Web App Cross-Origin Data Access Control via Trust Relations
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing Cross-Origin Resource Sharing (CORS) mechanism allows unauthorized access to user data when multiple web applications share a content server, leading to potential security risks as malicious applications can access data without user authorization.
Innovation Solution
Implementing a method and arrangement in a server node to determine the Origins of requesting and owning web applications, allowing or denying access based on established trust relations and user permissions, with user prompts for authorization when necessary, to securely manage and share user-related information across different Origins.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If CORS mechanism is implemented to enable cross-Origin requests, then web applications can access data from multiple Origins, but unauthorized access to user data occurs when malicious applications share the same content server
Solution Approach 1:
The patent introduces an intermediary authentication mechanism between the client and content server. When a user logs in via a first web application, the system establishes a trusted relationship and issues an authentication token. The content server verifies this token to determine whether the user is authorized to access data from a second web application, thus mediating access control between different Origins
Solution Approach 2:
The patent implements origin-specific access control policies where the content server evaluates each cross-Origin request individually based on the requesting application's origin, the user's authentication status, and pre-established trust relationships between specific origins. This allows selective permission granting rather than blanket access
2Reliability
If Same Origin policy is applied to prevent malicious access, then data security is improved, but web applications cannot collect and use data from multiple Origins
Solution Approach 1:
The patent implements dynamic access control where permission decisions are made at runtime based on the user's authentication state and the trusted relationship between origins. The content server dynamically evaluates each request from a different origin by checking whether the user has been authenticated via a trusted first application, allowing flexible permission management
3Device complexity
If multiple web applications share a content server for data storage, then system complexity is reduced, but unauthorized applications can access user data without user authorization
Solution Approach 1:
The patent implements a feedback mechanism where the content server continuously monitors and evaluates each incoming request by checking the user's authentication token against pre-established trusted origin relationships. This feedback loop ensures that only requests from authorized origins with valid user authentication are permitted, preventing unauthorized access while maintaining shared infrastructure
Data Source
AI summary
Methods and arrangements in a client node and a server node for supporting secure handling of information related to a user, said information being stored by the server node and comprising certain data. The user is assumed to be authenticated towards the server node and to employ a first and a second web application in a web browser supporting cross-Origin resource sharing. The methods and arrangements involve determining whether the first web application is permitted to access the certain data owned by the second web application, and allowing or denying the first web application to access the certain data, based on whether the first web application is permitted to access the data. The methods and arrangements further involve providing user input related to a permission for accessing the certain data, to the server node, and establishing and declaring a mutual trust relation between the first and the second web application.