Calling APIs across isolated parts of a network application

Abstract

A secure method for an isolated portion of a network application to call an API across boundaries is described. A host webpage receives a first object from a first iframe of the host webpage. The first object identifies a first application programming interface (API). The host webpage validates the first object against a predefined API for the host webpage. Once the first object is validated, the host webpage forwards the first object to a second iframe of the host webpage. The second iframe parses the first object and converts the parsed first object into a second API corresponding to the second iframe.

Description

Technical Field

[0001] The subject matter disclosed herein generally relates to a special purpose machine that provides a mechanism for two iframes of a web page to communicate, computerized variations including such special purpose machines, and improvements to such variations; and to techniques by which such special purpose machines are improved over other special purpose computers that provide non-executable code in messages between an iframe and its host. Specifically, the present disclosure is directed to systems and methods for communicating executable functions between iframes and between an iframe and its host. Background Art

[0002] The HTML Document Object Model (DOM) defines a standard set of elements for making web pages. One such element is an "<inline frame>" that instructs a web browser to load a different ("embedded") web page inside a specified rectangle that appears on an external ("host") web page. The embedded web page is isolated from the host web page. For example, program scripts from the embedded web page are generally prohibited from communicating with scripts from the host page, and security enforcement is prohibited in situations where the embedded web page may not be trusted.

[0003] The HTML5 specification also provides a messaging system in which an inline frame and its host can communicate via the postMessage API. Messages sent via postMessage can include structured objects. However, these structured objects cannot contain executable code and contain JavaScript primitives or other nested structured objects. Therefore, an inline frame cannot use the postMessage API to communicate with other inline frames embedded in the host. BRIEF DESCRIPTION OF THE DRAWINGS

[0004] To easily identify the discussion of any particular element or act, the most significant digit(s) in a reference number refers to the drawing number in which the element is first introduced.

[0005] Figure 1 is a schematic diagram of a network environment in which the present disclosure may be deployed according to some exemplary embodiments.

[0006] Figure 2 is a block diagram illustrating a cross-border application according to an exemplary embodiment.

[0007] Figure 3 is a block diagram illustrating an exemplary operation of a cross-boundary application according to an exemplary embodiment.

[0008] Figure 4is a sequence diagram illustrating an exemplary operation of a cross-boundary application according to an exemplary embodiment.

[0009] Figure 5 is a flow chart illustrating a method for communicating APIs across boundaries according to an exemplary embodiment.

[0010] Figure 6 is a flowchart illustrating a method for calling an API at a second iframe according to an exemplary embodiment.

[0011] Figure 7 is a flow chart illustrating a method for communicating results from an API called at a second iframe back to a first iframe, according to one embodiment.

[0012] Figure 8 A routine according to one embodiment is illustrated.

[0013] Fig. 9 is a schematic diagram of a machine in the form of a computer system within which a set of instructions may be executed for causing the machine to perform any one or more of the methodologies discussed herein according to an exemplary embodiment. DETAILED DESCRIPTION

[0014] "Component" refers to a device, physical entity or logic with boundaries defined by function or subroutine calls, branch points, APIs or other technologies that provide partitioning or modularization of specific processing or control functions. Components can be combined via their interfaces with other components to perform machine processes. Components can be packaged functional hardware units designed to be used with other components and a part of a program that generally performs a specific function of related functions. Components can constitute software components (e.g., codes embodied on machine-readable media) or hardware components. "Hardware components" are tangible units that can perform certain operations and can be configured or arranged in a certain physical manner. In various exemplary embodiments, one or more computer systems (e.g., independent computer systems, client computer systems, or server computer systems) or one or more hardware components of a computer system (e.g., a processor or a group of processors) can be configured by software (e.g., an application or an application part) to operate as hardware components for performing certain operations described herein. Hardware components can also be implemented mechanically, electronically, or any suitable combination thereof. For example, a hardware component may include a dedicated circuit or logic that is permanently configured to perform certain operations. A hardware component may be a dedicated processor, such as a field programmable gate array (FPGA) or an application-specific integrated circuit (ASIC). The hardware component may also include a programmable logic or circuit, which is temporarily configured by software to perform certain operations. For example, the hardware component may include software executed by a general-purpose processor or other programmable processor. Once configured by such software, the hardware component will become a specific machine (or a specific component of the machine) uniquely customized for performing the configured function, and is no longer a general-purpose processor. It will be appreciated that the decision to mechanically implement the hardware component in a dedicated and permanently configured circuit or in a temporarily configured circuit (for example, configured by software) can be driven by cost and time considerations. Therefore, the phrase "hardware component" (or "hardware-implemented component") should be understood to include a tangible entity, which is an entity that is physically constructed, permanently configured (for example, hardwired) or temporarily configured (for example, programmed) to operate or perform certain operations described in this article in some way. Considering an embodiment in which the hardware component is temporarily configured (for example, programmed), each hardware component does not need to be configured or instantiated at any one time instance. For example, in the case where the hardware component includes a general-purpose processor configured by software to become a special-purpose processor, the general-purpose processor can be configured as different special-purpose processors (for example, including different hardware components) at different times. The software configures one or more specific processors accordingly, for example, to constitute a specific hardware component at one instance in time, and to constitute a different hardware component at a different instance in time. Hardware components can provide information to other hardware components, or receive information from other hardware components. Thus, the described hardware components can be considered to be communicatively coupled.In the case of multiple hardware components being present at the same time, communication can be achieved by signal transmission (e.g., by appropriate circuits and buses) between two or more hardware components. In embodiments where multiple hardware components are configured or instantiated at different times, communication between these hardware components can be achieved, for example, by storing and retrieving information in a memory structure accessible to multiple hardware components. For example, a hardware component can perform an operation and store the output of the operation in a memory device to which it is communicatively coupled. Then, other hardware components can access the memory device at a later time to retrieve and process the stored output. The hardware component can also initiate communication with an input or output device and can operate on a resource (e.g., a collection of information). The various operations of the exemplary methods described herein can be performed at least in part by one or more processors that are temporarily configured (e.g., by software) or permanently configured to perform related operations. Whether temporarily configured or permanently configured, such a processor can constitute a component implemented by a processor, and these component operations are used to perform one or more operations or functions described herein. As used herein, a "processor-implemented component" refers to a hardware component implemented using one or more processors. Similarly, the method described herein can be at least partially processor-implemented, wherein one or more specific processors are examples of hardware. For example, at least some of the operations of a method can be performed by one or more processors or components implemented by the processor. In addition, one or more processors can also be operated to support the performance of related operations in a "cloud computing" environment or as "software as a service" (SaaS). For example, at least some of the operations can be performed by a group of computers (as an example of a machine including a processor), wherein these operations can be accessed via a network (e.g., the Internet) and via one or more appropriate interfaces (e.g., API). The execution of certain operations can be distributed between processors, not just resident in a single machine, but deployed across multiple machines. In some exemplary embodiments, a processor or a component implemented by a processor can be located in a single geographical location (e.g., in a home environment, an office environment, or a server farm). In other exemplary embodiments, a processor or a component implemented by a processor can be distributed across multiple geographical locations.

[0015] "Communication network" refers to one or more parts of a network, which may be an ad hoc network, an intranet, an extranet, a virtual private network (VPN), a local area network (LAN), a wireless LAN (WLAN), a wide area network (WAN), a wireless WAN (WWAN), a metropolitan area network (MAN), the Internet, a portion of the Internet, a portion of the Public Switched Telephone Network (PSTN), a Plain Old Telephone Service (POTS) network, a cellular telephone network, a wireless network, A network, another type of network, or a combination of two or more such networks. For example, the network or a portion of the network may include a wireless or cellular network, and the coupling may be a code division multiple access (CDMA) connection, a global system for mobile communications (GSM) connection, or other types of cellular or wireless coupling. In this example, the coupling may implement any of a variety of types of data transmission technologies, such as single carrier radio transmission technology (1xRTT), evolution data optimized (EVDO) technology, general packet radio service (GPRS) technology, enhanced data rates for GSM evolution (EDGE) technology, including the third generation partnership project (3GPP) of 3G, fourth generation wireless (4G) network, universal mobile telecommunications system (ETMTS), high speed packet access (HSPA), world wide interoperability for microwave access (WiMAX), long term evolution (LTE) standards, other standards defined by various standards development organizations, other remote protocols, or other data transmission technologies.

[0016] "Machine storage media" refers to a single or multiple storage devices and / or media (e.g., centralized or distributed databases and / or associated caches and servers) that store executable instructions, routines, and / or data. Thus, the term should be understood to include, but is not limited to, solid-state memory and optical and magnetic media, including memory internal or external to the processor. Specific examples of machine storage media, computer storage media, and / or device storage media include non-volatile memory, including, for example, semiconductor memory devices such as erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), FPGA, and flash memory devices; magnetic disks, such as internal hard disks and removable disks; magneto-optical disks; and CD-ROM and DVD-ROM disks. The terms "machine storage media," "device storage media," and "computer storage media" mean the same thing and are used interchangeably in this disclosure. The terms "machine storage media," "computer storage media," and "device storage media" expressly exclude carrier waves, modulated data signals, and other such media, at least some of which are covered by the term "signal media."

[0017] "Processor" refers to any circuit or virtual circuit (physical circuit emulated by logic executed on an actual processor) that manipulates data values ​​according to control signals (e.g., "commands," "opcodes," "machine codes," etc.), and which generates corresponding output signals that are applied to operate the machine. The processor may be, for example, a central processing unit (CPU), a reduced instruction set computing (RISC) processor, a complex instruction set computing (CISC) processor, a graphics processing unit (GPU), a digital signal processor (DSP), an application specific integrated circuit (ASIC), a radio frequency integrated circuit (RFIC), or any combination thereof. The processor may also be a multi-core processor with two or more independent processors (sometimes referred to as "cores") that can execute instructions simultaneously.

[0018] "Carrier signal" refers to any intangible medium capable of storing, encoding or carrying instructions for execution by a machine and includes digital or analog communications signals or other intangible media to facilitate communication of such instructions. Instructions may be sent or received over a network using a transmission medium via a network interface device.

[0019] "Signal medium" refers to any intangible medium that is capable of storing, encoding or carrying instructions for execution by a machine, and includes digital or analog communication signals or other intangible media to facilitate communication of software or data. The term "signal medium" should be taken to include any form of modulated data signals, carrier waves, etc. The term "modulated data signal" means a signal that has one or more of its characteristics set or changed in such a manner as to encode information in the signal. The terms "transmission medium" and "signal medium" mean the same thing and may be used interchangeably in this disclosure.

[0020] "Computer-readable media" refers to both machine storage media and transmission media. Thus, the term includes both storage devices / media and carrier waves / modulated data signals. The terms "machine-readable medium," "computer-readable medium," and "device-readable medium" mean the same thing and may be used interchangeably in this disclosure.

[0021] "Inline frame" refers to an HTML document that is embedded inside another HTML document on a website. The inline frame HTML element can be used to insert content from another source.

[0022] "Framework" refers to the SharePoint Framework (SPFx), which is a page and extension model that supports client-side development for building SharePoint experiences.

[0023] The following description describes the system, method, technology, instruction sequence and computing machine program product of the exemplary embodiment that illustrates this theme.In the following description, for the purpose of explanation, many specific details are set forth in order to provide an understanding of the various embodiments of this theme.However, it will be apparent to those skilled in the art that the embodiments of this theme can be put into practice without some or other details in these specific details.Examples represent possible variations only.Unless otherwise explicitly stated, structures (e.g., structural components, such as modules) are optional and can be combined or subdivided, and operations (e.g., in processes, algorithms or other functions) can be sequentially varied or combined or subdivided.

[0024] Microsoft's SharePoint product provides the ability to host interactive widgets (e.g., SharePoint client-side web parts). Web parts can be hosted in safe mode, which will render the web part inside an embedded frame (also known as an iframe) on a page hosted in SharePoint. Web parts in an iframe cannot affect the host page. SharePoint web parts can be configured using a configuration panel ("property pane") that is part of the host page. Web parts in safe mode render the property pane inside a separate iframe instead of the host page. Communication for the web part to the current frame of the property pane (and vice versa) is done through an API exposed between the two iframes.

[0025] Network components in secure mode need to be able to use these same APIs, but the current communication model does not provide a mechanism for two iframes to communicate (possibly across domains). Executable functions cannot be passed between an iframe and its host or between two iframes. This application describes a solution that provides the following features:

[0026] The web widget and the property pane are rendered in two separate iframes and may not have the same origin.

[0027] • A network component is able to use the current set of property pane APIs, and vice versa (eg, a network component in secure mode does not behave differently than the same network component not presented in secure mode).

[0028] The communication channel is safe, declarative, and does not involve global variables.

[0029] In an exemplary embodiment, the present application describes the following examples: a secure communication channel is established between two inline frames on a web page, the same API is called into or out of the inline frames with the same behavior, one inline frame safely calls the API in another inline frame, and the host can safely call the API in the inline frame, and vice versa.

[0030] In an exemplary embodiment, the present application describes a secure method for an isolated portion of a network application to call an API across boundaries. A host webpage receives a first object from a first iframe of the host webpage. The first object identifies a first application programming interface (API). The host webpage verifies the first object against a predefined API for the host webpage. Once the first object is verified, the host webpage forwards the first object to a second iframe of the host webpage. The second iframe parses the first object and converts the parsed first object into a second API corresponding to the second iframe.

[0031] As a result, one or more of the methods described herein facilitate solving the technical problem of calling an API across boundaries. Thus, one or more of the methods described herein can avoid the need for certain efforts or computing resources that would otherwise be associated with transferring executable functions between an inline frame and its host or between two inline frames. As a result, the resources used by one or more machines, databases, or devices (e.g., within an environment) can be reduced. Examples of such computing resources include processor cycles, network traffic, memory usage, data storage capacity, power consumption, network bandwidth, and cooling capacity.

[0032] Figure 1 is a schematic diagram of a network environment 100 in which some exemplary embodiments of the present disclosure may be implemented or deployed.

[0033] One or more application servers 104 provide server-side functionality to networked user devices in the form of client devices 106 via network 102. Web client 110 (eg, browser) and programmatic client 108 (eg, "app") are hosted and executed on web client 110.

[0034] Application program interface (API) servers 118 and web servers 120 provide corresponding programming and network interfaces to application servers 104. Specific application servers 116 host web hosting applications 122 (eg, Microsoft Sharepoint) and cross-boundary communication applications 124 including components, modules and / or applications.

[0035] The network client 110 communicates with the web hosting application 122 via a network interface supported by the network server 120. Similarly, the programmatic client 108 communicates with the web hosting application 122 via a programmatic interface provided by an application program interface (API) server 118. The third-party application 114 may be, for example, a service application that provides services to the client device 106. The web hosting application 122 provides the host web page with the service application to the network client 110 of the client device 106. The cross-border communication application 124 enables a network component in one iframe of the host web page to communicate with another network component in another iframe of the host web page.

[0036] The application server 116 is shown as being communicatively coupled with a database server 126, which facilitates access to an information repository or database 128. In the exemplary embodiment, the database 128 comprises a storage device that stores information to be published and / or processed by the web hosting application 122.

[0037] Additionally, a third-party application 114 executing on a third-party server 112 is shown having programmatic access to an application server 116 via a programming interface provided by an application program interface (API) server 118. For example, the third-party application 114, using information retrieved from the application server 116, may support one or more features or functions on a website hosted by the third party.

[0038] exist Figure 1 Shown in or with Figure 1 Any associated system or machine (e.g., database, device, server) may include or be implemented in a special-purpose (e.g., specialized or otherwise non-generic) computer that has been modified (e.g., configured or programmed by software, such as one or more software modules of an application, operating system, firmware, middleware, or other program) to perform one or more of the functions described herein for that system or machine. For example, the following reference Figure 5 A special-purpose computer system capable of realizing any one or more methods in the method described in this article has been discussed, and such a special-purpose computer can be a unit for executing any one or more methods in the method discussed in this article accordingly. In the technical field of such a special-purpose computer, compared with other special-purpose computers that lack the structure described in this article or cannot otherwise execute the function discussed in this article, the special-purpose computer that has been modified to execute the function discussed in this article by the structure described in this article has been improved in technology. Therefore, the technology of similar special-purpose machines has been improved according to the special-purpose machines configured with the system and method discussed in this article.

[0039] In addition, Figure 1 Any two or more of the systems or machines illustrated in the network environment 100 may be combined into a single system or machine, and the functionality described herein for any single system or machine may be subdivided into multiple systems or machines. Additionally, any number and type of client devices 106 may be embodied within the network environment 100. Furthermore, some components or functionality of the network environment 100 may be combined or located elsewhere in the network environment 100. For example, some functionality of the client device 106 may be embodied on the application server 116.

[0040] Figure 2 The cross-border communication application 124 according to an exemplary embodiment is illustrated. The cross-border communication application 124 includes an API module 202, a JSON object module 204, and a verification module 206. The API module 202 establishes a list of predefined APIs that the host can use to verify message requests from iframes. The JSON object module 204 detects that an API is called in a first iframe of a host web page. The JSON object module 204 constructs an object describing the called API from the first iframe and provides arguments (if any) for the function call.

[0041] The following code illustrates an example of a function call:

[0042] {

[0043] "foobar":{

[0044] "type":"_function_",

[0045] "name":"foobarFunctionName",

[0046] "args":{ ...

[0047] }

[0048] }

[0049] In another exemplary embodiment, the client device 106 includes the JSON object module 204 and constructs the object.

[0050] The first iframe sends the object to the host web page. The host web page then validates the object against a predefined or known API. In an exemplary embodiment, the validation module 206 validates the object against a known API signature from the API module 202. Once the validation module 206 validates the object, the host web page passes the object to a second iframe of the host web page. The frame in the second iframe will parse the object and convert it into a corresponding API call using the provided arguments (if any).

[0051] In another exemplary embodiment, if there are results that need to be communicated back to the first iframe, the frame in the second iframe will construct an object describing the results and send the object as a message to the host web page. The host web page validates the response and then sends it back to the first iframe.

[0052] Figure 3 An exemplary operation of a cross-border application according to an exemplary embodiment is illustrated. Inline frame A 304 sends a JSON object representing a function call for inline frame B 306. Host page 302 intercepts the JOSN object and sends it to the target inline frame (second inline frame B 306) with all the same data to process the JSON object. Inline frame B 306 receives and processes the JSON object. Specifically, inline frame B 306 looks for a predefined symbol for a function callback. Once inline frame B 306 verifies the predefined symbol for the function callback, inline frame B 306 forms an API identical to the API called in inline frame A 304. Note that inline frame A 304 and inline frame B 306 are located on the same domain A 308. The host (e.g., host page 302) is on a different domain. In another exemplary embodiment, inline frame A 304 and inline frame B 306 are from different domains.

[0053] Figure 44 is a sequence diagram 400 illustrating an exemplary operation of a cross-border application according to an exemplary embodiment. At operation 402, an API is called in an inline frame A 304. At operation 404, the framework of the network host page constructs an object describing the API and optionally provides arguments for the function call. "Frame" can refer to a web page sharing model (such as Microsoft's SharePoint Framework TM). At operation 406, the inline frame A 304 sends the object to the host page 302. At operation 408, the host page 302 verifies the object relative to a known or predefined API. At operation 410, once the host page 302 has verified the object, the host page 302 forwards the object to the inline frame B 306. At operation 412, the inline frame B 306 parses the object and converts the object into a corresponding API call with the provided arguments (if any). At operation 414, the inline frame B 306 constructs an object describing the result of the API call. At operation 416, the iframe B 306 sends the object or a message containing the object to the host page 302. At operation 418, the host page 302 validates the object received from the iframe B 306. At operation 420, the host page 302 forwards the object to the iframe A 304.

[0054] Figure 5 The method 500 for cross-border communication API according to an exemplary embodiment is illustrated. The operations in the method 500 can be performed by the cross-border communication application 124 or the web hosting application 122 using the above reference Figure 2 The method 500 is performed by the components (e.g., modules, engines) described herein. Therefore, the method 500 is described by reference to the example of the cross-border communication application 124. However, it should be appreciated that at least some of the operations of the method 500 can be deployed on various other hardware configurations or performed by similar components located elsewhere. For example, some of the operations can be performed at the web hosting application 122 or the third-party application 114.

[0055] At box 502, the API module 202 defines multiple APIs of the host to verify the message request from the iframe. At box 504, the cross-border communication application 124 establishes a message port with a network portion of the first iframe and a property pane of the second iframe. At box 506, the verification module 206 detects that an API (corresponding to one of the predefined APIs) is called in the first iframe. At box 508, the host page 302 calls an API corresponding to the API called in the first iframe in the second iframe. In another exemplary embodiment, the host page 302 calls an API at the second iframe based on the API called at the first iframe.

[0056] Figure 6 A method 600 for calling an API at a second iframe according to an exemplary embodiment is illustrated. The operations in the method 600 may be performed by the cross-border communication application 124 or the web hosting application 122 using the reference numerals in the above reference numerals. Figure 2 The method 600 is performed by the components (e.g., modules, engines) described herein. Therefore, the method 600 is described by reference to the example of the cross-border communication application 124. However, it should be appreciated that at least some of the operations of the method 600 may be deployed on various other hardware configurations or performed by similar components located elsewhere. For example, some of the operations may be performed at the web hosting application 122 or the third-party application 114.

[0057] The method 600 starts at a start block 604 and ends at an end block 614. At block 602, the JSON object module 204 constructs an object describing the API called in the first iframe. At block 606, the host receives the object from the first iframe. At decision block 608, the host verifies the object against a known API signature. If the object is verified at decision block 608, the host communicates the object to the second iframe at block 610. If the object is not verified at decision block 608, the method 600 ends at an end block 614. At block 612, the second iframe parses the object and converts the object into a corresponding API call with the provided arguments (if any).

[0058] Figure 7 A method 700 is illustrated for communicating the results of an API called at a second iframe back to a first iframe according to one embodiment. The operations in method 700 may be performed by a cross-border communication application 124 or a web hosting application 122 using the method described above with reference to Figure 2 The method 700 is performed by the components (e.g., modules, engines) described herein. Therefore, the method 700 is described by way of example with reference to the cross-border communication application 124. However, it should be appreciated that at least some of the operations of the method 700 may be deployed on various other hardware configurations or performed by similar components elsewhere. For example, some of the operations may be performed at the web hosting application 122 or the third-party application 114.

[0059] At block 702, the host receives a message from a second iframe. The message includes a result object describing the result of a call to an API at the second iframe. At block 704, the host validates the message from the second iframe based on a known API. At block 706, the host communicates the message to the first iframe.

[0060] Figure 8A routine 800 according to one embodiment is illustrated. In block 802, the routine 800 receives, at a host web page, a first object from a first iframe of the host web page, the first object identifying a first application programming interface (API). In block 804, the routine 800 validates the first object against a plurality of predefined APIs for the host web page via the host web page. In block 806, the routine 800, in response to validating the first object, forwards the first object to a second iframe of the host web page, the second iframe being configured to parse the first object and convert the parsed first object into a second API corresponding to the second iframe.

[0061] Fig. 9 900 is a schematic representation of a machine 900, within which instructions 908 (e.g., software, programs, applications, applet, app, or other executable code) may be executed to cause the machine 900 to perform any one or more of the methods discussed herein. For example, the instructions 908 may cause the machine 900 to perform any one or more of the methods described herein. The instructions 908 convert a general, unprogrammed machine 900 into a specific machine 900 that is programmed to perform the functions described and shown in the manner described. The machine 900 may operate as a standalone device or may be coupled (e.g., networked) to other machines. In a network deployment, the machine 900 may operate in the capacity of a server machine or a client machine in a server-client network environment, or as a peer machine in a peer-to-peer (or distributed) network environment. The machine 900 may include, but is not limited to, a server computer, a client computer, a personal computer (PC), a tablet computer, a laptop computer, a netbook, a set-top box (STB), a PDA, an entertainment media system, a cellular phone, a smart phone, a mobile device, a wearable device (e.g., a smart watch), a smart home device (e.g., a smart appliance), other smart devices, a network appliance, a network router, a network switch, a network bridge, or any machine capable of executing instructions 908, sequentially or otherwise, specifying actions to be taken by the machine 900. In addition, while only a single machine 900 is illustrated, the term "machine" should also be construed to include a collection of machines that individually or collectively execute instructions 908 to perform any one or more of the methodologies discussed herein.

[0062] The machine 900 may include a processor 902, a memory 904, and I / O components 942, which may be configured to communicate with each other via a bus 944. In an exemplary embodiment, the processor 902 (e.g., a central processing unit (CPU), a reduced instruction set computing (RISC) processor, a complex instruction set computing (CISC) processor, a graphics processing unit (GPU), a digital signal processor (DSP), an ASIC, a radio frequency integrated circuit (RFIC), another processor, or any suitable combination thereof) may include, for example, a processor 906 that executes instructions 908 and a processor 910. The term "processor" is intended to include multi-core processors that may include two or more independent processors (sometimes referred to as "cores") that may execute instructions simultaneously. Although Fig. 9 Multiple processors 902 are shown, but the machine 900 may include a single processor with a single core, a single processor with multiple cores (e.g., a multi-core processor), multiple processors with a single core, multiple processors with multiple cores, or any combination thereof.

[0063] The memory 904 includes a main memory 912, a static memory 914, and a storage unit 916, all of which are accessible to the processor 902 via the bus 944. The main memory 904, the static memory 914, and the storage unit 916 store instructions 908 embodying any one or more of the methods or functions described herein. During execution of the instructions by the machine 900, the instructions 908 may also reside, in whole or in part, within the main memory 912, within the static memory 914, within the machine-readable medium 918 within the storage unit 916, within at least one of the processors 902 (e.g., within a cache of the processor), or any suitable combination thereof.

[0064] The I / O components 942 may include a variety of components to receive input, provide output, generate output, send information, exchange information, capture measurements, etc. The specific I / O components 942 included in a particular machine will depend on the type of machine. For example, a portable machine such as a mobile phone may include a touch input device or other such input mechanism, while a headless server machine may not include such a touch input device. It will be appreciated that the I / O components 942 may be included in Fig. 9928 and an input component 930. In various exemplary embodiments, the I / O component 942 may include an output component 928 and an input component 930. The output component 928 may include a visual component (e.g., a display such as a plasma display panel (PDP), a light emitting diode (LED) display, a liquid crystal display (LCD), a projector, or a cathode ray tube (CRT)), an acoustic component (e.g., a speaker), a tactile component (e.g., a vibration motor, a resistance mechanism), other signal generators, etc. The input component 930 may include an alphanumeric input component (e.g., a keyboard, a touch screen configured to receive alphanumeric input, an optical keyboard, or other alphanumeric input component), a point-based input component (e.g., a mouse, a touch pad, a trackball, a joystick, a motion sensor, or other pointing tool), a tactile input component (e.g., a physical button, a touch screen that provides the location and / or force of a touch or touch gesture, or other tactile input component), an audio input component (e.g., a microphone), etc.

[0065] In another exemplary embodiment, the I / O component 942 may include a biometric component 932, a motion component 934, an environment component 936, or a position component 938, as well as a variety of other components. For example, the biometric component 932 includes components for detecting expressions (e.g., hand expressions, facial expressions, voice expressions, body gestures, or eye tracking), measuring biosignals (e.g., blood pressure, heart rate, body temperature, sweat, or brain waves), identifying individuals (e.g., voice recognition, retinal recognition, facial recognition, fingerprint recognition, or EEG-based recognition), etc. The motion component 934 includes an acceleration sensor component (e.g., an accelerometer), a gravity sensor component, a rotation sensor component (e.g., a gyroscope), etc. The environmental component 936 includes, for example, an illumination sensor component (e.g., a photometer), a temperature sensor component (e.g., one or more thermometers that detect ambient temperature), a humidity sensor component, a pressure sensor component (e.g., a barometer), an acoustic sensor component (e.g., one or more microphones that detect background noise), a proximity sensor component (e.g., an infrared sensor that detects nearby objects), a gas sensor (e.g., a gas detection sensor for detecting hazardous gas concentrations for safety or measuring pollutants in the atmosphere), or other components that can provide indications, measurements, or signals corresponding to the surrounding physical environment. The position component 938 includes a position sensor component (e.g., a GPS receiver component), an altitude sensor component (e.g., an altimeter or barometer that detects air pressure from which altitude can be derived), a direction sensor component (e.g., a magnetometer), and the like.

[0066] A variety of technologies may be used to achieve communication. I / O components 942 also include communication components 940, which are operable to couple machine 900 to network 920 or device 922 via coupling 924 and coupling 926, respectively. For example, communication components 940 may include a network interface component or another suitable device that interfaces with network 920. In other examples, communication components 940 may include a wired communication component, a wireless communication component, a cellular communication component, a near field communication (NFC) component, Components (e.g. Low energy), Components, and other communication components that provide communication via other modalities. Device 922 can be another machine or any of a variety of peripheral devices (eg, a peripheral device coupled via USB).

[0067] In addition, the communication component 940 can detect an identifier or include a component operable to detect an identifier. For example, the communication component 940 can include a radio frequency identification (RFID) tag reader component, an NFC smart tag detection component, an optical reader component (e.g., an optical sensor for detecting a one-dimensional barcode such as a universal product code (UPC) barcode, a multi-dimensional barcode (e.g., a Quick Response (QR) code, Aztec code, Data Matrix, Dataglyph, MaxiCode, PDF417, Ultra Code, UCC RSS-2D barcode, and other optical codes), or an acoustic detection component (e.g., a microphone to recognize an audio signal of a tag). In addition, various information can be derived via the communication component 940, such as a location via an Internet Protocol (IP) geographic location, a location via a ... The location of signal triangulation, the location of an NFC beacon signal via detection that can indicate a specific location, and the like.

[0068] Various memories (e.g., memory 904, main memory 912, static memory 914, and / or memory of processor 902) and / or storage unit 916 may store one or more sets of instructions and data structures (e.g., software) embodying any one or more of the methods or functions described herein or used by them. These instructions (e.g., instructions 908) when executed by processor 902, cause various operations to implement the disclosed embodiments.

[0069] Instructions 908 may be sent or received over network 920 using a transmission medium via a network interface device (e.g., a network interface component included in communication component 940) and using any of a number of known transmission protocols (e.g., Hypertext Transfer Protocol (HTTP)). Similarly, instructions 908 may be sent or received to device 922 via coupling 926 (e.g., a peer-to-peer coupling) using a transmission medium.

[0070] Although the embodiments have been described with reference to specific exemplary embodiments, it is apparent that various modifications and changes may be made to these embodiments without departing from the broader scope of the present disclosure. Therefore, the specification and the drawings should be considered illustrative rather than restrictive. The drawings forming a part thereof illustrate specific embodiments in which the present subject matter can be practiced in an illustrative rather than a limiting manner. The illustrated embodiments are described in sufficient detail to enable those skilled in the art to practice the teachings disclosed herein. Other embodiments may be utilized and derived therefrom so that structural and logical substitutions and changes may be made without departing from the scope of the present disclosure. Therefore, this detailed description should not be understood in a limiting sense, and the scope of the various embodiments is limited only by the appended claims and the full scope of equivalents to which these claims are assigned.

[0071] Here, these embodiments of the subject matter of the present invention may be referred to individually and / or in their entirety by the term "invention", only for convenience, and without any intention to limit the scope of the present application to any single invention or inventive concept when more than one invention is actually disclosed. Therefore, although specific embodiments have been illustrated and described herein, it should be understood that any arrangement calculated to achieve the same purpose may replace the specific embodiments shown. This disclosure is intended to cover any and all modifications or variations of the various embodiments. By reading the above description, the combination of the above embodiments and other embodiments not specifically described herein will be apparent to those skilled in the art.

[0072] An abstract of the present disclosure is provided to allow the reader to quickly determine the nature of the technical disclosure. This document is submitted with the understanding that it will not be used to interpret or limit the scope or meaning of the claims. In addition, in the foregoing detailed description, it can be seen that various features are combined together in a single embodiment for the purpose of simplifying the present disclosure. This method of the present disclosure should not be interpreted as reflecting the following intention: the claimed embodiments require more features than the features explicitly recited in each claim. Rather, as reflected in the attached claims, the subject matter of the invention lies in less than all the features of a single disclosed embodiment. Therefore, the following claims are hereby incorporated into the detailed description, with each claim independently serving as a separate embodiment.

[0073] Example

[0074] Example 1 is a computer-implemented method, comprising: receiving a first object at a host web page from a first inline frame of the host web page, the first object identifying a first application programming interface (API); validating the first object relative to a plurality of predefined APIs for the host web page by the host web page; and in response to validating the first object, forwarding the first object to a second inline frame of the host web page, the second inline frame being configured to parse the first object and convert the parsed first object into a second API corresponding to the second inline frame.

[0075] In Example 2, the subject matter of Example 1 also includes: receiving a message from the second iframe, the message including a second object describing a result of calling the second API in the second iframe; validating the message at the host web page; and in response to validating the message, forwarding the message to the first iframe.

[0076] In Example 3, the subject matter of Example 2, wherein the first iframe includes a network component item, the network component item includes a server-side controlled application operating within the first iframe, and wherein the second iframe includes a configuration pane of the host web page, the configuration pane is configured to be presented within the second iframe.

[0077] In Example 4, the subject matter of Example 1, wherein the first inline frame includes a first network component item configured to operate within the first inline frame, and wherein the second inline frame includes a second network component item configured to operate within the second inline frame.

[0078] In Example 5, the subject matter of Example 1 further includes: establishing a first message port between the host web page and the first iframe; and forming a second message port between the host web page and the second iframe.

[0079] In Example 6, the subject matter of Example 1, wherein the first object further includes an independent variable for calling a function corresponding to the first API, and wherein the second iframe is configured to parse the first object and convert the first object to the second API using the independent variable from the first object.

[0080] In Example 7, the subject matter of Example 1, wherein a framework of the first iframe at the host webpage is configured to construct the first object in response to the first iframe calling the first API.

[0081] In Example 8, the subject matter of Example 2, wherein a framework of the second iframe at the host webpage is configured to construct the second object in response to calling the second API at the second iframe.

[0082] In Example 9, the subject matter of Example 1 further includes: forming a list of a plurality of predefined APIs that can be used to authenticate the request from the first iframe.

[0083] In Example 10, the subject of Example 1 also includes: defining multiple public application programming interfaces (APIs) for multiple hosts, and the APIs are configured to verify message requests between the multiple hosts; establishing a message port using a network component of the first embedded frame and a property pane of the second embedded frame; detecting a call to an API among the multiple public APIs at the first embedded frame; and calling the API at the second embedded frame based on the API called at the first embedded frame.

Claims

1. A computing device, comprising: processor; as well as a memory storing instructions that, when executed by the processor, configure the apparatus to: receiving, at a host webpage, a first object from a first iframe of the host webpage, the first object identifying a first application programming interface (API); authenticating the first object via the host webpage relative to a plurality of predefined APIs for the host webpage; as well as In response to validating the first object, forwarding the first object to a second iframe of the host webpage, the second iframe being configured to parse the first object and convert the parsed first object into a second API corresponding to the second iframe, wherein the first embedded frame includes a network component item, the network component item includes a server-side controlled application operating in the first embedded frame, and The second iframe includes a configuration pane of the host webpage, and the configuration pane is configured to be presented inside the second iframe.

2. The computing device according to claim 1, wherein: The instructions further configure the apparatus to: receiving a message from the second iframe, the message comprising a second object describing a result of calling the second API in the second iframe; verifying the message at the host web page; as well as Responsive to validating the message, the message is forwarded to the first iframe.

3. The computing device according to claim 1, in, The first inline frame comprises a first network component item configured to operate within the first inline frame, and The second embedded frame includes a second network component item configured to operate within the second embedded frame.

4. The computing device according to claim 1, wherein: The instructions further configure the apparatus to: Establishing a first message port between the host web page and the first iframe; and A second message port is formed between the host web page and the second iframe.

5. The computing device according to claim 1, wherein: The first object also includes an argument for invoking a function corresponding to the first API, and The second iframe is configured to parse the first object and convert the first object into the second API using the arguments from the first object.

6. The computing device according to claim 1, wherein: The framework of the first iframe at the host webpage is configured to construct the first object in response to the first iframe calling the first API.

7. The computing device according to claim 2, wherein: The framework of the second iframe at the host webpage is configured to construct the second object in response to the second API being called at the second iframe.

8. The computing device according to claim 1, wherein: The instructions further configure the apparatus to: forming a list of the predefined plurality of APIs that can be used to authenticate a request from the first iframe; A visualization of the summarized changes is provided in a graphical user interface.

9. The computing device of claim 1, wherein: The instructions further configure the apparatus to: defining a plurality of common application programming interfaces (APIs) for a plurality of hosts, the APIs being configured to authenticate message requests between the plurality of hosts; establishing a message port using a network component of the first iframe and a property pane of the second iframe; Detecting that an API among the plurality of public APIs is called at the first iframe; and The API is called at the second iframe based on the called API at the first iframe.

10. A machine-readable medium carrying processor-readable instructions which, when executed by at least one processor of a machine, cause the machine to perform the operations according to any one of claims 1 to 9.

11. A computer-implemented method comprising: receiving, at a host webpage, a first object from a first iframe of the host webpage, the first object identifying a first application programming interface (API); authenticating the first object via the host webpage relative to a plurality of predefined APIs for the host webpage; as well as In response to validating the first object, forwarding the first object to a second iframe of the host webpage, the second iframe being configured to parse the first object and convert the parsed first object into a second API corresponding to the second iframe, wherein the first embedded frame includes a network component item, the network component item includes a server-side controlled application operating in the first embedded frame, and The second iframe includes a configuration pane of the host webpage, and the configuration pane is configured to be presented inside the second iframe.

12. The computer-implemented method of claim 11 , further comprising: receiving a message from the second iframe, the message comprising a second object describing a result of calling the second API in the second iframe; verifying the message at the host web page; as well as Responsive to validating the message, the message is forwarded to the first iframe.

13. The computer-implemented method of claim 11, in, The first inline frame comprises a first network component item configured to operate within the first inline frame, and The second embedded frame includes a second network component item configured to operate within the second embedded frame.

Images