Client-Side Anti-Hijacking Script for Web Page Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for preventing HTTP hijacking, such as using HTTPS, require complex upgrades to web servers, leading to performance reductions and potential delays in web page loading, and may still fail if insecure protocols like HTML, CSS, or JavaScript are used, allowing hijacking to occur.
Innovation Solution
A method involving a client and an antihijacking server that embeds script code in HTML source files to detect and hide DOM nodes used for HTTP hijacking, ensuring normal content is displayed by traversing the DOM tree and filtering out illegal URLs, without user participation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If HTTPS is used to prevent HTTP hijacking, then security against hijacking and information leakage is improved, but server performance deteriorates and web page load time increases
Solution Approach 1:
The patent segments the security protection function into a separate client-side script (anti-hijacking.js) that operates independently from the main web server. This script is downloaded and executed in the user's browser, dividing the security responsibility from the server and allowing the server to maintain its original HTTP performance while the client handles hijacking detection and prevention locally.
Solution Approach 2:
The patent introduces an intermediary anti-hijacking script that acts as a mediator between the user's browser and the web content. This script monitors DOM changes, detects hijacked content, and blocks malicious elements before they can affect the user experience, serving as a buffer that protects against hijacking without requiring the entire system to adopt HTTPS.
2Reliability
If HTTPS is used to prevent HTTP hijacking, then security against hijacking is improved, but web page load time deteriorates
Solution Approach 1:
The patent implements preliminary action by having the anti-hijacking script execute as soon as it is loaded, before any web content is rendered. The script sets up event listeners and monitoring mechanisms in advance, allowing it to detect and block hijacked content immediately upon insertion into the DOM, rather than waiting for the full page to load and then checking for security issues.
Solution Approach 2:
The patent applies the skipping principle by allowing the main web page content to load and render without waiting for comprehensive security verification. The anti-hijacking script operates in parallel, continuously monitoring for hijacked content and blocking it when detected, rather than sequentially verifying security before allowing page display. This enables the page to progress through loading while security checks occur simultaneously.
3Reliability
If all stations use HTTPS to achieve effective protection, then security is improved, but device complexity and implementation difficulty increase
Solution Approach 1:
The patent implements self-service by enabling individual websites and users to opt into anti-hijacking protection independently, without requiring coordination with other sites or infrastructure changes. Each user's browser automatically downloads and executes the anti-hijacking script from the content delivery network, and each website can independently integrate the script tag into their pages. This allows security protection to be deployed piecemeal across the web without requiring universal HTTPS adoption or complex multi-party coordination.
Data Source
AI summary
A method for preventing hijacking of a web page is provided. A HyperText Markup Language (HTML) source file is received from a web server in response to a HyperText Transfer Protocol (HTTP) access request, the HTML source file being embedded with a script tag corresponding to script code for preventing HTTP hijacking. The script code for preventing HTTP hijacking is pulled from an antihijacking server according to the script tag. It is detected, based on the script code for preventing HTTP hijacking, whether a document object model (DOM) node used for HTTP hijacking exists in a DOM tree. The DOM node used for HTTP hijacking is hidden from a web page of a browser in response to detecting that the DOM node used for HTTP hijacking.