CORS Proxy Server for Secure Cross-Domain Web Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for enabling cross-domain communications between web applications and storage systems via web browsers face security challenges due to cross-domain request prohibitions, with existing solutions like JSONP and XMLHttpRequest Level 2 being inadequate for handling sensitive information and requiring server-side support.
Innovation Solution
An information processing apparatus and method that utilizes a Scan Server operating in a different domain than the web application service, employing CORS standards and a lock function with connection IDs to facilitate secure and user-convenient cross-domain communications, allowing the web application to interact with the image reading apparatus and transmit data to a web storage system without direct cross-domain access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If JSONP is used to obtain cross-domain data, then cross-domain communications are enabled, but security is compromised because the server's endpoint is always exposed
Solution Approach 1:
The patent introduces a CORS proxy server as an intermediary between the web application and the web storage system. This proxy server receives requests from the web application, forwards them to the web storage system, and handles CORS headers automatically. This mediator approach enables cross-domain communication while maintaining security by avoiding direct exposure of server endpoints to client-side JavaScript.
2Adaptability or versatility
If XMLHttpRequest Level 2 with CORS is used, then cross-domain requests are permitted, but the web storage service must support CORS and configure permitted domains, making the solution complex and requiring server-side support
Solution Approach 1:
The CORS proxy server acts as an intermediary that handles CORS configuration and request forwarding. Instead of requiring the web storage system to configure CORS for every domain, the proxy server manages this complexity centrally. The web application simply needs to point to the proxy server, and the proxy handles all CORS-related configurations and communications.
Solution Approach 2:
The system is segmented into three independent components: the web application, the CORS proxy server, and the web storage system. This segmentation allows each component to have independent functionality - the web application doesn't need CORS support, the web storage system doesn't need domain configuration, and the proxy server handles these complexities separately.
3Ease of manufacture
If a desktop application is developed to operate the image reading apparatus, then the application can be developed with full functionality, but efficiency is reduced due to divided jobs and effort required to familiar with multiple applications
Solution Approach 1:
The patent merges the image reading functionality and web storage functionality into a single unified web-based workflow. Instead of requiring separate desktop applications for image reading and separate web applications for storage, the system combines these functions so that image reading operations directly feed into web storage through the CORS proxy, eliminating the need for multiple separate applications and improving user efficiency.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
An information processing apparatus includes: reception means for receiving a request from a web application executed on a web browser; acquisition means for acquiring, from the request, information about a domain of a request source; determination means for determining whether or not to permit the domain indicated in the information acquired by the acquisition means; and transmission means for transmitting a response to the web browser based on the result of determination of the determination means.