Proxy-Based Identity Management for Anonymous Web API Calls
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Web applications face security vulnerabilities due to complex source code and high-value data targets, necessitating robust identity and access management solutions to protect against malicious attacks.
Innovation Solution
Implementing network proxies to handle identity and access management, where an incoming proxy redirects authentication requests, provides access tokens, and an outgoing proxy manages token retrieval and insertion into API calls, simplifying the web application's security responsibilities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If web applications implement robust identity and access management solutions, then security against malicious attacks is improved, but device complexity increases
Solution Approach 1:
The patent introduces network proxies as intermediary components that sit between the web application and the web APIs. These proxies handle authentication and access token management, allowing the web application to communicate with APIs anonymously without embedding security logic in its code. This mediator approach transfers security responsibilities from the application to the proxy infrastructure.
Solution Approach 2:
The patent extracts security-related functionality (authentication and access token management) from the web application code and places it in dedicated network proxies. By taking out these complex security operations, the application code is simplified and no longer needs to handle security vulnerabilities directly, while the proxies specialize in maintaining secure access.
2Reliability
If access tokens are stored outside the web application, then security is improved, but loss of information may occur during token retrieval and validation
Solution Approach 1:
The patent implements feedback mechanisms where the outgoing proxy receives responses from web APIs that indicate token validity or permission status. When the API returns information about invalid or insufficient tokens, the proxy uses this feedback to determine when to retrieve new access tokens from the identity endpoint, ensuring continuous valid access without information loss.
Solution Approach 2:
The outgoing proxy autonomously monitors token validity and automatically retrieves new access tokens when needed, without requiring intervention from the web application. This self-service capability ensures continuous secure access while managing token information lifecycle independently.
3Ease of operation
If network proxies handle authentication and token management, then ease of operation is improved, but use of energy increases due to additional communication overhead
Solution Approach 1:
The outgoing proxy automatically manages access token retrieval and validation without requiring the web application to perform these operations. This self-service approach simplifies the application's operation while consolidating the computational workload in the proxy infrastructure, which is better positioned to handle these resource-intensive tasks efficiently.
Data Source
AI summary
Techniques described herein are directed to proxies configured to handle identity and access management for a web application. For instance, a first proxy receives requests to the application from a browser. The first proxy redirects the browser to an identity endpoint, which prompts the user to enter authentication credentials for the application. Upon successful authentication, the endpoint provides an access token for accessing web APIs to the first proxy. The first proxy provides the token to a second proxy, which stores the token. The second proxy receives anonymous API calls from the web application to the web APIs. When receiving an anonymous API call, the second proxy obtains the token and inserts it into an outgoing request to the API. Responsive to the API returning a message indicating that the token is invalid, the second proxy communicates with the first proxy to obtain a new token from the endpoint.