Cookie Optimization for Multi-Account Identity Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The limitations of cookies in web-based applications, specifically the 4 KB size restriction and 20-cookie limit per domain, make it difficult to manage a user's privileges across multiple accounts, especially in cloud-based systems where users have access to numerous accounts with varying levels of access.
Innovation Solution
A cookie optimization system that uses an identity service to verify user identity and determine authorized domains, issuing an intermediate token with account locations, allowing users to select accounts via a dashboard, and converting the account token back to an intermediate token for seamless account switching, thereby managing multiple accounts efficiently.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If cookies are used to store user privileges for multiple accounts, then authentication and authorization can be transmitted between web pages, but the cookie size is limited to 4 KB and the number of cookies is limited to 20 per domain
Solution Approach 1:
The patent segments the authentication and authorization data by separating the claim-based authentication (stored in a single cookie) from the account-specific privileges (stored in server-side session data). This allows the cookie to remain within the 4 KB limit while still supporting access to multiple accounts through the claim token, resolving the contradiction between ease of transmission and quantity of privilege data.
2Adaptability or versatility
If the user is associated with a large number of accounts, then the user has access to many privileges, but keeping the user's claim within the limited cookie size is extremely difficult
Solution Approach 1:
The patent extracts the detailed account-specific privilege information from the cookie and stores it on the server side in session data. The cookie only contains the essential claim-based authentication token, which is much smaller. This extraction allows the system to support a large number of accounts and privileges without increasing cookie size beyond the 4 KB limit.
3Ease of operation
If multiple cookies are issued for different accounts, then each account's privileges can be managed separately, but the user is limited to a maximum of 20 cookies per domain
Solution Approach 1:
The patent merges the authentication function (claim-based) with the account selection function into a single cookie mechanism. Instead of issuing separate cookies for each account, the system issues one claim-based authentication cookie that enables access to multiple accounts. The account-specific privileges are managed through server-side session data, combining multiple functions into a unified approach that avoids the 20-cookie limit.
Data Source
AI summary
Disclosed herein is a system and method for optimizing a cookie or token in a web service or other claims based domain system. A user presents an identity token to the domain system which verifies the identity claim as authentic and then determines what accounts the user has access to on the domain. The user is issued an intermediate token by the system which includes the locations of the accounts the user has access to. The user then selects the account they wish to interact with and receives an account token back to the user for the specific account, including any of the privileges the user has on the account. The account token also includes information that the user has multiple accounts on the domain. The user is able to switch accounts on the domain system without having to revalidate their credentials to the domain system.