware with specific operating systems; others fall back on virtualization platforms that slow down workflows. Regardless of the client approach, traffic gets backhauled through centralized appliances, degrading performance for mission-critical tasks like production management.
Migrating to Zero Trust also becomes a chore when users must change local configuration. When Cloudflare's own team deleted its VPN, engineers started sharing SSH configuration files in chat and fielding questions about environment variables for Kubernetes workloads. Application discovery suffered too, with wiki pages trying to maintain inventories of IP addresses and ports.
Three components, no client setup
The browser-based terminal addresses those challenges with the same deployment model as web application flows. The solution comprises:
- Your service running in an on-premise environment or public cloud
- A secure connection from that service to Cloudflare's edge using the lightweight daemon
cloudflared - A user's browser, where Cloudflare renders the SSH session
Identity rules for any resource
Enterprises with compliance requirements to add second-factor authentication to self-hosted applications previously faced months of development work. With Cloudflare Access, teams can require their identity provider's second-factor authentication as a condition for reaching applications of any type in minutes.
Those identity-based rules can be layered with other signals, including user location and device health via integrations with providers like Tanium, Carbon Black, and Crowdstrike. Organizations can require connections from managed devices or build login flows supporting enterprise providers like Okta and Azure AD alongside public options like GitHub and Google.
The platform also replaces outdated authentication practices. The JSON Web Token issued at login is converted to short-lived certificates that authorize the user's session on a machine, eliminating the need for long-lived SSH keys.
Session control and recording
Cloudflare Zero Trust Apps applies the same control over files, data, and commands available in Cloudflare Gateway to other application types. Teams can build rules controlling who can transfer data to or from a machine over SSH, or to a remote desktop over RDP, keyed by machine, user and group identity, country, or device.
Session recording is planned as a coming addition for any connection type. Cloudflare will record the screen of each session, batch the recordings at intervals, and ship them to storage you configure. Structured command logging and keyboard input capture will follow.
Single-click access from any device
Users get a dashboard tailored to their permissions, showing every application they can reach—web, SSH, RDP, and others. Clicking a tile launches the interface without leaving the browser. Cloudflare's login flow authorizes the session, and the user starts working without editing SSH configuration files or RDP clients.
The browser-based interface works on tablets and phones too, so technicians on site or users away from their desks can reach any service as seamlessly as a web application.
Security without sacrificing performance
The solution builds on the remote browser isolation technology that powers Cloudflare Browser, rendering the application as if it were native—with support for highlighting, copy-and-paste, and shortcuts. Cloudflare's network then accelerates traffic from the server to the end user, determining the fastest path across its global backbone and delivering the experience from a data center in one of more than 200 cities across over 100 countries.
Availability and next steps
The initial release supports SSH, with more application types planned over the coming months alongside structured command logging and filtering for SSH. Teams already using Cloudflare Access for SSH flows can begin using Zero Trust Apps immediately with a single configuration change.
Cloudflare Zero Trust Apps is available at no cost for up to 50 users as part of the Cloudflare for Teams free plan. Advanced features like session recording will require the Cloudflare for Teams Standard plan.
