Native App Session Termination for OAuth Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing OAuth implementation in native software applications leads to persistent browser-server sessions after logout, which can be contrary to user expectations and poses a security risk, allowing unauthorized access when session cookies remain active.
Innovation Solution
The native software application is configured to terminate active browser-server sessions with the authorization server before initiating a new login procedure, ensuring that login credentials are required for each session, thereby maintaining user security and expectations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the OAuth standard is implemented with browser-server session persistence, then user convenience is improved (no repeated login required), but security is worsened (unauthorized access risk after logout)
Solution Approach 1:
The patent segments the session management into two distinct components: application-server sessions (managed by access tokens) and browser-server sessions (managed by session cookies). This segmentation allows independent control of each session type, enabling the native application to terminate its session while the browser session can persist for convenience, or terminate both for security. The segmentation resolves the contradiction by allowing flexible configuration of session persistence at different layers.
Solution Approach 2:
The patent introduces an intermediary mechanism (the native application acting as a mediator between the browser and authorization server) that can detect when a user logs out and actively terminate the browser-server session by communicating with the authorization server. This intermediary resolves the security issue by bridging the gap between the native application's logout action and the browser session state, allowing the native application to influence browser session persistence despite not having direct control over cookies.
2Reliability
If the native software application terminates the application-server session by deleting the access token, then security is improved (application session ends), but the browser-server session persists causing inconsistent login behavior
Solution Approach 1:
The patent implements a feedback mechanism where the native application monitors the logout state and provides feedback to the authorization server to terminate the browser session. When the user logs out of the native application, the system detects this state change and communicates it to the authorization server, which then terminates the associated browser session. This feedback loop ensures that application session termination is reflected in the browser session state, resolving the inconsistency in login behavior.
Solution Approach 2:
The patent applies preliminary action by having the native application proactively terminate the browser-server session before allowing any subsequent login attempts. By preemptively ending the browser session when the application logs out, the system prevents potential security issues and ensures consistent login behavior, forcing users to re-authenticate through the proper OAuth flow rather than relying on stale session cookies.
3Loss of time
If the browser-server session persists after logout, then user convenience is improved (faster subsequent login), but unauthorized access risk increases (other users can access logged-in accounts)
Solution Approach 1:
The patent introduces dynamic session management where the persistence of browser-server sessions is not fixed but adapts based on application state. When the native application is logged in, browser sessions can persist for convenience. When the application logs out, the system dynamically terminates browser sessions to prevent unauthorized access. This dynamic adjustment resolves the contradiction by making session persistence conditional rather than static, balancing convenience and security based on current authentication state.
Solution Approach 2:
The patent changes the session timeout parameter dynamically based on application login state. When the native application is authenticated, the browser session timeout is extended to provide convenience. When the application logs out, the timeout is reduced to immediately terminate the session. This parameter change strategy resolves the contradiction by adjusting session duration to match security requirements, allowing long sessions only when appropriate rather than using a fixed timeout value.
Data Source
AI summary
A computing system includes a web browser and a native application configured to, at a first time, receive first instructions to log out of a first session authorized by way of an authorization server. Based on the first instructions, the native application removes a first access token that was provided to the native application by the authorization server and is related to authorization of the first session. At a second time later than the first time, the native application receives second instructions to authorize a second session and, based thereon, generates third instructions configured to cause the authorization server to terminate active sessions between the authorization server and the web browser prior to initiating a log-in procedure with the web browser for the second session. The third instructions are provided to the authorization server, which provides an authorization code exchangeable for a second access token related to the second session.