RDP without the risk: Cloudflare's browser-based solution for secure third-party access

Cloudflare announces a clientless, browser-based RDP capability in Cloudflare Access that secures Windows server access with Zero Trust controls, leveraging IronRDP in the browser over TLS WebSockets, Cloudflare Workers as a proxy, Apollo for routing, and Oxy for policy enforcement and logging. The post outlines RDP’s historical security challenges (e.g., BlueKeep, credential abuse), how the architecture mitigates them via SSO/MFA, JWT-based authorization, and modern authentication, and highlights benefits like no additional software, low latency, and integrated auditing. It previews roadmap items such as DLP controls and passwordless authentication and notes plans for FedRAMP High inclusion, with the feature currently in closed beta.