Cross-Application Session Continuity via Single-Use Passwords
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Browsers disabling or managing cookies differently can lead to loss of functionality and expose session information to security risks when used for maintaining user sessions across multiple web applications hosted on different domains.
Innovation Solution
A method involving a first web application generating a single-use password, passing it to a client application, and providing session data to a second web application upon validation, allowing seamless session continuation without relying on cookies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cookies are used to store session information across multiple web applications, then session continuity is achieved, but security risks increase due to potential eavesdropping and browser cookie management variability
Solution Approach 1:
The patent extracts the session information from cookies and stores it server-side in a session store. The client receives a session identifier instead of actual session data, which is kept secure on the server. This separation eliminates the security vulnerability of storing sensitive session information in client-side cookies that can be intercepted or manipulated.
Solution Approach 2:
The patent introduces a session store as an intermediary component between the web applications and the client. This session store acts as a secure mediator that holds session information and provides it to applications through controlled access, preventing direct exposure of session data to clients and reducing eavesdropping risks.
2Reliability
If cookies are used for session management, then user authentication state is maintained, but functionality is lost when browsers disable or manage cookies differently
Solution Approach 1:
The patent extracts session management dependency from client-side cookies and relocates it to server-side storage. The client only needs to store and transmit a non-sensitive session identifier, while the actual session state is maintained server-side, making the system functional regardless of browser cookie settings or management policies.
Solution Approach 2:
The session store provides a universal interface for session management that works across all browsers and devices, regardless of their cookie handling behavior. By decoupling session storage from client-side cookies, the system achieves broader adaptability and consistency across different browser environments.
3Ease of operation
If domain-specific cookies are used, then each web application can maintain its own session, but seamless access across different domains becomes difficult
Solution Approach 1:
The patent merges the session management functionality across multiple domains by implementing a shared session store that all web applications can access. Instead of maintaining separate domain-specific cookies, the system consolidates session information in a centralized store that applications can query and update, enabling seamless cross-domain access while maintaining domain-specific operational needs.
Data Source
AI summary
A technique for maintaining user sessions across multiple web applications includes receiving, by a first web application running on a first server, a cross-application request from a client application. The cross-application request indicates a user action to access a second web application, which runs on a second server. In response to receiving the cross-application request, the first web application sends a single-use password to the client application, which may send the single-use password to the second web application. The first web application receives a session request, which includes the single-use password, from the second web application. In response to receiving the session request, the first web application sends session data to the second web application, enabling the second web application to participate in a session with the client application.