Session Cookie Authentication via Query Parameter Matching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing SaaS systems face security issues where certification Cookies can be misused by malicious programs sharing the same Web browser, allowing unauthorized access to user data storage units.
Innovation Solution
A service providing method that generates and transmits a certification Cookie and session data to the client, where the data is verified as a query parameter in service requests, ensuring only authorized access by matching the data within the Cookie with the query parameter.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the server publishes the certification Cookie and judges access right by determining whether the certification Cookie same as the published certification Cookie is acquired from the client, then the access control is simplified, but other programs using the same Web browser can also utilize the published certification Cookie and access the user data storage unit illegally
Solution Approach 1:
The patent segments the certification verification process into two independent parts: (1) the certification Cookie stored in the browser, and (2) the session identifier passed through URL parameters. Both parts must be present and match for successful authentication. This segmentation prevents unauthorized access because even if one part is compromised, the other remains protected.
Solution Approach 2:
The patent introduces a session identifier as an intermediary element that bridges the certification Cookie and the service request. The session identifier is generated by the server, passed to the client, and then returned in the request URL along with the certification Cookie. This intermediary mechanism ensures that the server can verify both the user's identity (via certification Cookie) and the request's legitimacy (via session identifier match).
Data Source
AI summary
A service providing method, the method includes generating, by an information processing device, data relating to a session and a cookie relating to a certification including the data when the certification is successful in response to a certification request of the session received from a client device, transmitting, by the information processing device, the data and the cookie to the client device, receiving, by the information processing device, a service request which is given the data as a query parameter and the cookie from the client device, and providing, by the information processing device, a service of the service request to the client device when the data included in the cookie matches with the data which is given as the query parameter.