WebView Bridge for Secure Authentication via Deep Links
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Mobile devices with WebView applications lack support for popup windows, which hinders user authentication and secure transactions with services like PayPal, as integrated views within these apps are insecure and cannot display the necessary URIs for authentication.
Innovation Solution
A bridge program is introduced to facilitate actions that require popup windows by using a web browser to open URIs outside the WebView application, allowing users to authenticate securely and return data to the WebView application through deep link URIs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If an integrated view of PayPal.com is used within the WebView application, then user authentication can be performed, but security is compromised due to phishing risks
Solution Approach 1:
The patent introduces a bridge program as an intermediary component that mediates between the WebView application and the external web browser. The bridge program receives authentication requests from the WebView, launches a secure web browser to display the PayPal authentication page, and then captures the returned authentication data. This intermediary approach allows the system to use a secure external browser for authentication while maintaining integration with the WebView application, thus resolving the security vs. functionality contradiction.
2Reliability
If a popup window is used for authentication, then security is improved by displaying the URI, but WebView applications do not support popup windows
Solution Approach 1:
The bridge program serves as an intermediary that translates the WebView application's authentication request into a full web browser launch. Instead of attempting to use unsupported popup windows within the WebView, the bridge program opens the authentication URI in the device's default web browser, which fully supports popup windows and secure authentication displays. After authentication, the bridge program captures the returned data and passes it back to the WebView application, thus enabling popup window functionality indirectly.
Solution Approach 2:
Instead of trying to make the WebView application support popup windows directly (the conventional approach), the patent inverts the approach by having the WebView application delegate the popup window functionality to an external web browser through the bridge program. This inversion allows the system to leverage the full capabilities of a native web browser while keeping the WebView application's architecture intact.
3Ease of operation
If an IFRAME is used to integrate PayPal.com, then authentication can be performed, but security is compromised and credentials may be stolen
Solution Approach 1:
The bridge program acts as a secure intermediary that prevents direct integration of the PayPal website into the WebView application. Instead of using an IFRAME that could be exploited for phishing, the bridge program launches the authentication in a separate, secure web browser session. This physical separation ensures that the WebView application cannot intercept or steal credentials, as the authentication occurs in an isolated external environment. The bridge program only receives the final authenticated result, not the credentials themselves.
Data Source
AI summary
In certain computing environments, such as certain applications for mobile devices, popup browser windows may not be supported. This can cause functionality issues, as an existing website may use a popup window to perform a service (such as authentication). Thus, if a user is viewing a webpage within an application (such as a WebView application) that does not support popups, the user may be unable to proceed with a particular action. This issue can be resolved, in various embodiments, by introducing functionality that causes a separate browser program to be opened and then returning the user back to the mobile app via a particular URI (such as a deep link URI). By providing this functionality, mobile apps that rely on underlying web content with popups can thus be made to function in an environment in which they would otherwise fail, in various cases.