Native App to Browser Session Token Transition
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Native applications cannot transfer a user's logged-in state to an external browser, requiring users to re-enter credentials when accessing protected web resources, which is inconvenient and exposes credentials to potential attacks.
Innovation Solution
A system that obtains an access token from a Central Authentication Service (CAS) and requests a session token, which is then used to initialize an authenticated session scoped to the desired web resource, allowing the native application to direct the browser to access the resource without re-entering credentials.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the native application spawns an external browser instance to access web resources, then the user can access protected web properties, but the user must re-enter credentials and the logged-in state cannot be transferred
Solution Approach 1:
The patent introduces a session token as an intermediary mechanism that bridges the native application and web browser. The session token carries authentication information from the native application to the browser, enabling seamless transition without requiring users to re-enter credentials. This intermediary solves the problem of state transfer between different application contexts.
Solution Approach 2:
The patent implements preliminary authentication in the native application before spawning the browser. The system obtains an access token from the CAS server in advance, then uses this token to request a session token that will be valid for the upcoming browser session. This preliminary action ensures the browser starts in an authenticated state, eliminating the need for repeated login.
2Ease of operation
If the native application transfers authentication credentials to the browser, then the logged-in state can be maintained, but credentials are exposed to potential security risks
Solution Approach 1:
The patent uses short-lived session tokens instead of transferring long-term credentials. The session token has a limited lifespan and can be invalidated by the server at any time. This disposable approach allows authentication state transfer while minimizing security risks, as the token becomes useless after expiration or revocation, preventing long-term credential exposure.
Solution Approach 2:
The patent changes the authentication parameter from permanent credentials (username/password) to temporary session tokens. This parameter transformation maintains the authenticated state across applications while fundamentally reducing security risks. The session token is a derived credential that provides access without exposing the original authentication credentials.
3Ease of operation
If the system uses long-lived access tokens for authentication, then convenience is improved, but security is reduced due to longer exposure window
Solution Approach 1:
The patent segments the authentication process into two distinct phases: a long-lived access token phase for the native application, and a short-lived session token phase for the browser. This segmentation allows each component to use the appropriate token lifespan - the native application benefits from long-term access tokens for convenience, while the browser uses short-term session tokens for security, resolving the contradiction between convenience and security.
Data Source
AI summary
One embodiment of the present invention relates to a system that enables a user of an application that runs natively on a client to obtain access to a web resource that is affiliated with the native application. First, the native application obtains an access token from a Central Authentication Service (CAS). Next, the native application sends a secure request for a one-time use session token to the CAS. If the CAS determines the request is valid, the CAS initializes a session token and sends the session token to the native application. After receiving the session token, the native application directs a browser to an endpoint server, appending the session token to the browser's request. Finally, the endpoint server initializes an authenticated session wherein the authenticated session is scoped to the desired web resource.