Inserting and replacing placeholders in resource code

Abstract

A proxy receives (402) a request for a resource from a client and verifies (404) authentication credentials included therein. The agent determines (406) a placeholder value indicating that the authentication credential is validated and determines (408) that the requested resource corresponds to a first modified version of the resource stored in memory accessible by the agent, the first modified version comprising a code component comprising a placeholder inserted by the agent. The agent replacing the placeholder with the first placeholder value to generate (412) a second modified version of the resource; and sending (414) the second modified version of the resource to the client. In another aspect, a client-side proxy service detects an event in a modified version of a web page, inserts a placeholder in code of the web page, replaces the placeholder with a placeholder value, and evaluates the modified code.

Description

CROSS-REFERENCE TO RELATED APPLICATIONS

[0001] This application claims priority to Indian Provisional Application No. 202311037669, filed on May 31, 2023, titled “Inserting and replacing placeholders in resource code”, the entire contents of which are incorporated herein by reference. Background Art

[0002] A web server is a service operating in a computing device that accepts requests (e.g., via HTTP (Hypertext Transfer Protocol) or its secure variant HTTPS (HTTP Secure)) and, in response, returns web content (e.g., web pages). A web proxy located between a web server executing on a server and a web browser executing on a client device can monitor interactions between the two parties and enforce security policies for those interactions. For example, a web proxy can intercept resource requests issued from a web browser and, based on a series of access control protocols, manage what the user of the web browser can access and interact with regarding a particular set of resources. Some proxies can modify the code included in a web page received from a web server before passing the web page to the web browser. Modifying the code can be a resource-intensive and time-consuming task. Summary of the Invention

[0003] This Summary is provided to introduce a selection of concepts in a simplified form that are further described below in the Detailed Description. This Summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used to limit the scope of the claimed subject matter.

[0004] This document describes an embodiment for inserting and replacing placeholders in code included in a resource. In one aspect of the present disclosure, an agent receives a first request for a resource from a client. The first request includes authentication credentials. The agent verifies the authentication credentials and determines a first placeholder value indicating that the authentication credentials are verified. The agent determines that the requested resource corresponds to a first modified version of the resource stored in a memory accessible to the agent computing device. The first modified version includes a code component that includes a first placeholder inserted by the agent. The agent retrieves the first modified version. A second modified version of the resource is generated by replacing the placeholder in the code component with the first placeholder value. The second modified version of the resource is sent to the first client.

[0005] In another example aspect, an agent receives a resource from a server, identifies a code component included in the resource, generates a first modified version of the resource by inserting a first placeholder into the identified code component, and stores the first modified version of the resource in a memory.

[0006] In another example aspect, the proxy receives a second request for a resource from a second client. A second placeholder value is determined based on the received second request. A first modified version of the resource is retrieved. A third modified version of the resource is generated by replacing the first placeholder value with the second placeholder value in the code component.

[0007] In another example aspect, the identified code component includes a static import statement.

[0008] In another aspect of the present disclosure, a browser of a client includes a client-side proxy service. The browser receives a modified version of a web page. The modified version of the web page includes an embed function and a code rewrite function that are not included in the web page (e.g., the original version of the web page). An event associated with the embed function and the code component in the web page is detected. The embed function generates a first modified version of the code component by inserting a placeholder in the code component. The authentication credentials are verified, and a placeholder value indicating that the authentication credentials are verified is determined. The code rewrite function generates a second modified version of the code component by replacing the placeholder in the first modified version of the code component with the placeholder value. The second modified version of the code component is evaluated.

[0009] Other features and advantages of the present invention, as well as the structure and operation of various embodiments of the present invention, are described in detail below with reference to the accompanying drawings. Note that the present invention is not limited to the specific embodiments described herein. Such embodiments are presented herein for illustrative purposes only. Additional embodiments will be apparent to those skilled in the relevant art based on the teachings contained herein. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] The accompanying drawings, which are incorporated herein and form a part of the specification, illustrate the embodiments and, together with the description, further serve to explain the principles of the embodiments and to enable one skilled in the relevant art to make and use the embodiments.

[0011] Figure 1 is a block diagram of an example system that enables redirection of requests directed to a web server to a proxy service, according to an embodiment.

[0012] Figure 2 is a block diagram of an example system according to an embodiment, wherein a proxy computing device is interconnected between a client computing device and a server computing device, wherein the proxy computing device executes a proxy service, the client computing device executes a web browser, and the server computing device executes a web server.

[0013] Figure 3 Depicted is a flow diagram of a process for generating and storing a modified version of a resource, according to an embodiment.

[0014] Figure 4ADepicted is a flow diagram of a process for modifying a stored modified version of a resource, according to an embodiment.

[0015] Figure 4B Depicted is a flow diagram of a process for storing placeholder values, according to an embodiment.

[0016] Figure 4C Depicted is a flow diagram of a process for modifying a resource in accordance with an embodiment.

[0017] Figure 5 Depicted is a block diagram of an example system that generates modified resources from stored resources in accordance with an embodiment.

[0018] Figure 6 Depicted is a flow diagram of a process for modifying a stored modified version of a resource, according to an embodiment.

[0019] Figure 7 is a block diagram of an example system according to an embodiment, wherein a proxy computing device is interconnected between a client computing device and a server computing device, wherein the proxy computing device executes a proxy service, the client computing device executes a web browser including a client-side proxy service, and the server computing device executes a web server.

[0020] Figure 8 Depicted is a flow diagram of a process for modifying a resource by a client-side proxy service, according to an embodiment.

[0021] Figure 9 Depicted is a flowchart of a process for generating a second modified version of a code component, according to an embodiment.

[0022] Figure 10 Depicted is a flow diagram of a process for storing placeholder values, according to an embodiment.

[0023] Figure 11 Depicted is a flow diagram of a process for requesting a web page, according to an embodiment.

[0024] Figure 12 is a block diagram of an example computing device that can be used to implement an embodiment.

[0025] The features and advantages of the present invention will become more apparent from the detailed description set forth below in conjunction with the accompanying drawings, in which like reference numerals identify corresponding elements throughout. In the drawings, like reference numerals generally indicate identical, functionally similar, and / or structurally similar elements. The drawing in which an element first appears is indicated by the leftmost digit in the corresponding reference numeral. DETAILED DESCRIPTION I. Introduction

[0026] The following detailed description discloses a number of example embodiments. The scope of this patent application is not limited to the disclosed embodiments, but also includes combinations of the disclosed embodiments and modifications to the disclosed embodiments. It should be noted that any section / subsection headings provided herein are not intended to be limiting. Embodiments are described throughout this document, and any type of embodiment may be included under any section / subsection. In addition, the embodiments disclosed in any section / subsection may be combined in any manner with any other embodiment described in the same section / subsection and / or different sections / subsections. II. Example Embodiments

[0027] Some web proxies intercept transmissions between a web server and a client device and rewrite a portion of the resource included in the transmission (e.g., a web page). For example, a suffix proxy can rewrite navigation functionality (e.g., JavaScript navigation) and Ajax actions in a web page to modify the (e.g., suffix or non-suffix) URL of a target application. As another example, a security proxy rewrites code in a resource to enforce a security policy. For example, a security proxy can rewrite code in a resource to detect actions performed in a client browser that should be evaluated according to a security policy (e.g., file upload or download events occurring in the client browser (e.g., without interacting with a web server)).

[0028] To rewrite the code, the web proxy parses the resources received from the web server before the resources are passed to the web browser executing on the client device. The web proxy identifies the code of interest and packages the code to generate the modified resources. Parsing, identifying the code of interest, and generating the modified resources are resource-intensive tasks that may consume a lot of time, especially when the code size is large. This may adversely affect the web proxy's ability to quickly deliver web pages. As the web proxy expands to more and more users, this task may become a significant bottleneck for the proxy.

[0029] Embodiments of the present disclosure implement the insertion and replacement of placeholders in code included in a resource. For example, the embodiments described herein include a proxy computing device interconnected between a client computing device and a server computing device, which receives a resource from the server computing device. In one aspect of the present disclosure, the proxy computing device receives a resource from the server computing device. The proxy computing device identifies a code component included in the resource and generates a first modified version of the resource by inserting a placeholder in the identified code component. The proxy computing device stores the first modified version of the resource (e.g., in a memory accessible to the proxy computing device). In another aspect, the proxy computing device receives a request for the resource from the client computing device, the request including authentication credentials. The proxy computing device verifies the authentication credentials and determines a first placeholder value indicating that the authentication credentials are verified. The proxy computing device retrieves the first modified version of the resource from the memory and generates a second modified version of the resource by replacing the placeholder with the first placeholder value. The proxy computing device sends the second modified version of the resource to the first client computing device.

[0030] The technology described herein provides a multi-step code rewriting process that includes inserting placeholders into a resource (thereby generating a first modified version of the resource) and replacing the inserted placeholders with corresponding placeholder values ​​(thereby generating a second modified version of the resource). Furthermore, the first modified version of the resource is stored in a memory (e.g., a cache) accessible to a proxy service, enabling the proxy service to retrieve (e.g., obtain or otherwise access) the stored version of the first modified version of the resource, so that future rewrites do not have to parse the resource to identify code components (e.g., code of interest). Instead, future rewrites obtain the stored version of the resource and replace the placeholders with placeholder values ​​that satisfy requests for the resource. Furthermore, the web proxy can store placeholder values ​​for multiple clients, authentication sessions, regions, contexts, and other criteria described herein. In this context, the web proxy can dynamically replace placeholders in the stored version of the resource with placeholder values ​​based on attributes of the client computing device (or an application executing on it, a user associated with the client computing device, a user account of the user, etc.).

[0031] To help illustrate the aforementioned systems and methods, the following will now be described. Figure 1 In particular, Figure 1 1 is a block diagram of a system 100 that enables redirecting requests directed to a web server to a proxy service, according to an embodiment. Figure 1 As shown, the system 100 includes a cloud service network 102 and a client computing device 114. Figure 1As further shown, cloud service network 102 includes a server computing device 104, an identity provider 108, and a proxy computing device 110. Server computing device 104 is configured to execute a web server 106, proxy computing device 110 is configured to execute a proxy service 112, and client computing device 114 is configured to execute a web browser 116. These components of system 100 are described in further detail below.

[0032] exist Figure 1 , web server 106 implements an application or service capable of providing resources, including web pages, to clients such as client computing devices 114. Although web server 106 is shown as being implemented on a single server computing device 104, in alternative embodiments, web server 106 may be implemented on multiple server computing devices and / or one or more other computing devices.

[0033] The identity provider 108 is a computer-implemented system that creates, maintains, and manages identity information associated with users while providing authentication services to web services. The identity provider 108 can be implemented, for example, on one or more server computing devices.

[0034] The proxy service 112 is a computer-implemented system that monitors and manages the interactions between an application or service implemented by the web server 106 and its users. Figure 1 As shown, the proxy service 112 includes a resource modifier 118 and a placeholder service 120. The resource modifier 118 modifies the resource received from the web server 106 to be provided to the web browser 116 by inserting placeholders in the resource, as described elsewhere herein. The placeholder service 120 replaces the placeholders in the modified resource with placeholder values, as described elsewhere herein. Although the proxy service 112 is shown as being implemented on a single proxy computing device 110, in alternative embodiments, the proxy service 112 can be implemented on multiple proxy computing devices and / or one or more other computing devices. For example, according to an alternative embodiment, the resource modifier 118 executes on a first proxy computing device, and the placeholder service 120 executes on a second proxy computing device.

[0035] Each component of the cloud service network 102 and the client computing device 114 can communicate via one or more networks ( Figure 1 The one or more networks may include, for example, but not limited to, one or more of a local area network (LAN), a wide area network (WAN), a personal area network (PAN), a private network, a public network, a packet network, a circuit-switched network, a wired network, and / or a wireless network.

[0036] The client computing device 114 can be any type of computing device, including fixed or mobile computing devices. Examples of fixed computing devices include, but are not limited to, desktop computers, personal computers (PCs), video game consoles, or smart appliances (e.g., smart TVs). Examples of mobile computing devices include, but are not limited to, smartphones, laptops, notebooks, tablets, netbooks, or wearable computing devices (e.g., smart watches, head-mounted devices including smart glasses, etc.).

[0037] like Figure 1 As shown, the web browser 116 of the client computing device 114 submits a request 122 to the web server 106 of the server computing device 104 requesting its resources. According to an embodiment, the request 120 is submitted on behalf of a user of the client computing device 114.

[0038] In response to receiving request 120, web server 106 determines that the user has not been authenticated and provides a response 124 to web browser 116, which causes web browser 116 to send a request 126 to identity provider 108 for user authentication. For example, web server 106 according to an embodiment redirects web browser 116 to identity provider 108 in response to determining that required authentication credentials (e.g., an authentication artifact (e.g., a token)) were not provided with request 122.

[0039] After receiving the request 126, the identity provider 108 determines whether the web browser 116 should access the resource via the proxy service 112 based on the access policy. The access policy may outline which users, user groups, and / or web services' network cloud traffic should be routed to the proxy service 112 for monitoring and / or management. According to an embodiment, an information technology (IT) administrator for an organization sets access policies for applications and users of client computing devices accessing the organization's computer network. As a non-limiting example, assume that the identity provider 108 evaluates a user's login (e.g., username and password) and determines that there is a policy associated with the user indicating that the user should access the resource via the proxy service 112.

[0040] The identity provider 108 further authenticates the user associated with the request 126 and creates an authentication credential (e.g., a token) that the web server 106 can use to determine whether the user should be authorized to access the resource. In some embodiments, during authentication, the identity provider 108 prompts the user to provide his or her user login credentials. After determining that the web browser 116 should access the resource via the proxy service 112 (e.g., a security proxy that enforces access policies), the identity provider 108 sends a response 128 to the web browser 116, which includes an encrypted version of the authentication credential, and redirects the web browser 116 to send a request 130 including such encrypted authentication credential to the proxy service 112. According to an embodiment, the authentication credential (or encrypted authentication credential) is signed with the private key of the identity provider 108.

[0041] In response to receiving the redirect request 130, the proxy service 112 decrypts the authentication artifact (and optionally determines whether the signature of the authentication credentials is valid (e.g., using a public key corresponding to a private signing key)), generates a corresponding request 132 including the decrypted authentication artifact, and provides the request 132 to the web server 106. According to an embodiment, the request 132 includes a placeholder value (or multiple placeholder values). Alternatively, the proxy service 112 (or placeholder service 120) determines the placeholder value (or multiple placeholder values) based on analyzing the request 132 and / or data included in the request 132. According to an embodiment, the proxy service 112 stores the placeholder value in a service-accessible memory (e.g., a storage medium). Figure 1 For additional details on receiving, determining, and storing placeholder values, see Figure 4A and Figure 4B and discussed elsewhere in this paper.

[0042] The web server 106 can grant or deny access to the resource based on the authentication artifact. If access is granted, the web server 106 can interpret the request 132, generate a response 134 to the request 132, and send the response 134 to the proxy service 112. In some embodiments, the response 134 can include a file stored on the web server 106 or output from a program executed on the web server 106. In other embodiments, if the request cannot be satisfied, the response 134 can include an error message.

[0043] After receiving response 134, proxy service 112 may generate response 136 (e.g., a response including a web page) and send response 136 to web browser 116. In response to receiving response 136, web browser 116 may interpret response 136 and display the contents of response 136 for a user of client computing device 114 on a window of web browser 116 (e.g., when response 136 includes a web page). Response 136 may be the same as response 134 or a response modified by proxy service 112. For example, according to an embodiment, resource modifier 118 modifies a resource (e.g., a web page) included in response 134 by identifying a code component included in the resource and inserting a placeholder in the identified code component. Placeholder service 120 replaces the placeholder inserted by resource modifier 118 with the first placeholder value to generate a second modified version of the resource, and proxy service 112 includes the second modified version of the resource in response 136. For further details on modifying resources, refer to Figures 2 to 4A and Figure 4C and discussed elsewhere herein. According to another embodiment, and as with respect to Figures 7 to 11 As depicted, the proxy service 112 includes placeholder values, embedded functionality, and / or code rewriting functionality in the response 136 .

[0044] Any other requests related to accessing resources of web server 106 and originating from web browser 116 during the user's proxy session can be directed to proxy service 112, and any responses to other requests generated by proxy service 112 can be issued by proxy service 112 to web browser 116 on behalf of web server 106.

[0045] In some embodiments, the proxy service 112 can be configured to act as a suffix proxy. A suffix proxy enables a user to access content via a proxy server by appending the name of the proxy server to the domain URL of the requested content. For example, if a web page uses the domain URL "targetaplication.com" to identify the source of the content, the proxy service 112 can rename the domain URL so that the renamed domain URL appears as the domain URL "targetaplication.com.proxyserver".

[0046] In the embodiments, and as with respect to Figure 2 and Figure 3 As discussed elsewhere herein, proxy service 112 stores the modified version of the resource generated by resource modifier 118 (e.g., the resource included in response 134) in memory accessible to proxy service 112 (e.g., Figure 1By storing the modified version generated by resource modifier 118, proxy service 112 rewrites the resource in response to future requests without having to parse the resource to identify the code component. Instead, placeholder service 120 retrieves the stored modified version and replaces the placeholder with a placeholder value that satisfies future requests. Figure 5 and Figure 6 As further discussed, the proxy service 112 may dynamically replace placeholders of a stored version of a resource with placeholder values ​​for multiple client computing devices. III. Example Proxy Server Embodiment

[0047] As described herein, some embodiments of the proxy service include resource modifiers and placeholder modifiers for modifying resources to be provided to a web browser. To help further illustrate these features of the proxy service according to embodiments, the following will now be described. Figure 2 . Specifically, Figure 2 is a block diagram of an example system 200 (hereinafter referred to as "system 200") according to an embodiment, wherein a proxy computing device is interconnected between a client computing device and a server computing device, wherein the proxy computing device performs a proxy service, the client computing device performs a web browser, and the server computing device performs a web server. Figure 2 As shown, the system 200 includes: a client computing device 114 (including a web browser 116), an agent computing device 110 (including an agent service 112), and a server computing device 104 (including a web server 106), as described above with respect to Figure 1 As described, and data storage 206. Figure 2 As further shown in FIG. 1 , the proxy service 112 includes a resource modifier 118 and a placeholder service 120, as described above with respect to Figure 1 As described above, and request interface 236. Figure 2 As shown, the resource modifier 118 includes a placeholder initialization service 202 and a rewrite engine 204, and the request interface 236 includes a validator 238 and a request analyzer 240. Figure 2 As shown, the proxy service 112 receives the resource 218 and outputs the modified resource 230. The resource 218 includes code 232, and the modified resource 230 includes the code 232 with the modified code component 234, as described elsewhere herein. According to an embodiment, and as described with respect to Figures 7 to 11 As further discussed, the modified resource 230 includes one or more placeholder values, embedded functions, and / or code rewrite functions.

[0048] As referenced above Figure 1 As discussed, the proxy computing device 110 communicates via one or more networks ( Figure 2104) are communicatively interconnected between the client computing device 114 and the server computing device 104. Figure 1 The described process establishes itself as an intermediary for the client computing device 114 and the server computing device 104 .

[0049] The data store 206 stores one or more placeholders 208 (hereinafter "placeholders 208"), one or more placeholder values, and cached resources 212. Figure 2 As shown, the data store 206 is external to the proxy computing device 110 ; however, it is also contemplated that all or a portion of the data store 206 may be internal to the proxy computing device 110 .

[0050] For illustrative purposes, Figure 3 System 200 is described. Figure 3 A flowchart 300 is depicted of a process for generating and storing a modified version of a resource according to an embodiment. In an embodiment, Figure 2 The system 200 can operate according to the flowchart 300. Not all steps of the flowchart 300 need to be performed in all embodiments. Figure 2 and Figure 3 From the following description, further structural and operational embodiments will be apparent to those skilled in the relevant art.

[0051] Flowchart 300 begins at step 302. In step 302, a resource is received from a server computing device. For example, a resource executed on proxy computing device 110 Figure 2 The proxy service 112 receives the resource 218 from the web server 106 of the server computing device 104. The proxy service 112 can receive the resource 218 in various ways. For example, Figure 2 As shown, the request interface 236 of the proxy service 112 receives the request 214 from the web browser 116 (e.g., in response to the identity provider having determined, based on the access policy, that the request 214 should be redirected to the proxy service 112, and / or during an active proxy session between the web browser 116 and the proxy service 112). According to an embodiment, the request 214 includes authentication credentials (e.g., Figure 114). In this context, in response to receiving the request 214, the validator 238 validates the authentication credentials. If the authentication credentials are validated, the validator 238 provides a signal 242 to the request analyzer 240 indicating that the authentication credentials are validated. According to an embodiment, the signal 242 includes the request 214, the authentication credentials, an indication that the authentication credentials are validated, an indicator of the requested resource (e.g., a resource identifier (ID)), and / or any other information associated with the request 214 and / or the validation of the credentials included therein. The request analyzer 240 analyzes the signal 242 to determine whether the requested resource corresponds to a modified version of a stored resource. For additional details on determining whether the requested resource corresponds to a modified version of a stored resource, refer to Figure 4A and Figure 4C and discussed elsewhere in this article.

[0052] If the request analyzer 240 determines that the resource requested in the request 214 does not correspond to a modified version of the stored resource, the proxy service 112 issues a corresponding request 216 to the web server 106, requesting that the web server 106 fulfill the request 214. The proxy service 112 receives a response corresponding to the request 216 from the web server 106, including the resource 218. Figure 2 As shown, resources 218 include code 232 (eg, JavaScript code). According to an embodiment, code 232 includes one or more code components for implementing various actions as described elsewhere herein.

[0053] In step 304, code components included in the resource are identified. For example, the rewrite engine 204 of the resource modifier 118 receives the resource 218, analyzes the code 232, and identifies the code components included in the code 232. According to an embodiment, the rewrite engine 204 identifies code components of interest. Example code components of interest include, but are not limited to, code components corresponding to URLs to be rewritten, code components corresponding to credentials to be included therein, code components corresponding to context to be included therein, and / or code components that implement actions of interest to the proxy service 112. Example actions of interest include, but are not limited to, navigation actions, file download actions, file upload actions, asynchronous JavaScript and XML (AJAX) actions, and / or any other actions that may be of interest to the proxy service 112. According to an embodiment, the rewrite engine 204 identifies multiple code components of interest.

[0054] In an embodiment, the rewrite engine 204 identifies code components in various ways. For example, the rewrite engine 204 according to an embodiment extracts code components from the code 232 of the resource 218 and organizes the code components into an abstract syntax tree (AST). The AST is a tree representation of the abstract syntax structure of code (e.g., code 232) written in a programming language. Each node of the AST can represent a construct that appears in the code, and the connections between the nodes can represent dependencies between such constructs. The rewrite engine 204 traverses the AST to identify nodes of interest to the proxy service 112 from a management or monitoring perspective, and therefore targets the packaged code components for replacement, as described elsewhere herein.

[0055] According to an embodiment, the rewrite engine 204 identifies components by identifying static import statements. As a non-limiting running example, assume that the code 232 includes the following code: In this example, rewrite engine 204 identifies each static “import” statement as an identified code component in step 304 .

[0056] In step 306, a first modified version of the resource is generated by inserting a first placeholder into the identified code component. For example, the rewrite engine 204 generates a first modified version of the resource 218, namely, the modified resource 226, by inserting one or more placeholders into the code component identified in step 304. The placeholders correspond to information to be inserted into the identified code component, as described elsewhere herein (e.g., with respect to FIG. 4 through FIG. 5 ). Figure 6 、 Figure 8and elsewhere herein). Examples of placeholders include, but are not limited to, a suffix placeholder that specifies a suffix (e.g., a domain) to be inserted into the identified code component; a credential placeholder that specifies an authorization credential (e.g., a token) to be inserted into the identified code component; and a context placeholder that specifies a script context (e.g., a context corresponding to a resource type, a context corresponding to an action that triggered the request (e.g., a user clicking a button in the graphical interface of the web browser 116, a user hovering a mouse over an element presented in the graphical interface of the web browser 116, a navigation action within the web browser 116, an action within the web browser 116) to be inserted into the identified code component. 12), a context corresponding to the web browser type of the web browser 116, the type of code component included in the resource (e.g., script, Cascading Style Sheet (CSS) code, binary code, HTML code, JavaScript code, etc.), and / or any other type of context associated with the client computing device 114, the web browser 116, the proxy service 112, the proxy session between the web browser 116 and the proxy service 112, the user of the client computing device 114, and / or the resource 218. According to an embodiment, placeholders are variables that represent the information they replace.

[0057] The rewrite engine 204 can be configured to identify code components and insert placeholders in the identified code components in various ways. Figure 2As shown, the placeholder initialization service 202 determines placeholder configuration data 220 and stores the data in the data store 206. According to an embodiment, the placeholder configuration data 220 specifies the rules for inserting placeholders in the code component and what the placeholders are. For example, assume that the placeholder configuration data 220 specifies how to represent a particular placeholder in the code language. In this example, the representation of the placeholder is stored as a placeholder of placeholder 208. For example, according to an embodiment, the suffix placeholder is represented as "${SUFFIX_MCAS}", the credential placeholder is represented as "${TOKEN_MCAS}", and the script context placeholder is represented as "$CTX_MCAS". The rewrite engine 204 obtains the representation of the placeholder from the data store 206 via signal 224. Alternatively, the placeholder initialization service 202 provides the placeholder configuration data 220 (including the representation of the placeholder) to the rewrite engine 204 via configuration signal 222. According to an embodiment, the placeholder initialization service 202 is pre-programmed with representations of placeholders. According to an embodiment, the placeholder initialization service 202 receives the representations of placeholders from a management computing device associated with the proxy service 112. According to an embodiment, the placeholder initialization service 202 includes representations of a plurality of placeholders and generates the placeholder configuration data 220 to include a subset of the plurality of placeholder representations based on which placeholder values ​​are determined for a particular proxy session. For additional details on determining placeholder values, see Figure 4A and described elsewhere in this article.

[0058] Continuing with the non-limiting example described with respect to step 304, assume that the rewrite engine 204 inserts the suffix code, credential placeholder, and context placeholder into the static import statement identified in step 304. In this context, the code component of the modified resource 226 is represented as: In this example, the rewrite engine 204 inserts the suffix placeholder "${SUFFIX_MCAS}", the context placeholder "${CTX_MCAS}", and the credential placeholder "${TOKEN_MCAS}" into each URL of each import statement.

[0059] According to an embodiment, the rewrite engine 204 generates the modified resource 226 by replacing certain code components of the code 232 with corresponding wrapper code components and by including embedding functions and / or code rewriting functions into the resource. For additional details on wrapper code components, embedding functions, and code rewriting functions, refer to Figures 7 to 9 and described elsewhere in this article.

[0060] In step 308, the first modified version of the resource is stored in a memory accessible to the proxy computing device. For example, Figure 2The rewrite engine 204 stores the modified resource 226 as a cached resource 212 in the data store 206 (e.g., its cache). By storing the modified resource 226, the proxy service 112 enables future requests for the resource 218 (e.g., from the web browser 116, from another web browser on the client computing device 114, or from a web browser executing on another computing device) to be processed. Figure 2 2 (not shown) to retrieve the modified resource 226. For example, by utilizing a "suffix placeholder," the proxy service 112 can access a stored (e.g., cached) version of the modified resource 226 to satisfy a request that requires a different suffix than the request 214. Furthermore, by utilizing a "credential placeholder," the proxy service 112 can access a stored version of the modified resource 226 to satisfy a request for a different authentication session (e.g., a different user with different credentials, a different session with a different session token, etc.). Figure 4A 、 Figure 5 and Figure 6 Additional details regarding accessing stored modified resources are discussed elsewhere herein.

[0061] After storing the modified resource 226, the proxy service 112 fulfills the request 214. For example, the placeholder service 120 replaces the placeholder in the modified resource 226 to generate the modified resource 230 and sends the modified resource 230 to the web browser 116. For additional details on replacing the placeholder and sending the modified resource, refer to Figure 4A and further discussed elsewhere in this paper.

[0062] As described above, proxy service 112 also modifies the modified version of the resource generated by resource modifier 118 to fulfill a request from a web browser (e.g., web browser 116) of a client computing device (e.g., client computing device 114). Proxy service 112 can modify the modified version of the resource in various ways. For example, Figure 4A A flowchart 400 is depicted of a process for determining placeholder values ​​according to an embodiment. In an embodiment, Figure 2 The system 200 can operate according to the flowchart 400. Not all steps of the flowchart 400 need to be performed in all embodiments. Figure 2 and Figure 4A Other structural and operational embodiments will be apparent to persons skilled in the relevant art(s) from the following description.

[0063] Flowchart 400 begins at step 402. In step 402, a first request for a resource is received from a first client computing device, the first request including authentication credentials. For example, Figure 2The proxy service 112 receives a request 244 for a resource 218 from a web browser 116 executing on a client computing device 114, the request 244 including authentication credentials. Figure 1 Proxy service 112 receives request 244, after identity provider 108 (e.g., an identity provider) has determined, based on an access policy, that request 244 should be redirected to proxy service 112. According to another embodiment, proxy service 112 receives request 244 during an active (e.g., already established) proxy session between web browser 116 and proxy service 112. For example, request 244 may be a request received after request 214 in the same proxy session. According to an embodiment, the authentication credential is an authentication credential provided by identity provider 108 to web browser 116 (e.g., in response to authentication of a user or service by web browser 116). According to another embodiment, the authentication token is signed using a private key of identity provider 108.

[0064] In step 404, the authentication credentials are verified. For example, Figure 2 The verifier 238 verifies the authentication credentials included in the request 244. According to an embodiment, the verifier 238 verifies that the authentication credentials satisfy the security policy of the proxy service 112. According to an embodiment, the verifier 238 verifies the authentication credentials by verifying the signature of the authentication credentials (e.g., using the public key of the identity provider 108 corresponding to the private key of the identity provider 108). Figure 2 As shown, the validator 238 provides a signal 246 to the request analyzer 240, and the flowchart 400 continues to step 406. According to an embodiment, the signal 246 includes the request 244, the authentication credentials, an indication that the authentication credentials are verified, the resource ID of the resource 218, and / or any other information associated with the verification of the request 244 and / or the credentials included therein.

[0065] In step 406, a first placeholder value is determined, the first placeholder value indicating that the authentication credentials are verified. For example, Figure 2 The request analyzer 240 of FIG. 244 determines the placeholder value based on the request 244 (e.g., included in the signal 246). For example, the request analyzer 240 may analyze the request 244 (and / or any other data included in the signal 246) to determine the placeholder value based on information included in the request 244, the web browser sending the request (i.e., the web browser 116), the computing device executing the web browser (i.e., the client computing device 114), the user associated with the web browser 116, and / or data associated with the active proxy session between the web browser 116 and the proxy service 112. For example (e.g., and in response to verification of the authentication credentials included in the request 244), according to an embodiment, the request analyzer 240 determines the placeholder value based on the authentication credentials (e.g., provided by Figure 1The authentication token signed by the identity provider 108) determines the authentication string. Figure 4C As discussed further, request analyzer 240 can determine placeholder values ​​in addition to (or in addition to) credential placeholder values. For example, according to an embodiment, request analyzer 240 analyzes data associated with establishing a proxy session between web browser 116 and proxy service 112 included in request 214 and determines a suffix placeholder value corresponding to the proxy session.

[0066] In step 408, it is determined that the requested resource corresponds to a first modified version of the resource. The first modified version of the resource is stored in a memory accessible to the proxy computing device. The first modified version of the resource includes a code component that includes a first placeholder inserted by the proxy computing device. For example, Figure 2 The request analyzer 240 analyzes the request 244 (and / or any other data included in the signal 246) to determine whether the resource requested in the request 244 corresponds to a first modified version of a resource stored in the data store 206 (e.g., the cached resource 212 and / or other previously modified resources generated by the rewrite engine 204). According to an embodiment, the request analyzer 240 compares the resource ID of the requested resource with the resource ID of the modified version of the resource stored in the data store 206. As a non-limiting operating example, assume that the request 244 includes the resource ID of the requested resource 218, and the cached resource 212 includes the resource ID of the resource 218. In this example, the request analyzer 240 accesses the data store 206 to compare the resource IDs of the stored resources (including the cached resource 212) with the resource ID included in the request 244. If there is no match, the request analyzer 240 issues a request (e.g., request 216) to the web server 106, as described with respect to Figure 3 However, if there is a match, the request analyzer 240 provides a match signal 248 to the placeholder service 120, and the flowchart 400 continues to step 410. According to an embodiment, the match signal 248 includes the placeholder value determined in step 406.

[0067] In step 410, the first modified version is retrieved. For example, Figure 2 The placeholder service 120 retrieves the first modified version of the resource 218 from the data store 206 (e.g., the modified resource 226 stored in the data store 206 as the cached resource 212). Figure 2 As shown, the placeholder 120 accesses the data store 206 in response to receiving the match signal 248 and receives the first modified version of the resource via signal 228. According to an embodiment, the data store 206 receives the first modified version of the resource in response to the match signal 248 from the placeholder service 120 ( Figure 2 2. According to an alternative embodiment, the request analyzer 240 retrieves the first modified version of the resource from the data store 206 and includes the retrieved version in the matching signal 248.

[0068] In step 412, a second modified version of the resource is generated by replacing the first placeholder with the first placeholder value. For example, Figure 2 The placeholder service 120 generates a second modified version of the resource 218 by replacing the placeholder in the modified resource 226 (e.g., retrieved via signal 228 in step 410) with the first placeholder value, which is the modified resource 230. Figure 2 As shown, the code 232 of the modified resource 230 includes a modified code component 234. In this context, the modified code component 234 includes a first placeholder value inserted by the placeholder service 120. According to an embodiment, the placeholder service 120 selects a placeholder value to replace the placeholder based on the proxy service 112, the user account of the client computing device 114, the web browser 116, and / or any other data associated with the specific proxy session between the web browser 116 and the proxy service 112, and / or the policy of the proxy service 112. For example, according to an embodiment, the match signal 248 includes the first placeholder value determined by the resource analyzer 240 in step 406. In this context, the placeholder service 120 replaces the first placeholder in the modified resource 226 with the first placeholder value determined in step 406. Therefore, the modified resource 230 indicates that the authentication credentials included in the request 244 are verified.

[0069] like Figure 2 As shown, the placeholder service 120 obtains the first placeholder value via the matching signal 248. Alternatively, the placeholder service 120 obtains the first placeholder value from the data store 206 via the signal 228 (e.g., in addition to the modified resource 226). In this context, the placeholder value is a placeholder value for the placeholder in the modified resource 226, which is stored in the data store 206 as (e.g., a portion of) the placeholder value 210. According to an embodiment, the placeholder value 210 is stored in the data store 206 by the request analyzer 240 (e.g., as part of the analysis of the signal 246 and / or the request 244, as described with respect to step 406). According to an alternative embodiment, the placeholder initialization service 202 determines the placeholder value and stores it in the data store 206 as the placeholder value 210 (e.g., as part of the placeholder configuration data 220). Additional details regarding storing the placeholder value will be referred to in Figure 4B Provide a description.

[0070] Continue About Figure 3300 , assume that the proxy service 112 includes a secure proxy service that verifies that the authentication credentials included in the request from the web browser are valid (e.g., according to the process described with respect to steps 404 and 406). In this example, the first placeholder value determined in step 406 is the authentication string "auth123" indicating that the authentication credentials are verified. Further assume that, in this example, the proxy service 112 includes a suffix service that adds a ".mcas.ms" suffix to the URL of the web page sent to the web browser 116, and that the code of the modified resource 230 is to be evaluated using the script context "ctx20". In this context, the code of the modified resource 230 is represented as: In this example, the placeholder service 120 replaces the placeholder inserted in the modified resource 226 with a placeholder value corresponding to the ".mcas.ms" suffix, the authentication string "auth123" representing the authentication token, and the "ctx20" context.

[0071] In step 414, the second modified version of the resource is sent to the first client computing device. For example, Figure 2 The placeholder service 120 sends the modified resource 230 to the web browser 116 executing on the client computing device 114 .

[0072] As about Figure 4A As discussed, according to an embodiment, resource analyzer 240 provides the determined placeholder value to placeholder service 120 via match signal 248. As an alternative (or in addition) to providing the placeholder value determined by placeholder service 120, request analyzer 240 can store the determined placeholder value in memory, for example, as placeholder value 210. For example, placeholder initialization service 202 can provide the placeholder value to the placeholder service 120 according to the match signal 248. Figure 4B Stores a placeholder value. According to an embodiment, Figure 4B A flowchart 420 is depicted of a process for storing placeholder values. In an embodiment, Figure 2 The system 200 can operate according to the flowchart 420. The flowchart 420 need not be executed in all embodiments. Figure 2 and Figure 4B Other structural and operational embodiments will be apparent to persons skilled in the relevant art(s) from the following description.

[0073] Flowchart 420 includes step 422. In step 422, the first placeholder value is stored in a memory accessible to the proxy computing device. For example, Figure 2 The request analyzer 240 will be Figure 4AThe placeholder value determined in step 406 is stored in the data store 206 as the value of the placeholder value 210 (e.g., via Figure 2 By storing placeholder values ​​in this manner, the placeholder service 120 is able to replace the placeholders to generate modified resources (e.g., Figure 2 230) to provide the modified resource to the web browser. For example, assume that the placeholder value corresponds to an indication that the authentication credentials have been verified for the proxy session between the web browser 116 and the proxy service 112. By storing the placeholder in this manner, the resource analyzer 240 does not have to determine the placeholder value for subsequent requests during the same proxy session, thereby reducing the resources required to respond to the request.

[0074] In an embodiment, the placeholder value 210 includes a placeholder value for a single client user in a single proxy session. Alternatively, the placeholder value 210 includes a placeholder value for a proxy service 112 and a corresponding client computing device (e.g., including client computing device 114 and Figure 2 14. The placeholder service 120 stores a corresponding placeholder value for each proxy session between the web browser and the proxy server 116 (e.g., other client computing devices not shown in the figure). In this alternative context, a set of placeholder values ​​210 is stored in the data store 206, where each set is associated with an identifier for a specific proxy session. In this manner, the placeholder service 120 obtains a specific set of placeholder values ​​based on the proxy session identifier included in a request received from the web browser (e.g., request 214 or request 244 received from the web browser 116).

[0075] As about Figure 4A As discussed, resource analyzer 240 and / or placeholder initialization service 202 determine a placeholder value based on a request received from a web browser (e.g., request 214 or request 244 received from web browser 116). Specifically, the description is made with respect to determining a placeholder value indicating that authentication credentials are verified. Figure 4A 400. However, it is also contemplated herein that in embodiments, other placeholder values ​​may be determined (e.g., in addition to or in lieu of a placeholder value indicating that the authentication credentials are being verified). Other placeholder values ​​may be determined, and the modified version of the resource may be further modified in various ways to include other placeholders. For example, Figure 4C A flowchart 430 is depicted of a process for modifying a resource according to an embodiment. In an embodiment, Figure 2 The system 200 can operate according to the flowchart 430. The flowchart 430 need not be executed in all embodiments. Figure 2 and Figure 4C Other structural and operational embodiments will be apparent to persons skilled in the relevant art(s) from the following description.

[0076] Flowchart 430 begins at step 432, which may be as described with respect to Figure 4A Another embodiment of step 406 of the described flowchart 400. In step 432, a second placeholder value is determined based on the received first request. For example, Figure 2 The request analyzer 240 of determines a second placeholder value based on the request 244 (e.g., included in the signal 246). For example, assume that the first placeholder value is a credential placeholder value indicating that the authentication credentials included in the request 244 are verified, as described elsewhere herein. It is further contemplated herein that the request analyzer 240 may determine additional placeholder values ​​(e.g., a suffix placeholder value and a context placeholder value) based on the request 244. Depending on the implementation, the request analyzer 240 may determine any number of placeholder values. See Regarding Figure 3 and Figure 4A In the described example operation, request analyzer 240 determines the suffix placeholder value “.mcas.ms” and the context placeholder value “ctx20” based on request 244 .

[0077] Flowchart 430 continues to step 434, which may be as described with respect to Figure 4A Another embodiment of step 412 of the described flowchart 400. In step 434, a second modified version is generated by replacing the second placeholder with the second placeholder value. For example, assume that the modified resource 226 includes a first placeholder (credential placeholder) and a second placeholder. Figure 2 The placeholder service 120 generates a modified resource 230 by replacing the first placeholder with the first placeholder value (as described with respect to step 412 of FIG. 4 ) and replacing the second placeholder with the second placeholder value determined in step 432 . For example, referring to FIG. Figure 3 and Figure 4A In the described example operation, the placeholder service 120 generates a modified resource 230 by replacing the credential placeholder “${TOKEN_MCAS}” with the authentication string “auth123”, the suffix placeholder “${SUFFIX_MCAS}” with the “.mcas.ms” suffix, and the context placeholder “${CTX_MCAS}” with the “ctx20” context.

[0078] As described elsewhere herein, the proxy service's rewrite engine stores modified versions of resources with placeholders in memory accessible to the proxy service so that future rewrites of the resource do not have to parse the resource to identify the code component. Instead, the proxy service's placeholder service accesses the cached resource and replaces the placeholder with the appropriate placeholder value to generate a second modified version of the resource. Furthermore, the proxy service may store and / or determine placeholder values ​​for multiple clients. In embodiments, the proxy service and its components may be configured to access and modify resources stored for multiple clients in various ways. For example, Figure 5 A block diagram of an example system 500 (hereinafter referred to as "system 500") for generating modified resources from stored resources according to an embodiment is depicted. Figure 5 As shown, the system 500 includes a proxy computing device 110 (including a proxy service 112, which includes a resource modifier 118 (including a placeholder initialization service 202 and a rewrite engine 204, which are not shown in the figure for the sake of brevity). Figure 5 ), the placeholder service 120 and the request interface 236 (including the validator 238 and the request analyzer 240) and the data store 206 (including the placeholder value 210 and the cache resource 212), as shown in FIG. Figure 2 As described, and client computing device 514 (executing web browser 516). Figure 2 As shown, the proxy service 112 receives the request 502 and outputs a modified resource 530. The modified resource 530 includes the code 232 having a modified code component 534, as described elsewhere herein. Figures 7 to 11 As further discussed, modified resource 530 includes one or more placeholder values, embedded functionality, and / or code rewrite functionality.

[0079] The client computing device 514 can be any type of computing device, such as Figure 1 The client computing device 514 may be a computing device of the same user as the client computing device 514, a computing device associated with the same organization as the client computing device 514, and / or a computing device associated with a different user and / or organization than the client computing device 514. Figure 5 As shown, the client computing device 514 executes a web browser 516. According to an embodiment, the web browser 516 is used to communicate with Figure 1 The web browser 116 operates in a similar manner.

[0080] The proxy computing device 110 communicates via one or more networks ( Figure 5 ) between the client computing device 514 and the server computing device 104 ( Figure 5According to an embodiment, the proxy computing device 110 establishes itself as an intermediary for the client computing device 514 and the server computing device 104 in a manner similar to that described with respect to the client computing device 114 and the server computing device 104.

[0081] For illustrative purposes, Figure 6 System 500 is described. Figure 6 A flowchart 600 is depicted of a process for modifying a stored modified version of a resource according to an embodiment. In an embodiment, Figure 5 The system 500 can operate according to the flowchart 600. Not all steps of the flowchart 600 need to be performed in all embodiments. Figure 5 and Figure 6 From the following description, further structural and operational embodiments will be apparent to those skilled in the relevant art.

[0082] Flowchart 600 begins at step 602. In step 602, a second request for a resource is received from a second client computing device. For example, Figure 5 The validator 238 receives a request for the resource 218 ( Figure 5 According to an embodiment, the proxy service 112 responds to the identity provider (e.g., Figure 1 108) has determined, based on an access policy, that the request 502 should be redirected to the proxy service 112. According to another embodiment, the proxy service 112 receives the request 502 during an active (e.g., established) proxy session between the web browser 516 and the proxy service 112. According to an embodiment, the request 502 includes authentication credentials (e.g., a token provided to the web browser 516 via the identity provider 108). In this context, the authenticator 238 verifies the authentication credentials and generates a signal 504 (e.g., in the form of a signal indicating that the authentication credential is being used). Figure 4A Depending on the embodiment, signal 504 includes request 502, authentication credentials, an indication that the authentication credentials are verified, a resource ID of resource 218, and / or any other information associated with verification of request 502 and / or the credentials included therein.

[0083] In step 604, a second placeholder value is determined based on the received second request. For example, Figure 5 The request analyzer 240 determines a second placeholder value based on the request 502 (eg, included in the signal 504) in a manner similar to that described with respect to step 406 of the flowchart 400, as described with respect to Figure 4AAlternatively, the placeholder value is determined based on a request previously received from the web browser 516 or in other ways described elsewhere herein (e.g., by an administrator user of the proxy service 116). According to an embodiment, Figure 2 The request analyzer 240 stores the determined placeholder value in the data store 206 via a store signal 506 .

[0084] In step 606, the first modified version is retrieved. Figure 5 As shown, the request analyzer 240 is requested to Figure 4A In a manner similar to that described in step 408 of FIG. 5 , the process determines that the resource requested by request 502 (i.e., resource 218) corresponds to modified resource 226 (stored in data store 206 as cached resource 212) and provides a match signal 508 (e.g., indicating a match and including the second placeholder value determined in step 604). In response to receiving the match signal 508, Figure 5 The placeholder service 120 retrieves the modified resource 226 from the data store 206 via signal 510. By obtaining the modified resource 226 in this manner, the placeholder service 120 reduces the computational resources and time required to rewrite the resource 218 (e.g., based on the policy of the proxy service 112 and in a manner that satisfies the request 502). For example, according to an embodiment, the rewrite engine 204 obtains the modified resource 226 in response to the resource modifier 118 receiving the request 502 without having to parse the modified resource 226 to identify the code component.

[0085] In step 608, a third modified version of the resource is generated by replacing the first placeholder with the second placeholder value. For example, Figure 5 The placeholder service 120 generates a third modified version of the resource 218 (modified resource 530) by replacing the placeholder in the modified resource 530 with the second placeholder value determined in step 604. Figure 5 As shown, the modified resource 530 includes code 232, which includes a modified code component 534. In this context, the modified code component 534 includes a second placeholder value inserted by the placeholder service 120. The placeholder service 120 generates the modified resource 230 in a manner similar to that described with respect to the generation of the modified resource 230 (e.g., as described with respect to Figure 2 、 Figure 4A and Figure 4C) and other techniques for generating modified resources by replacing placeholders with placeholder values, as described elsewhere herein, to generate the modified resource 530. According to an embodiment, the placeholder 120 selects a placeholder value to replace the placeholder based on the placeholder value determined in step 604, the proxy service 112, the user account of the client computing device 514, the web browser 516, and / or any other data associated with the proxy session between the web browser 516 and the proxy service 112.

[0086] In step 610, a third modified version of the resource is sent to the second client computing device. For example, Figure 5 The placeholder service 120 sends the modified resource 530 to the web browser 516 executing on the client computing device 514 . IV. Example Client-Side Proxy Service Embodiment

[0087] As described herein, embodiments of the present disclosure enable a proxy service executed on a proxy computing device interconnected between a client computing device and a server computing device to rewrite the code of a resource using placeholders. In an alternative (or additional) aspect, a web browser executed on the client computing device includes a client-side proxy service that implements client-side rewriting of code included in a web page provided to the web browser. To further illustrate the client-side proxy service embodiment, the following will now be described. Figure 7 . Figure 7 is a block diagram of an example system 700 according to an embodiment, wherein a proxy computing device is interconnected between a client computing device and a server computing device, wherein the proxy computing device executes a proxy service, the client computing device executes a web browser including a client-side proxy service, and the server computing device executes a web server. Figure 2 As shown, system 700 includes a server computing device 104 (including a web server 106), an agent computing device 110 (including an agent service 112), and a client computing device 114 (including a web browser 116), as described above with respect to Figure 1 As described separately. Figure 2As further shown in FIG, the proxy service 112 includes a web page modifier 704, and the web browser 116 includes a client-side proxy service 702. The client-side proxy service 702 includes a placeholder initialization service 706, an event detector 708, rewrite logic 710, evaluation logic 712, and validation logic 728. According to an embodiment, the client-side proxy service 702 is provided to the web browser 116 by the proxy service 112 (e.g., by the proxy service 112 including the client-side proxy service 702 in a response (e.g., in a web page or resource included in the response)). Alternatively, the client-side proxy service 702 is stored in the cache of the web browser 116. As also shown in FIG. Figure 2 As shown, the proxy service receives web page 718 and outputs modified web page 720. Web page 718 includes code 722, and modified web page 720 includes code 722 with embed functionality 724 and code rewrite functionality 726. According to an embodiment, code 722 of modified web page 720 includes modified code components and / or one or more placeholder values.

[0088] For illustrative purposes, Figure 8 System 700 is described. Figure 8 A flowchart 800 is depicted of a process for modifying a resource by a client-side proxy service according to an embodiment. In an embodiment, Figure 7 The system 700 can be operated according to the flowchart 800. Not all steps of the flowchart 800 need to be performed in all embodiments. Figure 7 and Figure 8 Based on the description, further structural and operational embodiments will be apparent to those skilled in the relevant art.

[0089] Flowchart 800 begins at step 802. In step 802, a modified version of a web page is received in a browser. The modified version of the web page includes embedded functions and code rewriting functions that are not included in the web page. For example, Figure 7 The web browser 116 receives a modified web page 720 from the web page modifier 704. The modified web page 720 includes an embed function 724 and a code rewrite function 726. The embed function 724 is configured to modify the code component by inserting a placeholder in the code component, and the code rewrite function 726 is configured to replace the placeholder with the placeholder value.

[0090] According to an embodiment, the web page modifier 704 of the proxy service 112 modifies the web page 718 by inserting an embedding function 724 and a code rewriting function 726 in the code 722 to generate a modified web page 720. According to an embodiment, the web page modifier 704 modifies the web page 718 by inserting an embedding function 724 and a code rewriting function 726 in the code 722 to generate a modified web page 720. Figure 1 and Figure 2 The web page modifier 704 operates in a similar manner as described above to modify the web page (e.g., by parsing the web page to identify code components therein, inserting placeholders into the identified code components, and replacing the placeholders with placeholder values). According to another embodiment, the web page modifier 704 analyzes the web page 718 to identify code components of the code 722 (e.g., code of interest) and replaces the identified code components with "wrapped code components." The wrapped code components include a call to the embed function 724, which includes the identified code components as its arguments. In this case, if a user of the client computing device 114 interacts with the modified web page 720 on the client computing device 114 in a manner that would normally trigger the evaluation of the original code components, the wrapped code components will be evaluated.

[0091] According to an embodiment, in response to receiving the modified web page 720, the web browser 116 stores the embedding function 724 and / or the code rewriting function 726 in the browser cache ( Figure 7 720). In this context, further responses of the modified web page from the proxy service 112 need not include the functionality stored by the web browser 116. For example, as an alternative to including the embed functionality 724 and / or the code rewrite functionality 726 in the modified web page 720, the web page modifier 704 may include a reference to a function that causes the client computing device 114 to load the functionality into the modified web page 720 (e.g., when the web browser 116 renders the modified web page 720). The reference to the embed functionality 724 and / or the code rewrite functionality 726 may be a hint to load a file (e.g., a library, a JavaScript file, etc.) including the corresponding functionality and / or any other reference suitable for including the embed functionality 724 and / or the code rewrite functionality 726 in the modified web page 720.

[0092] According to another embodiment, the web page modifier 704 inserts code that, when executed by the processor of the client computing device 114 , executes the client-side proxy service 702 (and its sub-services) in the modified web page 720 .

[0093] In step 804, an event is detected in the web page. The event is associated with the embedded function and code component. For example, Figure 7The event detector 708 detects events in the modified web page 720 presented by the web browser 116. For example, assume that the modified web page 720 is loaded for user viewing and interaction by the web browser 116. For example, according to an embodiment, the event detector 708 detects events corresponding to actions of interest (e.g., navigation actions, file download actions, file upload actions, AJAX actions, etc.), which are evaluated with respect to the policy of the proxy service 112. According to another embodiment, the event detector 708 detects the actions of interest by evaluating a modified code component (e.g., a wrapper code component or other modified code component) that includes a call to the embed function 724. In this context, when the modified code component is evaluated, the embed function 724 is called, and the flowchart 800 proceeds to step 806. According to an embodiment, the call to the embed function 724 passes the corresponding code component as its argument. In embodiments, the modified code component may be evaluated when the web browser 116 renders the modified web page 730, or may be evaluated (e.g., only) when the web browser 116 renders the modified web page 730 and a particular event occurs with respect to the modified web page 730 (e.g., a user of the client computing device 114 interacts with the modified web page 730 in a particular manner (e.g., changes an element, clicks a button, hovers the mouse over an element, moves the mouse off an element, presses a keyboard key), and / or any other type of event associated with the modified web page 730, as described elsewhere herein and / or as would otherwise be understood by a person of ordinary skill in the art having the benefit of this disclosure).

[0094] In step 806, a first modified version of the code component is generated by inserting a placeholder into the code component through the embed function. For example, Figure 7 The rewrite logic 710 of the system 200 evaluates the embedding function 724 to generate a first modified version of the code component (hereinafter "first modified component") by inserting the placeholder in the code component. In an embodiment, the embedding function 724 inserts the placeholder in the code component in a manner similar to the rewrite engine 204 of the system 200, as described with respect to Figure 2 and 3 For example, the embedding functionality 724 may determine whether a suffix placeholder, a credential placeholder, a script context placeholder, and / or any other type of placeholder should be inserted into the code component, and if so, insert the corresponding placeholder into the code component to generate the first modified component. According to an embodiment, the representation of the placeholder is determined by the placeholder initialization service 706. The placeholder initialization service 706 may be configured in a manner similar to that described with respect to Figure 2 The placeholder initialization service 202 determines the representation of the placeholder in a similar manner as described above. Figure 8While described with respect to inserting a (eg, a single) placeholder, it is also contemplated herein that the embed functionality 724 may insert multiple placeholders into a code component.

[0095] In step 808, the authentication credentials are verified. For example, Figure 7 The authentication logic 728 verifies the authentication credentials. In this context, the authentication credentials may be stored in the browser cache of the web browser 116 or in a memory accessible to the client computing device 114 ( Figure 7 ). According to an embodiment, the authentication credentials are provided by the identity provider 108 to the client computing device 114 (e.g., in response to authentication by a user or service of the client computing device 114). The verification logic 728 may be similar to the authentication logic 728 with respect to Figure 2 Validator 238 and Figure 4A The authentication credentials are verified in the manner described in step 404 of flowchart 400. If the authentication credentials are verified, flowchart 800 proceeds to step 810.

[0096] In step 810, a placeholder value is determined. The placeholder value indicates that the authentication credential is to be verified. For example, Figure 7 The rewrite logic 710 determines a placeholder value corresponding to the authentication credentials verified in step 808. According to an embodiment, and as described below with respect to Figure 10 As further described, the rewrite logic 710 determines a corresponding placeholder value indicating that the authentication credentials are verified based on the set of placeholder values ​​received from the proxy service 112. According to an embodiment, the placeholder value is included in the modified web page 720 received in step 802. Alternatively, the placeholder value is received from a previous transmission from the proxy service 112. According to another alternative embodiment, the client-side proxy service 702 receives the placeholder value by sending a value request ( Figure 7 Not shown) and receives a value response ( Figure 7 (not shown) to determine the placeholder value. According to another embodiment, the rewrite logic 710 is pre-configured with the placeholder value. In any case, after determining the placeholder value, the flowchart 800 proceeds to step 812.

[0097] In step 812, a second modified version of the code component is generated by replacing the placeholders in the first modified version of the code with the placeholder values ​​through the code rewriting function. For example, Figure 7 The rewrite logic 710 of the system 200 evaluates the code rewrite function 726 to generate a second modified version of the code component (hereinafter "the second modified component") by replacing the placeholders in the first modified component with the placeholder values ​​determined in step 810. In an embodiment, the code rewrite function 726 replaces the placeholders in the first modified component in a manner similar to the placeholder service 120 of the system 200, as described with respect to Figure 2 and Figure 4A For example, according to an embodiment, the code rewrite functionality 726 selects a placeholder value based on the proxy service 112, a user account of the client computing device 114, the web browser 116, and / or any other data associated with the proxy session between the web browser 116 and the proxy service and / or a policy of the proxy service 112 (e.g., initialized by the placeholder initialization service 706, received from the proxy service 112, or otherwise available to the code rewrite functionality 726, as described elsewhere herein).

[0098] In step 814, the second modified version of the code component is evaluated. For example, Figure 7 The evaluation logic 712 evaluates the second modified component generated in step 808. According to an embodiment, the code rewrite functionality 726 is a code rewrite and evaluation functionality that evaluates the second modified component (e.g., automatically, in response to its generation, or as would be understood by one of ordinary skill in the relevant art having the benefit of this disclosure).

[0099] Therefore, it has been about Figure 8 An example process for modifying a resource by a client-side proxy service is described. As described herein, the steps of flowchart 800 may be performed in different Figure 8 806 and before step 812, it is also contemplated herein that, according to an embodiment, the verification of the authentication credentials (step 808) and the determination of a placeholder value indicating that the authentication credentials are verified (step 810) occur when the web page is rendered by the web browser 116 (e.g., after step 802). It is also contemplated herein that the verification of the authentication credentials and the determination of the corresponding placeholder value may occur before the web browser 116 receives the modified web page 720. For example, according to another embodiment, the client-side proxy service 702 (or a sub-service thereof) verifies the authentication credentials in response to the identity provider providing the authentication credentials to the web browser 116, and determines a placeholder value indicating the authentication credentials (e.g., for future use by the rewrite logic 710).

[0100] In various embodiments, a first modified code component is modified by replacing a placeholder with a placeholder value to generate a second modified code component in various ways. For example, you can call Figure 7 The code rewrite function 726 is used to generate a second modified code component. For example, Figure 9 A flowchart 900 is depicted of a process for generating a second modified version of a code component according to an embodiment. In an embodiment, Figure 7 The system 700 can operate according to the flowchart 900. According to an embodiment, the flowchart 900 is about Figure 8Another embodiment of step 812 of flowchart 800 is described. Flowchart 900 need not be performed in all embodiments. Figure 7 and Figure 9 Based on the description, further structural and operational embodiments will be apparent to those skilled in the relevant art.

[0101] Flowchart 900 includes step 902. In step 902, a call to a code rewriting function is executed by the embed function. The call to the code rewriting function includes the first modified version of the code component as its argument. For example, embed function 724 includes a call to code rewriting function 726, so that when embed function 724 is evaluated, code rewriting function 726 is called to generate the second modified version of the code component. The call to code rewriting function 726 includes the first modified component generated in step 806 of flowchart 800 as its argument.

[0102] As about Figure 7 and Figure 8 As described, the code rewrite functionality 726 replaces the placeholder with the placeholder value. In an embodiment, the client-side proxy service 702 may obtain the placeholder value in various ways. For example, the placeholder initialization service 706 may determine the placeholder value based on the web browser 116 (e.g., based on properties of the web browser 116, based on data stored in the browser cache of the web browser 116, etc.), the client computing device 114 (e.g., based on properties of the client computing device 114, based on applications installed on the client computing device 114, based on data stored in the memory of the client computing device 114, etc.), the user of the client computing device 114 (and / or the user's user account), a token received from the identity provider (e.g., after authenticating the user's login credentials), etc. Alternatively, the placeholder initialization service 706 obtains the placeholder value from the proxy service 112. In an embodiment, the placeholder initialization service 706 may obtain the placeholder value from the proxy service 112 in various ways. For example, Figure 10 Depicted is a flow diagram of a process for storing placeholder values ​​according to an embodiment. In an embodiment, Figure 7 The system 700 can operate according to the flowchart 1000. Not all steps of the flowchart 1000 need to be performed in all embodiments. Figure 7 and Figure 10 From the following description, further structural and operational embodiments will be apparent to those skilled in the relevant art.

[0103] Flowchart 1000 begins at step 1002. In step 1002, a placeholder value is received from a proxy computing device. For example, Figure 7The web browser 116 of the proxy computing device 110 receives the placeholder value from the proxy service 112 of the proxy computing device 110. According to an embodiment, the web browser 116 receives the placeholder value as part of establishing a proxy session with the proxy service 112. Alternatively, the web page modifier 704 includes (e.g., inserts) the placeholder value in the modified web page 720 (e.g., in the code 722). In another alternative embodiment, the web page modifier 704 sends the placeholder value as a separate response to the request received from the web browser 116. In another alternative embodiment, the client-side proxy service 702 is pre-configured with the placeholder value.

[0104] In step 1004, the placeholder value is stored in a memory accessible to the client-side proxy service. For example, Figure 7 The web browser 116 (or the client-side proxy service 702) stores the placeholder value received in step 1002 in a memory accessible to the client-side proxy service 702 (e.g., in the cache of the web browser 116, Figure 7 not shown).

[0105] Although flowchart 1000 is described with respect to a single (e.g., first) placeholder value, it is also contemplated herein that the web browser 116 (and / or the client-side proxy service 702) can receive and store multiple placeholder values ​​(e.g., a suffix placeholder, a credential placeholder, a context placeholder, etc.).

[0106] In embodiments, the web browser 116 may receive the modified web page in various ways. For example, according to an embodiment, the web browser 116 receives the modified web page in response to a request for (e.g., an original version of) the web page. For example, Figure 11 A flowchart 1100 is depicted of a process for requesting a web page according to an embodiment. In an embodiment, Figure 7 The system 700 can be operated according to the flowchart 1100. Not all steps of the flowchart 1100 need to be performed in all embodiments. Figure 7 and Figure 11 Based on the description, further structural and operational embodiments will be apparent to those skilled in the relevant art.

[0107] Flowchart 1100 begins at step 1102. In step 1102, a request for a web page is sent to a proxy computing device. For example, a web browser 116 executing on a client computing device 114 sends a request 714 for a web page to the proxy service 112. According to an embodiment, the request 714 also includes client-side generated content and / or metadata associated with the client computing device 114 and / or the web browser 116. According to an embodiment, the web browser 116 responds to an identity provider (e.g., Figure 1 The identity provider 108 has determined based on the access policy that the request 714 should be redirected to the proxy service 112 and sends the request 714 to the proxy service 112. In this context, the request 714 may include an (e.g., encrypted) authentication token provided by the identity provider 108 to the web browser 116.

[0108] Flowchart 1100 continues to step 1104. According to an embodiment, step 1104 is as follows Figure 8 Another embodiment of step 802 of the depicted flowchart 800. In step 1104, in response to the sending request, a modified version of the web page is received from the proxy computing device. For example, the web browser 116 executing on the client computing device 114 receives the modified web page 720 from the proxy service 112.

[0109] By means of the operation of the web page modifier 704 (such as Figure 7 and Figure 8 714 and described elsewhere herein), the modified web page 720 includes the embedding functionality 724 and the code rewriting functionality 726 (and / or the client-side proxy service 702, one or more wrapper code components, and one or more placeholder values), but these entities are not included in the web page requested in step 702 (e.g., web page 718). Instead, in response to receiving the request 714, the proxy service 112 issues a corresponding request 716 to the web server 106, requesting that the web server 106 fulfill the request 714. The proxy service 112 receives a response from the web server 106 that corresponds to the request 716 and includes the web page 718. Figure 7 As shown, web page 718 includes code 722 (e.g., JavaScript code). In an embodiment, code 722 includes one or more code components, as described elsewhere herein. Web page modifier 704 modifies code 722 of web page 718 to include embed functionality 724 and code rewrite functionality 726 (and optionally client-side proxy service 702, a wrapper code component (that replaces the corresponding code component of code 722), and / or one or more placeholder values). V. Example Computer System Implementation

[0110] As described herein, the described embodiments and any circuits, components and / or subcomponents thereof, as well as the flowcharts / operational diagrams (including portions thereof) and / or other embodiments described herein may be implemented in hardware or any combination of hardware and software and / or firmware, including as computer program code configured to be executed in one or more processors and stored in a computer-readable storage medium, or as hardware logic / circuitry, such as in a system on a chip (SoC), a field programmable gate array (FPGA), and / or an application-specific integrated circuit (ASIC). A SoC may include an integrated circuit chip that includes one or more of the following: a processor (e.g., a microcontroller, a microprocessor, a digital signal processor (DSP), etc.), memory, one or more communication interfaces, and / or other circuits and / or embedded firmware for performing its functions.

[0111] The embodiments disclosed herein may be implemented in one or more computing devices that may be mobile (mobile devices) and / or stationary (stationary devices), and may include any combination of features of such mobile and stationary computing devices. Figure 12 Examples of computing devices are described in which embodiments may be implemented. Figure 12 A block diagram of an exemplary computing environment 1200 is shown that includes a computing device 1202. The computing device 1202 is Figure 1 The client computing device 114, the server computing device 104 and / or the proxy computing device 110 and / or Figure 5 1202. In some embodiments, the computing device 1202 communicates with devices external to the computing environment 1200 via the network 1204. Figure 12 1202 is communicatively coupled to a network (not shown). Network 1204 includes one or more networks, such as a local area network (LAN), a wide area network (WAN), an enterprise network, the Internet, etc., and may include one or more wired and / or wireless components. Network 1204 may additionally or alternatively include a cellular network for cellular communications. Computing device 1202 is described in detail below.

[0112] The computing device 1202 may be any of various types of computing devices. For example, the computing device 1202 may be a mobile computing device, such as a handheld computer (e.g., a personal digital assistant (PDA)), a laptop computer, a tablet computer, a hybrid device, a notebook computer, a netbook, a mobile phone (e.g., a cellular phone, a smartphone, a phone implementing an operating system, etc.), a wearable computing device (e.g., a head-mounted augmented reality and / or virtual reality device including smart glasses, etc.), or other types of mobile computing devices. The computing device 1202 may alternatively be a stationary computing device, such as a desktop computer, a personal computer (PC), a stationary server device, a minicomputer, a mainframe, a supercomputer, etc.

[0113] like Figure 12 As shown, computing device 1202 includes various hardware and software components, including a processor 1210, storage 1220, one or more input devices 1230, one or more output devices 1250, one or more wireless modems 1260, one or more wired interfaces 1480, a power supply 1482, a location information (LI) receiver 1484, and an accelerometer 1486. ​​Storage 1220 includes memory 1256 and storage device 1290, with memory 1256 including non-removable memory 1222 and removable memory 1224. Storage 1220 also stores an operating system 1212, applications 1214, and application data 1216. Wireless modems 1260 include a Wi-Fi modem 1262, a Bluetooth modem 1264, and a cellular modem 1266. Output device 1250 includes speakers 1252 and a display 1254. The input device 1230 includes a touch screen 1232, a microphone 1234, a camera 1236, a physical keyboard 1238, and a trackball 1240. Figure 12 All components of the computing device 1202 shown in FIG are present in all embodiments, additional components not shown may be present, and any combination of components may be present in a particular embodiment. These components of the computing device 1202 are described below.

[0114] A single processor 1210 (e.g., a central processing unit (CPU), a microcontroller, a microprocessor, a signal processor, an ASIC (application-specific integrated circuit), and / or other physical hardware processor circuit) or multiple processors 1210 may be present in the computing device 1002 to perform tasks such as program execution, signal decoding, data processing, input / output processing, power control, and / or other functions. The processor 1210 may be a single-core or multi-core processor, and each processor core may be single-threaded or multi-threaded (to provide multiple execution threads simultaneously). The processor 1210 is configured to execute program code stored in a computer-readable medium, such as the program code of an operating system 1212 and application programs 1214 stored in the storage device 1220. The operating system 1212 controls the allocation and use of components of the computing device 1202 and provides support for one or more application programs 1214 (also referred to as "applications" or "apps"). Applications 1214 may include common computing applications (e.g., email applications, calendars, contact managers, web browsers, messaging applications), other computing applications (e.g., word processing applications, mapping applications, media player applications, productivity suite applications), one or more machine learning (ML) models, and applications related to the embodiments disclosed elsewhere herein.

[0115] Any component in computing device 1202 may communicate with any other component depending on the functionality, although not all connections are shown for ease of illustration. Figure 12 As shown, bus 1206 is a multi-signal line communication medium (e.g., conductive traces in silicon, metal traces along a motherboard, wires, etc.) that may be present to communicatively couple processor 1210 to various other components of computing device 1202, although in other embodiments, alternative buses, other buses, and / or one or more separate signal lines may be present to communicatively couple components. Bus 1206 represents any one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, and a processor or local bus using any of a variety of bus architectures.

[0116] The storage device 1220 is a physical storage device including one or both of the memory 1256 and the storage device 1290, which stores the operating system 1212, the application program 1214, and the application data 1216 according to any distribution. The non-removable memory 1222 includes one or more of the following: RAM (random access memory), ROM (read only memory), flash memory, a solid state drive (SSD), a hard disk drive (e.g., a disk drive for reading from and writing to a hard disk), and / or other physical memory device types. The non-removable memory 1222 may include main memory and may be separate from the processor 1210 or manufactured in the same integrated circuit as the processor 1210. Figure 12 As shown, non-removable memory 1222 stores firmware 1218, which may be present to provide low-level control of the hardware. Examples of firmware 1218 include BIOS (Basic Input / Output System, such as on a personal computer) and boot firmware (e.g., on a smartphone). Removable memory 1224 can be inserted into a socket on computing device 1202 or otherwise coupled to computing device 1202 and can be removed from computing device 1202 by a user. Removable memory 1224 can include any suitable removable memory device type, including an SD (Secure Digital) card, a Subscriber Identity Module (SIM) card commonly known in the GSM (Global System for Mobile Communications) communication system, and / or other removable physical memory device types. One or more of storage devices 1290 may be present inside and / or outside the housing of computing device 1202 and may or may not be removable. Examples of storage devices 1290 include a hard drive, an SSD, a thumb drive (e.g., a USB (Universal Serial Bus) flash drive), or other physical storage devices.

[0117] One or more programs may be stored in storage device 1220. Such programs include operating system 1212, one or more application programs 1214, and other program modules and program data. Examples of such applications may include, for example, computer program logic (e.g., computer program code / instructions) for implementing one or more of the following: web server 106, identity provider 108, proxy service 112, web browser 116, resource modifier 118, placeholder service 120, placeholder initialization service 202, rewrite engine 204, web browser 516, client-side proxy service 702, web page modifier 704, placeholder initialization service 706, event detector 708, rewrite logic 710 and / or evaluation logic 712, and any components and / or subcomponents thereof, as well as the flowcharts / job diagrams described herein (e.g., flowchart 300, flowchart 400, flowchart 420, flowchart 430, flowchart 600, flowchart 800, flowchart 900, flowchart 1000 and / or flowchart 1100) (including portions thereof) and / or other examples described herein.

[0118] The storage device 1220 also stores data used and / or generated by the operating system 1212 and the application programs 1214 as application data 1216. Examples of application data 1216 include web pages, text, images, tables, sound files, video data, and other data, which may also be sent to / received from one or more network servers or other devices via one or more wired or wireless networks. The storage device 1220 can be used to store other data including subscriber identifiers such as the International Mobile Subscriber Identity (IMSI) and device identifiers such as the International Mobile Equipment Identifier (IMEI). Such identifiers can be sent to a network server to identify the user and device.

[0119] A user can enter commands and information into the computing device 1202 through one or more input devices 1230 and receive information from the computing device 1202 through one or more output devices 1250. The input devices 1230 may include one or more of a touch screen 1232, a microphone 1234, a camera 1236, a physical keyboard 1238, and / or a trackball 1240; the output devices 1250 may include one or more of a speaker 1252 and a display 1254. Each of the input devices 1230 and the output devices 1250 may be integrated into the computing device 1202 (e.g., built into the housing of the computing device 1202) or external to the computing device 1202 (e.g., communicatively coupled to the computing device 1202 via a wired interface 1280 and / or a wireless modem 1260, either wired or wirelessly). Other input devices 1230 (not shown) may include a natural user interface (NUI), a pointing device (computer mouse), a joystick, a video game controller, a scanner, a touchpad, a stylus, a voice recognition system for receiving voice input, a gesture recognition system for receiving gesture input, and the like. Other possible output devices (not shown) may include piezoelectric or other tactile output devices. Some devices may provide more than one input / output function. For example, a display 1254 may display information and operate as a touch screen 1232 by receiving user commands and / or other information (e.g., by touch, finger gestures, a virtual keyboard, etc.) as a user interface. There may be any number of each type of input device 1230 and output device 1250, including multiple microphones 1234, multiple cameras 1236, multiple speakers 1252, and / or multiple displays 1254.

[0120] One or more wireless modems 1260 can be coupled to an antenna (not shown) of computing device 1202 and can support bidirectional communication between processor 1210 and devices external to computing device 1202 via network 1204, as will be understood by those skilled in the relevant art. Wireless modems 1260 are shown generally and can include a cellular modem 1266 for communicating with one or more cellular networks, such as a GSM network for data and voice communications within a single cellular network, between cellular networks, or between a mobile device and the public switched telephone network (PSTN). Wireless modems 1260 can also or alternatively include other radio-based modem types, such as a Bluetooth modem 1264 (also referred to as a "Bluetooth device") and / or a Wi-Fi 1062 modem (also referred to as a "wireless adapter"). Wi-Fi modem 1262 is configured to communicate with an access point or other remote Wi-Fi-capable device according to one or more wireless network protocols based on the IEEE (Institute of Electrical and Electronics Engineers) 802.11 family of standards commonly used for local area network and Internet access for devices. The Bluetooth modem 1064 is configured to communicate with another Bluetooth-capable device in accordance with Bluetooth short-range wireless technology standards, such as IEEE 802.15.1 and / or as managed by the Bluetooth Special Interest Group (SIG).

[0121] The computing device 1202 may also include a power supply 1282, an LI receiver 1284, an accelerometer 1286, and / or one or more wired interfaces 1280. Example wired interfaces 1280 include a USB port, an IEEE 1394 (FireWire) port, an RS-232 port, an HDMI (High-Definition Multimedia Interface) port (e.g., for connecting to an external display), a DisplayPort port (e.g., for connecting to an external display), an audio port, and / or an Ethernet port, the purpose and functionality of each of which are well known to those skilled in the relevant art. The wired interfaces 1280 of the computing device 1202 provide a wired connection between the computing device 1202 and the network 1204 or between the computing device 1202 and one or more devices / peripherals when such devices / peripherals are external to the computing device 1202 (e.g., a pointing device, display 1254, speakers 1252, camera 1236, a physical keyboard, etc.). The power supply 1282 is configured to provide power to each component of the computing device 1202 and may receive power from a battery within the computing device 1202 and / or from a power cord plugged into a power port (e.g., a USB port, an A / C power port) of the computing device 1202. The LI receiver 1284 may be used for location determination of the computing device 1202 and may include a satellite navigation receiver, such as a Global Positioning System (GPS) receiver, or may include other types of location determiners configured to determine the location of the computing device 1202 based on received information (e.g., using cellular tower triangulation, etc.). An accelerometer 1086 may be present to determine the orientation of the computing device 1202.

[0122] Note that the components shown in computing device 1202 are not required or all-inclusive, and as will be appreciated by those skilled in the art, fewer or greater numbers of components may be present. For example, computing device 1202 may also include one or more of the following: a gyroscope, a barometer, a proximity sensor, an ambient light sensor, a digital compass, etc. Processor 1210 and memory 1256 may be co-located in the same semiconductor device package, such as included together in an integrated circuit chip, an FPGA, or a system on a chip (SOC), optionally along with other components of computing device 1202.

[0123] In an embodiment, computing device 1202 is configured to implement any of the above-described features of the flowcharts herein. Computer program logic for performing any operations, steps, and / or functions described herein may be stored in storage 1220 and executed by processor 1210 .

[0124] In some embodiments, server infrastructure 1270 may be present in computing environment 1200 and may be communicatively coupled to computing device 1202 via network 1204. Server infrastructure 1270, when present, may be a set of servers accessible to a network (e.g., a cloud computing platform). Figure 12 As shown, server infrastructure 1270 includes clusters 1272. Each of clusters 1272 may include a set of one or more computing nodes and / or a set of one or more storage nodes. Figure 12 As shown, cluster 1272 includes nodes 1274. Each of nodes 1274 is accessible via network 1204 (e.g., in a "cloud computing platform" or "cloud-based" embodiment) to build, deploy, and manage applications and services. Any of nodes 1274 can be a storage node, which includes multiple physical storage disks, SSDs, and / or other physical storage devices accessible via network 1204 and is configured to store data associated with the applications and services managed by node 1274. For example, Figure 12 As shown, node 1274 can store application data 1278.

[0125] Each of the nodes 1274 can include one or more server computers, server systems, and / or computing devices as computing nodes. For example, the nodes 1274 can include one or more components of the computing device 1202 disclosed herein. Each of the nodes 1274 can be configured to execute one or more software applications (or "applications") and / or services and / or manage hardware resources (e.g., processors, memory, etc.) that can be utilized by users (e.g., clients) of the set of network-accessible servers. For example, Figure 12 As shown, node 1274 can operate application 1276. In an implementation, one of nodes 1274 can operate or include one or more virtual machines, where each virtual machine emulates, in isolation, a system architecture (e.g., an operating system) on which applications such as application 1276 can execute.

[0126] In embodiments, one or more of the clusters 1272 may be co-located (e.g., housed in one or more nearby buildings with associated components such as backup power, redundant data communications, environmental controls, etc.) to form a data center, or may be arranged in other ways. Thus, in embodiments, one or more of the clusters 1272 may be a data center in a distributed collection of data centers. In embodiments, the exemplary computing environment 1200 comprises a portion of a cloud-based platform, but this is by way of example only and is not intended to be limiting.

[0127] In embodiments, the computing device 1202 may access the application 1276 for execution in any manner, such as by a client application and / or a browser at the computing device 1202 .

[0128] For network (e.g., cloud) backup and data security purposes, computing device 1202 may additionally and / or alternatively synchronize copies of applications 1214 and / or application data 1216 to be stored as applications 1276 and / or application data 1278 at network-based server infrastructure 1270. For example, operating system 1212 and / or applications 1214 may include a file hosting service client configured to synchronize applications and / or data stored in storage 1220 at network-based server infrastructure 1270.

[0129] In some embodiments, a local server 1292 may be present in computing environment 1200 and may be communicatively coupled to computing device 1202 via network 1204. When present, local server 1292 is hosted within the organization's infrastructure and, in many cases, is hosted physically on-site at the organization's facilities. Local server 1292 is controlled, managed, and maintained by the organization's IT (information technology) personnel or an IT partner. Application data 1298 may be shared by local server 1292 among the organization's computing devices, including computing device 1202 (when part of the organization), via the organization's local network and / or other networks accessible to the organization (including the Internet). Furthermore, local server 1292 may provide applications, such as application 1296, to the organization's computing devices, including computing device 1202. Thus, local server 1292 may include storage 1294 (including one or more physical storage devices, such as storage disks and / or SSDs) for storing application 1296 and application data 1298, and may include one or more processors for executing application 1296. Furthermore, computing device 1202 may be configured to synchronize copies of application programs 1214 and / or application data 1216 for storage at local server 1292 as backup for application programs 1296 and / or application data 1298 .

[0130] The embodiments described herein may be implemented in one or more of the computing device 1202, the network-based server infrastructure 1270, and the local server 1292. For example, in some embodiments, the computing device 1202 may be used to implement the systems, clients, or devices, or components / subcomponents thereof, disclosed elsewhere herein. In other embodiments, a combination of the computing device 1202, the network-based server infrastructure 1270, and / or the local server 1292 may be used to implement the systems, clients, or devices, or components / subcomponents thereof, disclosed elsewhere herein.

[0131] As used herein, the terms "computer program medium", "computer-readable medium" and "computer-readable storage medium" are used to refer to physical hardware media. Examples of such physical hardware media include any hard disk, optical disk, SSD, other physical hardware media (such as RAM, ROM, flash memory, digital video disk, zip disk, MEM (microelectronic machine) memory, nanotechnology-based storage device), and other types of physical / tangible hardware storage media of storage device 1220. Such computer-readable media and / or storage media are separate from and do not overlap with communication media and propagation signals (excluding communication media and propagation signals). Communication media embodies computer-readable instructions, data structures, program modules or other data in modulated data signals such as carrier waves. The term "modulated data signal" refers to a signal that sets or changes one or more of its characteristics in a manner that encodes information in the signal. By way of example and not limitation, communication media include wireless media, such as acoustic, RF, infrared and other wireless media, and wired media. Embodiments also relate to such communication media, which are separate from and do not overlap with the embodiments relating to computer-readable storage media.

[0132] As described above, computer programs and modules (including application programs 1214) can be stored in storage device 1220. Such computer programs can also be received over network 1204 via wired interface 1280 and / or wireless modem 1260. Such computer programs, when executed or loaded by the application, enable computing device 1202 to implement the features of the embodiments discussed herein. Thus, such computer programs represent controllers of computing device 1202.

[0133] Embodiments also relate to computer program products including computer code or instructions stored on any computer readable medium or computer readable storage medium.Such computer program products include the physical storage of storage device 1220 as well as other physical storage types. VI. Additional Exemplary Embodiments

[0134] A system is described herein. The system includes a proxy computing device. The proxy computing device receives a first request for a resource from a first client computing device, the first request including authentication credentials; verifies the authentication credentials; determines a first placeholder value indicating that the authentication credentials are verified; determines that the requested resource corresponds to a first modified version of the resource stored in a memory accessible to the proxy computing device, the first modified version including a code component including a first placeholder inserted by the proxy computing device; retrieves the first modified version; generates a second modified version of the resource by replacing the first placeholder with the first placeholder value; and sends the second modified version of the resource to the first client computing device.

[0135] In one implementation of the foregoing system, the proxy computing device: receives a resource from the server computing device; identifies a code component included in the resource; generates a first modified version of the resource by inserting a first placeholder in the identified code component; and stores the first modified version of the resource in a memory.

[0136] In one implementation of the aforementioned system, the code component includes a second placeholder inserted by the proxy computing device. The proxy computing device: determines a second placeholder value based on the received first request, and generates a second modified version by replacing the second placeholder with the second placeholder value.

[0137] In one implementation of the aforementioned system, the second placeholder includes: a suffix placeholder specifying a suffix to be inserted into the identified code component; or a context placeholder specifying a script context to be inserted into the identified code component.

[0138] In one implementation of the foregoing system, the proxy computing device stores the first placeholder value in a memory.

[0139] In one implementation of the foregoing system, the proxy computing device: receives a second request for the resource from a second client computing device; determines a second placeholder value based on the received second request; retrieves the first modified version; generates a third modified version of the resource by replacing the placeholder with the second placeholder value; and sends the third modified version of the resource to the second client computing device.

[0140] In one implementation of the foregoing system, the agent computing device executes a security agent.

[0141] In one implementation of the foregoing system, the identified code component includes a static import statement.

[0142] A method performed by a proxy computing device is described herein. The method includes receiving a first request for a resource from a first client computing device, the first request including authentication credentials; validating the authentication credentials; determining a first placeholder value indicating that the authentication credentials are validated; determining that the requested resource corresponds to a first modified version of the resource stored in a memory accessible to the proxy computing device, the first modified version including a code component including a first placeholder inserted by the proxy computing device; retrieving the first modified version; generating a second modified version of the resource by replacing the first placeholder with the first placeholder value; and sending the second modified version of the resource to the first client computing device.

[0143] In one implementation of the foregoing system, a resource is received from a server computing device; code components included in the resource are identified; a first modified version of the resource is generated by inserting a first placeholder in the identified code component; and the first modified version of the resource is stored in a memory.

[0144] In one implementation of the aforementioned system, the code component includes a second placeholder inserted by the proxy computing device. The method further includes determining a second placeholder value based on the received first request, and generating a second modified version by replacing the second placeholder with the second placeholder value.

[0145] In one implementation of the aforementioned system, the placeholder includes: a suffix placeholder specifying a suffix to be inserted into the identified code component; or a context placeholder specifying a script context to be inserted into the identified code component.

[0146] In one implementation of the foregoing system, the method further includes storing the first placeholder value in a memory.

[0147] In one implementation of the foregoing system, the method further includes: receiving a second request for the resource from a second client computing device; determining a second placeholder value based on the received second request; retrieving the first modified version; generating a third modified version of the resource by replacing the first placeholder with the second placeholder value; and sending the third modified version of the resource to the second client computing device.

[0148] In one implementation of the foregoing system, an agent computing device executes a security agent to perform the method.

[0149] In one implementation of the foregoing system, the identified code component includes a static import statement.

[0150] A computer-readable storage medium having programming instructions encoded thereon is described herein. The programming instructions are executed by a processor circuit of a proxy computing device to implement a method. The method includes receiving a first request for a resource from a first client computing device, the first request including authentication credentials; validating the authentication credentials; determining a first placeholder value indicating that the authentication credentials are validated; determining that the requested resource corresponds to a first modified version of the resource stored in a memory accessible to the proxy computing device, the first modified version including a code component including a placeholder inserted by the proxy computing device; retrieving the first modified version; generating a second modified version of the resource by replacing the placeholder with the first placeholder value; and sending the second modified version of the resource to the first client computing device.

[0151] In one implementation of the aforementioned computer-readable storage medium, the method further includes: receiving a resource from a server computing device; identifying a code component included in the resource; generating a first modified version of the resource by inserting a placeholder in the identified code component; and storing the first modified version of the resource in a memory.

[0152] In one implementation of the aforementioned computer-readable storage medium, the code component includes a second placeholder inserted by the proxy computing device. The method further includes: determining a second placeholder value based on the received first request, and generating a second modified version by replacing the second placeholder with the second placeholder value.

[0153] In one implementation of the aforementioned computer-readable storage medium, the second placeholder includes: a suffix placeholder specifying a suffix to be inserted into the identified code component; or a context placeholder specifying a script context to be inserted into the identified code component.

[0154] In one implementation of the aforementioned computer-readable storage medium, the method further includes storing the first placeholder value in a memory.

[0155] In one implementation of the aforementioned computer-readable storage medium, the method further includes: receiving a second request for the resource from a second client computing device; determining a second placeholder value based on the received second request; obtaining the first modified version; generating a third modified version of the resource by replacing the first placeholder with the second placeholder value; and sending the third modified version of the resource to the second client computing device.

[0156] In one implementation of the aforementioned computer-readable storage medium, an agent computing device executes a security agent to perform the method.

[0157] In one implementation of the aforementioned computer-readable storage medium, the identified code component includes a static import statement.

[0158] A method performed by a client computing device is described herein. The method includes: receiving, in a browser, a modified version of a web page, the modified version of the web page including an embed function and a code rewrite function not included in the web page; detecting, in the web page, an event associated with the embed function and a code component; inserting a placeholder in the code component via the embed function to generate a first modified version of the code component; validating authentication credentials; determining a placeholder value indicating that the authentication credentials are validated; replacing the placeholder in the first modified version of the code component with a first placeholder value via the code rewrite function to generate a second modified version of the code component; and evaluating the second modified version of the code component.

[0159] In one implementation of the foregoing method, the detected event comprises the execution of a call to an embedded function, the call to the embedded function including the code component as its argument.

[0160] In one implementation of the aforementioned method, generating the second modified version of the code component includes: executing, by the embedding function, a call to a code rewriting function, the call to the code rewriting function including the second modified version of the code component as its argument.

[0161] In one implementation of the aforementioned method, the method further includes: receiving, in the browser, a first placeholder value from a proxy computing device.

[0162] In one implementation of the foregoing method, the method further includes: sending a request for the web page to the proxy computing device; and receiving a modified version of the web page from the proxy computing device in response to sending the request.

[0163] In one implementation of the aforementioned method, the code component includes a second placeholder, the second placeholder including: a suffix placeholder specifying a suffix to be inserted into the code component; or a context placeholder specifying a script context to be inserted into the code component.

[0164] In one implementation of the foregoing method, the identified code component includes a static import statement.

[0165] This document describes a client computing device. The client computing device includes a processor circuit and a memory. The memory stores program code that can be executed by the processor circuit to execute a web browser and perform operations. The operations include: receiving a modified version of a web page from a proxy computing device in the browser, the modified version of the web page including an embed function and a code rewrite function that are not included in the web page; detecting an event associated with the embed function and a code component in the web page; inserting a placeholder in the code component via the embed function to generate a first modified version of the code component; verifying authentication credentials; determining a placeholder value indicating that the authentication credentials are verified; replacing the placeholder in the first modified version of the code component with the first placeholder value via the code rewrite function to generate a second modified version of the code component; and evaluating the second modified version of the code component.

[0166] In one implementation of the foregoing client computing device, the detected event includes execution of a call to the embedded function, the call to the embedded function including the code component as its argument.

[0167] In one implementation of the aforementioned client computing device, generating the second modified version of the code component includes: executing, by the embedding function, a call to a code rewrite function, the call to the code rewrite function including the second modified version of the code component as its argument.

[0168] In one implementation of the foregoing client computing device, the operations further include: receiving, in the browser, a first placeholder value from the proxy computing device.

[0169] In one implementation of the foregoing client computing device, the operations further include: sending a request for the web page to the proxy computing device; and receiving the modified version of the web page from the proxy computing device in response to sending the request.

[0170] In one implementation of the aforementioned client computing device, the code component includes a second placeholder, the second placeholder including: a suffix placeholder specifying a suffix to be inserted into the code component; or a context placeholder specifying a script context to be inserted into the code component.

[0171] In one implementation of the foregoing client computing device, the identified code component includes a static import statement.

[0172] A system comprising the aforementioned client computing device is described herein.

[0173] A computer-readable storage medium having programming instructions encoded thereon is described herein. The programming instructions are executable by a processor circuit of a client computing device to perform a method. The method includes: receiving, in a browser of the client computing device, a modified version of a web page, the modified version of the web page including an embed function and a code rewrite function that are not included in the web page; detecting, in the web page, an event associated with the embed function and a code component; inserting a placeholder in the code component via the embed function to generate a first modified version of the code component; validating authentication credentials; determining a placeholder value indicating that the authentication credentials are validated; replacing the placeholder in the first modified version of the code component with the first placeholder value via the code rewrite function to generate a second modified version of the code component; and evaluating the second modified version of the code component.

[0174] In one implementation of the aforementioned computer-readable storage medium, the detected event includes execution of a call to an embedded function, the call to the embedded function including a code component as its argument.

[0175] In one implementation of the aforementioned computer-readable storage medium, generating the second modified version of the code component includes: executing, by the embedding function, a call to a code rewriting function, the call to the code rewriting function including the second modified version of the code component as its argument.

[0176] In one implementation of the aforementioned computer-readable storage medium, the method further includes: receiving, in the browser, a first placeholder value from a proxy computing device.

[0177] In one implementation of the aforementioned computer-readable storage medium, the method further includes: sending a request for the web page to the proxy computing device; and receiving a modified version of the web page from the proxy computing device in response to sending the request.

[0178] In one implementation of the aforementioned computer-readable storage medium, the code component includes a second placeholder, the second placeholder including: a suffix placeholder specifying a suffix to be inserted into the code component; or a context placeholder specifying a script context to be inserted into the code component.

[0179] In one implementation of the aforementioned computer-readable storage medium, the identified code component includes a static import statement. VII. Conclusion

[0180] References in the specification to "one embodiment," "an embodiment," "an example embodiment," etc., indicate that the described embodiment may include a particular feature, structure, or characteristic, but every embodiment may not necessarily include the particular feature, structure, or characteristic. Furthermore, such phrases do not necessarily refer to the same embodiment. Furthermore, when a particular feature, structure, or characteristic is described in conjunction with an embodiment, it is understood that it is within the knowledge of those skilled in the art to affect such feature, structure, or characteristic in conjunction with other embodiments, whether or not explicitly described.

[0181] In the discussion, unless otherwise indicated, adjectives modifying conditions or relationship characteristics of one or more features of the implementation of the present disclosure should be understood to mean that the condition or characteristic is defined to be within an acceptable tolerance for the operation of the implementation for its intended application. In addition, if the performance of an operation is described herein as being "responsive to" one or more factors, it should be understood that the one or more factors may be viewed as the sole contributing factors for causing the operation to occur or as contributing factors in conjunction with one or more additional factors for causing the operation to occur, and the operation may occur at any time upon or after the establishment of the one or more factors. In addition, where "based on" is used to indicate that an effect is a result of the indicated cause, it should be understood that the effect need not be produced solely by the indicated cause, but that any number of possible additional causes may also contribute to the effect. Therefore, as used herein, the term "based on" should be understood to be equivalent to the term "based at least on."

[0182] A number of example embodiments have been described above. Any section / subsection headings provided herein are not intended to be limiting. Embodiments are described throughout this document, and any type of embodiment may be included under any section / subsection. Furthermore, an embodiment disclosed in any section / subsection may be combined in any manner with any other embodiment described in the same section / subsection and / or in a different section / subsection.

[0183] Furthermore, the exemplary embodiments have been described above with respect to one or more operational examples. Such operational examples describe one or more specific implementations of the exemplary embodiments; however, the embodiments described herein are not limited to these specific implementations.

[0184] Furthermore, in accordance with the described embodiments and techniques, any component of a system, computing device, server, identity provider, web browser, proxy service, resource modifier, web page modifier, placeholder service, and / or data store, and functionality thereof, may be activated for operation / execution thereof based on other operations, functions, actions, and the like, including the initiation, completion, and / or execution of operations, functions, actions, and the like.

[0185] In some example embodiments, one or more operations of the flowcharts described herein may not be performed. Furthermore, operations may be performed in addition to or instead of the operations of the flowcharts described herein. Furthermore, in some example embodiments, one or more operations of the flowcharts described herein may be performed out of sequence, in an alternative sequence, or partially (or completely) simultaneously with each other or with other operations.

[0186] The embodiments described herein and / or any other systems, subsystems, devices, and / or components disclosed herein may be implemented in hardware (e.g., hardware logic / circuitry) or in any combination of hardware and software (computer program code configured to be executed in one or more processors or processing devices) and / or firmware.

[0187] Although various embodiments have been described above, it should be understood that they are presented by way of example only and not limitation. It will be apparent to those skilled in the relevant art that various changes in form and details may be made without departing from the spirit and scope of the embodiments. Therefore, the breadth and scope of the embodiments should not be limited by any of the above-described exemplary embodiments, but should be defined only in accordance with the appended claims and their equivalents.

Claims

1. A system (1200), comprising: An agent computing device (110) that: receiving a first request (244, 502) for a resource (218) from a first client computing device (114, 514), the first request (244, 502) including authentication credentials; verifying the authentication credentials; determining a first placeholder value indicating that the authentication credential is verified; determining that the requested resource (218) corresponds to a first modified version (212, 226) of a resource stored in a memory (206) accessible to the proxy computing device (110), the first modified version (212, 226) including a code component including a first placeholder inserted by the proxy computing device (110); Retrieving the first modified version (212, 226); generating a second modified version of the resource by replacing the first placeholder with the first placeholder value (230, 530); and The second modified version (230, 530) of the resource is sent to the first client computing device (114, 514).

2. The system of claim 1 , wherein the proxy computing device: receiving the resource from a server computing device; Identifying the code component included in the resource; generating the first modified version of the resource by inserting the first placeholder in the identified code component; and The first modified version of the resource is stored in the memory.

3. The system of claim 1 , wherein: The code component includes a second placeholder inserted by the proxy computing device; and The proxy computing device: determining a second placeholder value based on the received first request, and The second modified version is generated by replacing the second placeholder with the second placeholder value.

4. The system of claim 3, wherein the second placeholder comprises: A suffix placeholder specifying a suffix to be inserted into the identified code component; or A context placeholder that specifies the script context to be inserted into the identified code component. The system of claim 1 , wherein the proxy computing device stores the first placeholder value in the memory.

6. The system of claim 1 , wherein the proxy computing device: receiving a second request for the resource from a second client computing device; determining a second placeholder value based on the received second request; retrieving the first modified version; generating a third modified version of the resource by replacing the placeholder with the second placeholder value; as well as The third modified version of the resource is sent to the second client computing device. The system of claim 1 , wherein the proxy computing device executes a security agent.

8. The system of claim 1, wherein the identified code component comprises a static import statement.

9. A method (400) performed by an agent computing device, comprising: receiving a first request for a resource from a first client computing device, the first request including authentication credentials (402); Verifying the authentication credentials (404); determining a first placeholder value indicating that the authentication credential is verified (406); determining that the requested resource corresponds to a first modified version of a resource stored in a memory accessible to the proxy computing device, the first modified version including a code component including a first placeholder inserted by the proxy computing device (408); Retrieving the first modified version (410); generating a second modified version of the resource by replacing the first placeholder with the first placeholder value (412); as well as The second modified version of the resource is sent to the first client computing device (414).

10. The method according to claim 9, further comprising: receiving the resource from a server computing device; Identifying the code component included in the resource; generating the first modified version of the resource by inserting the first placeholder in the identified code component; and The first modified version of the resource is stored in the memory.

11. The method according to claim 9, wherein: The code component includes a second placeholder inserted by the proxy computing device; as well as The method further comprises: determining a second placeholder value based on the received first request, and The second modified version is generated by replacing the second placeholder with the second placeholder value.

12. The method of claim 11, wherein the placeholder comprises: A suffix placeholder specifying a suffix to be inserted into the identified code component; or A context placeholder that specifies the script context to be inserted into the identified code component.

13. The method according to claim 9, further comprising: The first placeholder value is stored in the memory.

14. The method according to claim 9, further comprising: receiving a second request for the resource from a second client computing device; determining a second placeholder value based on the received second request; retrieving the first modified version; generating a third modified version of the resource by replacing the first placeholder value with the second placeholder value; as well as The third modified version of the resource is sent to the second client computing device.

15. The method of claim 9, wherein the proxy computing device executes a security agent to perform the method.

16. The method of claim 9, wherein the identified code components include static import statements.

17. A computer-readable storage medium (1220, 1274, 1294) having encoded thereon programming instructions (1214, 1276, 1296), the programming instructions being executed by a processor circuit (1210) of an agent computing device (110) to implement a method (400), the method (400) comprising: receiving a first request for a resource from a first client computing device, the first request including authentication credentials (402); Verifying the authentication credentials (404); determining a first placeholder value indicating that the authentication credential is verified (406); determining that the requested resource corresponds to a first modified version of a resource stored in a memory accessible to the proxy computing device, the first modified version including a code component including a placeholder inserted by the proxy computing device (408); Retrieving the first modified version (410); generating a second modified version of the resource by replacing the placeholder with the first placeholder value (412); as well as The second modified version of the resource is sent to the first client computing device (414).

18. The computer-readable storage medium of claim 17, wherein the method further comprises: receiving the resource from a server computing device; Identifying the code component included in the resource; generating the first modified version of the resource by inserting the placeholder in the identified code component; and The first modified version of the resource is stored in the memory.

19. The computer-readable storage medium of claim 17, wherein the method further comprises: receiving a second request for the resource from a second client computing device; determining a second placeholder value based on the received second request; retrieving the first modified version; generating a third modified version of the resource by replacing the placeholder with the second placeholder value; as well as The third modified version of the resource is sent to the second client computing device.

20. The computer-readable storage medium of claim 17, wherein the identified code component comprises a static import statement.

Images