Validated API Object for Cross-Origin Iframe Communication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current communication models between iframes and their hosts, as well as between iframes, do not allow for the passing of executable functions, limiting secure and cross-origin communication in web applications like SharePoint, which requires a mechanism to invoke APIs across boundaries securely.
Innovation Solution
Establishing a secure communication channel between iframes by using a validated Application Programming Interface (API) object that is forwarded from one iframe to another, allowing the host web page to validate and translate API requests, enabling secure and declarative communication without relying on global variables.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the postMessage API is used for communication between iframe and host, then structured objects can be passed, but executable code cannot be communicated
Solution Approach 1:
The patent introduces an intermediary mechanism that serializes executable functions into string representations, which can then be safely transmitted through the postMessage API. This mediator converts between executable code and transmittable data formats, enabling function communication while maintaining security boundaries.
Solution Approach 2:
The patent changes the parameter representation of functions from executable code to serialized string format. By transforming functions into JSON-serializable objects with metadata (function name, parameters, return type), the system enables transmission while preserving the ability to reconstruct and execute functions on the receiving end.
2Reliability
If iframes are isolated from the host web page, then security is enforced, but communication between iframe and host is prohibited
Solution Approach 1:
The patent implements a mediator layer that sits between the isolated iframe and host web page. This mediator uses the postMessage API to establish controlled communication channels, allowing data exchange while maintaining the security isolation boundaries. The mediator validates and serializes all communications, enabling interaction without compromising security.
3Adaptability or versatility
If executable functions are passed between iframes, then communication versatility is improved, but security validation becomes more complex
Solution Approach 1:
The patent transforms executable functions into standardized parameter objects with explicit metadata (function identifier, parameter schemas, return type expectations). This parameter transformation enables systematic validation through JSON schema verification, reducing validation complexity compared to analyzing arbitrary executable code.
Solution Approach 2:
The patent creates serialized copies of function definitions that can be validated and transmitted safely. Instead of passing direct function references, the system copies function metadata into transferable objects, which can be validated against known schemas before execution, simplifying the validation process.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A secured method for isolated parts of a web application to invoke APIs across boundaries is described. A host web page receives a first object from a first inline frame of the host web page. The first object identifies a first Application Programming Interface (API). The host web page validates the first object against a predefined APIs for the host web page. Once the first object is validated, the host web page forwards the first object to a second inline frame of the host web page. The second inline frame parses the first object and translate the parsed first object to a second API corresponding to the second inline frame.