A plug-in sandbox runs outside the plug-in iFrame. The sandbox component, along with the rest of the vSphere Client user interface components, sends requests to the vsphere-ui service of the vCenter Server instance that the browser connected to. Service requests use REST and Web sockets over HTTPS. All requests pass through the vCenter Server reverse proxy, which routes them to the correct server components.

A plug-in user interface sends service requests to the plug-in back end, using any RPC style on top of the HTTPS transport protocol. All requests pass through the vCenter Server reverse proxy, which routes them to the plug-in server. The proxy routing is configured at the time the plug-in is installed; it simplifies dealing with self-signed certificates, and avoids problems with cross-origin resource access.