Cross-Domain Traffic Routing for Cookie-Free SaaS Login
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Multi-tenant SaaS providers face challenges in maintaining seamless user sessions across different tenant network domains due to the inability to read third-party cookies, leading to redundant login requirements.
Innovation Solution
An identity matching service predicts the presence of active login cookies for a service network domain based on user identifiers, directing network traffic to either a login or logged-in state without relying on third-party cookies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If third-party cookies are used to maintain user sessions across tenant network domains, then seamless cross-domain login is achieved, but browser security restrictions and privacy policies prevent reading third-party cookies, causing redundant login requirements
Solution Approach 1:
The patent introduces an identity matching service as an intermediary between the tenant network domain and service network domain. This service receives identifiers from the tenant domain, predicts whether active login cookies exist for the service domain, and facilitates seamless redirection without directly relying on third-party cookie reading, thus resolving the contradiction between session continuity and browser security restrictions
Solution Approach 2:
The identity matching service performs preliminary prediction of cookie presence before actual service access. By predicting whether active login cookies are stored based on received identifiers, the system can proactively determine the appropriate redirect target (login page or service page), avoiding redundant login steps and ensuring session continuity before the user actually accesses the service
2Adaptability or versatility
If users are redirected to service network domain for each access, then service functionality is enabled, but multiple redirects increase navigation complexity and user friction
Solution Approach 1:
The system performs preliminary prediction of the user's login state before redirection. By predicting whether active login cookies are present based on identifiers received from the tenant domain, the system can directly redirect to the appropriate state (login or service) in a single action, eliminating the need for multiple trial redirects and reducing navigation complexity
Solution Approach 2:
The identity matching service uses feedback from identifier matching to determine redirect behavior. By comparing received identifiers against stored data to predict cookie presence, the system gets feedback about the user's likely authentication state and adjusts the redirect accordingly, ensuring service access capability while minimizing unnecessary navigation steps
Data Source
AI summary
A server of a first tenant network domain receives one or more identifiers associated with a browser application that was used to access a webpage of the first tenant network domain. The server identifies, based on the one or more identifiers associated with the browser application, a likelihood that an active login cookie associated with a service network domain is stored by the browser application. If the likelihood exceeds a threshold, the server causes the browser application to be directed to a webpage on the service network domain that is associated with a logged-in state at the service network domain.