Cross-Domain Window Communication via Bridge Iframe

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Web browser security features restrict cross-domain communications between windows and iframes, preventing secure interactions and leading to issues like cross-site scripting attacks, which can hinder the functionality of web pages across different browser programs.

Innovation Solution

The implementation of a 'bridge iframe' within the target window, which allows a pop-up window from a different domain to communicate with the target window by using the SendMessageToParent function, facilitating secure cross-domain interactions by exploiting the child-parent relationship between windows.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If web browser security features restrict cross-domain communications between windows and iframes, then security against cross-site scripting attacks is improved, but functionality of web pages that require cross-domain interactions deteriorates

Engineering Contradiction:

ImprovesecurityVSAvoidcross-domain communication functionality

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The patent introduces an intermediary iframe element that acts as a mediator between the parent window and child window. The intermediary iframe receives messages from the child window and forwards them to the parent window, enabling cross-domain communication without direct window-to-window interaction. This mediator approach allows secure communication by maintaining the security restrictions while providing a controlled channel for data exchange.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Ease of operation

If direct communication between windows from different domains is allowed, then ease of operation for cross-domain interactions is improved, but security concerns and vulnerability to cross-site scripting attacks increase

Engineering Contradiction:

Improvecross-domain interaction capabilityVSAvoidcross-site scripting attack vulnerability

Core Design Contradiction:

Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The intermediary iframe serves as a secure mediator that facilitates communication between windows from different domains without allowing direct access. The child window can send messages to the intermediary iframe, which then forwards them to the parent window through controlled mechanisms. This approach maintains ease of operation for cross-domain interactions while preventing direct access that could lead to cross-site scripting attacks.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent implements a feedback mechanism where the intermediary iframe receives messages from the child window, processes them appropriately, and forwards validated information to the parent window. This feedback loop ensures that only authorized and validated data is transmitted between domains, reducing vulnerability to malicious attacks while maintaining operational capability.

Inventive Principle:

Principle #23Feedback

Data Source

PatentUS11010822B2Cross-domain communications between browser windows

Publication Date: 2021.05.18 AMAZON TECH INC

AI summary

A computer process enables a target window associated with a first domain to receive a message from a child window associated with a second domain. The message is passed using an iframe that is created within the target window. The process may, for example, be used to relay information entered by a user into the child window to the target window.