Token Broker for Cross-Domain Frame Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Internet-facing applications face challenges in secure access control, particularly when an application executing on a child frame, hosted on a different domain than the parent frame, is unable to request tokens from an identity provider due to third-party cookie restrictions, hindering secure delegated access to resources.
Innovation Solution
A token broker is implemented on a descendant frame, which communicates with both the top-level frame and the identity provider to obtain authentication and request tokens on behalf of the application, enabling secure delegated access while maintaining security and isolation by being hosted on a separate domain.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If an application executes on a child frame hosted on a different domain than the parent frame, then domain isolation and security are maintained, but the application cannot request tokens from the identity provider due to third-party cookie restrictions
Solution Approach 1:
The patent introduces a token broker as an intermediary component that runs on a descendant frame of the top-level frame. The broker mediates between the embedded application (on a different domain) and the identity provider, enabling the application to obtain tokens indirectly through the broker without violating third-party cookie restrictions. The broker receives token requests from the application, communicates with the identity provider on behalf of the application, and returns the obtained tokens to the application.
2Reliability
If third-party cookies are disallowed to maintain security, then security is improved, but embedded applications lose the ability to access resources through secure delegated access
Solution Approach 1:
The token broker serves as a mediator that enables secure delegated access without relying on third-party cookies. It establishes authentication relationships with the identity provider and manages token distribution to embedded applications, thereby maintaining security while restoring resource access capability.
Solution Approach 2:
The system segments the authentication and token management functions into a separate broker component that runs on a descendant frame. This segmentation allows the broker to maintain authentication states and manage tokens independently, enabling embedded applications to access resources through the broker's authenticated sessions rather than through direct third-party cookie-based authentication.
3Ease of operation
If a token broker is introduced to enable token requests from embedded applications, then token request capability is restored, but system complexity increases
Solution Approach 1:
The token broker is designed as a universal component that can serve multiple embedded applications within the same top-level frame context. It maintains authentication states for multiple applications and handles token requests from any embedded application, thereby distributing the complexity across a single multi-functional component rather than requiring separate authentication mechanisms for each application.
Data Source
AI summary
The disclosed technology is generally directed to web authentication. In one example of the technology, authentication of a broker is obtained with an identity provider. Obtaining the authentication includes at least communication between the broker and a top-level frame and communication between the broker and the identity provider. The broker is executing in a descendant frame of the top-level frame. The top-level frame and the broker are hosted on different domains. At the broker, from an embedded application that is executing on another descendant frame of the top-level frame, a token request is received. Via the broker, a token is requested from the identity provider. The token is associated with an authorization of secure delegated remote access of at least one resource by the embedded application. At the broker, from the identity provider, the token is received. Via the broker, the token is provided to the embedded application.