Cross-Origin Communication Channel for Web Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current computing systems face challenges in securely communicating between cross-origin execution contexts, as same-origin policies restrict data access and interaction, hindering unified user interfaces and seamless event triggering across different origins.
Innovation Solution
Establishing a bi-directional communication channel between cross-origin execution contexts using uni-directional sub-channels, facilitated by the postMessage API, allows for secure message transmission and event handling across different origins, enabling unified user interfaces and event-driven interactions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If same-origin policy is implemented to restrict cross-origin document interaction, then security and data integrity are improved, but cross-origin communication capability deteriorates
Solution Approach 1:
The patent introduces a message channel as an intermediary mechanism that enables cross-origin communication while maintaining security boundaries. The channel acts as a mediator between execution contexts from different origins, allowing controlled information exchange without compromising the same-origin policy's security model. Messages are transmitted through this intermediate structure rather than direct access, resolving the contradiction between security restriction and communication need.
Solution Approach 2:
The communication capability is segmented into uni-directional sub-channels that can be individually established and controlled. Rather than implementing a broad cross-origin access mechanism, the patent divides communication into discrete, directed channels between specific execution contexts. This segmentation allows selective enabling of cross-origin communication paths while maintaining security restrictions elsewhere.
2Reliability
If same-origin policy restricts data access between different origins, then data confidentiality is improved, but unified user interface implementation deteriorates
Solution Approach 1:
The message channel serves as an intermediary that enables unified user interface implementation across cross-origin embedded content while preserving data confidentiality. UI events and interactions can be transmitted through the channel, allowing the top-level document and embedded documents to cooperate in creating a unified interface experience without exposing confidential data structures or internal states directly to each other.
Solution Approach 2:
The bi-directional communication channel enables feedback mechanisms between the top-level document and embedded documents. UI events, user interactions, and state changes can be communicated back and forth through the channel, allowing embedded content to respond to user actions and maintain synchronization with the overall UI state while keeping data access restricted.
3Object-affected harmful factors
If direct cross-origin access is blocked, then security against malicious code is improved, but event-driven interaction between origins deteriorates
Solution Approach 1:
The message channel acts as a secure intermediary that enables event-driven interaction between execution contexts from different origins without allowing direct access. Events can be posted and received through the channel's message passing mechanism, maintaining the security boundary while enabling the event-driven architecture needed for responsive web applications.
Solution Approach 2:
Each execution context maintains autonomy and self-service capabilities while interacting through the channel. The postMessage API and message reception mechanisms are self-contained within each context, allowing them to independently manage their event handling and communication protocols without requiring direct access to the other context's internal mechanisms.
Data Source
AI summary
This specification discloses techniques for communicating data between a first execution context on a computing system and a second execution context on the computing system. The first execution context can execute content from a first origin, the second execution context can execute content from a second origin that is different from the first origin, and the first execution context and the second execution context can each be restricted from accessing data of the other as a result of a same-origin policy implemented by the computing system. The method can include establishing a bi-directional communication channel between the first execution context and the second execution context.