Impromptu Component Manager Bypasses Web Firewall Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Web applications face security risks due to the need for validating user input, which can be impractical for custom portlets that require bypassing validation rules, especially when integrating with existing application components.
Innovation Solution
A method involving signing and transforming request parameters to bypass validation rules, allowing secure data transfer between a Web client and a Web application by using an Impromptu Component Manager to manage and dispatch requests to custom portlets, thereby avoiding the need for updating validation rules.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If web application firewall validates all incoming requests against generic security rules, then security is improved, but custom portlets cannot be integrated without updating validation rules
Solution Approach 1:
The patent introduces an intermediary component (portlet container or gateway) that sits between the web application firewall and custom portlets. This intermediary translates and adapts requests destined for custom portlets into a format that complies with the firewall's generic validation rules, allowing custom functionality to integrate seamlessly without modifying the firewall's security policies.
Solution Approach 2:
The system segments the validation process by separating the firewall's generic security validation from custom portlet-specific validation. The firewall handles standard security rules for all requests, while a separate validation mechanism handles custom portlet requirements, allowing both to coexist without conflict.
2Adaptability or versatility
If validation rules are updated to accommodate custom portlets, then adaptability is improved, but security complexity increases
Solution Approach 1:
The patent extracts custom portlet validation requirements from the main firewall validation rule set. By isolating custom validation logic into separate handlers or translators, the system maintains the simplicity of generic firewall rules while accommodating custom portlets through dedicated validation pathways.
3Device complexity
If generic security rules are applied to all requests, then security management is simplified, but custom portlet functionality is restricted
Solution Approach 1:
The system implements dynamic request routing where the validation approach changes based on the request destination. Requests to standard components use static generic security rules, while requests to custom portlets dynamically invoke specialized validation translators that adapt the generic rules to accommodate custom functionality.
Data Source
AI summary
A method of controlling data transfer between a Web client and a Web application by building a response with a target. The target indicates a destination to an impromptu component of the Web application. The target is signed when a response is built. After receiving the response by the Web client; the corresponding a request from the Web client includes the signed target. The request is received by an entry point of the Web application. The entry point has existing validation rules. The validation rules are by-passed when the signed target is verified. The target is restored in the request to the original state; and dispatched to the impromptu component.