Web service request verification

• US 10,042,945 B2
• Filed: 09/05/2014
• Issued: 08/07/2018
• Est. Priority Date: 10/10/2013
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Kaplan, Philippe, Moll, Georges-Henri, Nodet, Xavier, Oudot, Olivier
• Primary Examiner(s): Baderman, Scott
• Assistant Examiner(s): Smith, Benjamin J
• Application Number:
  US14/478,178
• Publication Number:
  US 20150106688A1
• Time in Patent Office: 1,432 Days
• CPC Class Codes: G06F 16/958 Organisation or management of web site content, e.g. publishing, maintaining pages or automatic linking
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/146 Markers for unambiguous identification of a particular session, e.g. session cookie or URL-encoding

Abstract

A method and Web server for verifying a Web service request originating from a Web page is provided. The method includes matching the Web service request with a Web service. A sequence ID contained in the request is identified. The Web service request is verified if the identified sequence ID does not correspond with a previous sequence ID for the matched Web service. Additionally, the Web service does not verify a same Web service request twice.

Claims

1. A Web server comprising a computer processor coupled to a computer-readable memory unit comprising a sequence ID software engine, a matcher component, an identifier component, and a verifier component, said memory unit comprising instructions that when executed by the computer processor implements a method for verifying a Web service request originating from a Web form, said method comprising:

matching, by said computer processor executing said matcher component, the Web service request with a Web service;

storing, by said processor, a sequence ID as session data in a sequence ID register internal to said sequence ID software engine;

adding, by said processor, said sequence ID to a URL;

building, by said processor, Webpage content comprising said URL and associated with said Web form;

identifying, by said computer processor executing said identifier component, said sequence ID contained in the request;

loading, by said computer processor, said identified sequence ID into a sequence ID test register within said sequence ID software engine;

verifying, by said computer processor executing said verifier component, the Web service request if the identified sequence ID does not correspond with an already received sequence ID for the matched Web service, wherein the Web service does not verify a same Web service request twice, and wherein said verifying comprises;

performing a look up process via usage of a plurality of session registers, internal to said sequence ID software engine, for locating associated sequence registers associated with said identified sequence ID;

comparing, by a comparator internal to said sequence ID software engine, the already received sequence ID within an associated sequence register of said associated sequence registers with the identified sequence ID within the sequence ID test register;

removing parameters from a SUBMIT command;

transmitting a confirmation page comprising a success code;

refreshing an original Web page displaying an order form; and

displaying a new order form;

removing, by said processor based on results of said verifying, elements of said sequence ID from said URL;

generating, by said processor, in response to results of said removing, a new sequence ID;

generating, by said processor, a response Web page associated with said URL with said elements removed during said removing, wherein said response Web page differs from an original Web page associated with said sequence ID;

reloading, by said processor, said response Webpage via transmission of an HTTP signal to a server;

forwarding, by said processor to a client server, an HTTP message associated with said response Web page; and

embedding, by said computer processor executing a code generator, one or more restricted user controls in a Web page associated with a sequence ID generator internal to said sequence ID software engine, wherein any Web request received from a restricted user control includes said sequence ID generated by the sequence ID generator, and wherein each sequential request for the Web service is associated with a next sequential ID in a sequence of sequence IDs as embedded respectively in the Web page and the Web service.

2. The Web server of claim 1, further comprising a suppressor component, and wherein said method further comprises:

suppressing, by said computer processor executing said suppressor component, the Web service request, if the Web service request is not verified, by removing critical parameters from the Web service request before the request is passed on to Web service.

3. The Web server of claim 1, wherein the Web service ignores extra parameters in the Web service request if the Web service request has not been verified.

4. The Web server of claim 1, wherein said sequence ID is determined by a sequence ID generator.

5. The Web server of claim 1, wherein the sequence of sequence IDs comprises a simple arithmetical progression.

6. The Web server of claim 1, wherein the sequence ID comprises a generated token.

7. The Web server of claim 1, wherein the sequence ID is associated with a particular user session.

8. A method for verifying a Web service request originating from a Web page, the method comprising:

matching, by a computer processor of a Web server executing a matcher component of the Web server, the Web service request with a Web service, wherein said Web server comprises a sequence ID software engine, said matcher component, an identifier component, and a verifier component;

storing, by said processor, a sequence ID as session data in a sequence ID register internal to said sequence ID software engine;

adding, by said processor, said sequence ID to a URL;

building, by said processor, Webpage content comprising said URL and associated with said Web form;

identifying, by said computer processor executing said identifier component, said sequence ID contained in the request;

loading, by said computer processor, said identified sequence ID into a sequence ID test register within said sequence ID software engine;

verifying, by said computer processor executing said verifier component, the Web service request if the identified sequence ID does not correspond with an already received sequence ID for the matched Web service, wherein the Web service does not verify a same Web service request twice, and wherein said verifying comprises;

performing a look up process via usage of a plurality of session registers, internal to said sequence ID software engine, for locating associated sequence registers associated with said identified sequence ID;

comparing, by a comparator internal to said sequence ID software engine, the already received sequence ID within an associated sequence register of said associated sequence registers with the identified sequence ID within the sequence ID test register;

removing parameters from a SUBMIT command;

transmitting a confirmation page comprising a success code;

refreshing an original Web page displaying an order form; and

displaying a new order form;

removing, by said processor based on results of said verifying, elements of said sequence ID from said URL;

generating, by said processor, in response to results of said removing, a new sequence ID;

generating, by said processor, a response Web page associated with said URL with said elements removed during said removing, wherein said response Web page differs from an original Web page associated with said sequence ID;

reloading, by said processor, said response Webpage via transmission of an HTTP signal to a server;

forwarding, by said processor to a client server, an HTTP message associated with said response Web page; and

embedding, by said computer processor executing a code generator, one or more restricted user controls in a Web page associated with a sequence ID generator internal to said sequence ID software engine, wherein any Web request received from a restricted user control includes said sequence ID generated by the sequence ID generator, and wherein each sequential request for the Web service is associated with a next sequential ID in a sequence of sequence IDs as embedded respectively in the Web page and the Web service.

9. The method of claim 8, further comprising:

suppressing, by said computer processor executing a suppressor component of the Web server, the Web service request, if the Web service request is not verified, by removing critical parameters from the Web service request before the request is passed on to Web service.

10. The method of claim 8, wherein the Web service ignores extra parameters in the Web service request if the Web service request has not been verified.

11. The method of claim 8, wherein said sequence ID is determined by a sequence ID generator.

12. The method of claim 8, wherein the sequence of sequence IDs comprises a simple arithmetical progression.

13. The method of claim 8, wherein the sequence ID comprises a generated token.

14. The method of claim 8, wherein the sequence ID is associated with a particular user session.

15. The method of claim 8, further comprising:

providing at least one support service for at least one of creating, integrating, hosting, maintaining, and deploying computer-readable code in the computing system, said code being executed by the computer processor to implement said matching, said identifying, and said verifying.

16. A computer program product, comprising a non-transitory computer readable hardware storage device storing a computer readable program code, said computer readable program code comprising an algorithm that when executed by a computer processor of a Web server system implements a method, said method comprising:

matching, by the computer processor executing a matcher component of the Web server, the Web service request with a Web service, wherein said Web server comprises a sequence ID software engine, said matcher component, an identifier component, and a verifier component;

storing, by said processor, a sequence ID as session data in a sequence ID register internal to said sequence ID software engine;

adding, by said processor, said sequence ID to a URL;

building, by said processor, Webpage content comprising said URL and associated with said Web form;

identifying, by said computer processor executing said identifier component, said sequence ID contained in the request;

loading, by said computer processor, said identified sequence ID into a sequence ID test register within said sequence ID software engine;

verifying, by said computer processor executing said verifier component, the Web service request if the identified sequence ID does not correspond with an already received sequence ID for the matched Web service, wherein the Web service does not verify a same Web service request twice, and wherein said verifying comprises;

performing a look up process via usage of a plurality of session registers, internal to said sequence ID software engine, for locating associated sequence registers associated with said identified sequence ID;

comparing, by a comparator internal to said sequence ID software engine, the already received sequence ID within an associated sequence register of said associated sequence registers with the identified sequence ID within the sequence ID test register;

removing parameters from a SUBMIT command;

transmitting a confirmation page comprising a success code;

refreshing an original Web page displaying an order form; and

displaying a new order form;

removing, by said processor based on results of said verifying, elements of said sequence ID from said URL;

generating, by said processor, in response to results of said removing, a new sequence ID;

generating, by said processor, a response Web page associated with said URL with said elements removed during said removing, wherein said response Web page differs from an original Web page associated with said sequence ID;

reloading, by said processor, said response Webpage via transmission of an HTTP signal to a server;

forwarding, by said processor to a client server, an HTTP message associated with said response Web page; and

embedding, by said computer processor executing a code generator, one or more restricted user controls in a Web page associated with a sequence ID generator internal to said sequence ID software engine, wherein any Web request received from a restricted user control includes said sequence ID generated by the sequence ID generator, and wherein each sequential request for the Web service is associated with a next sequential ID in a sequence of sequence IDs as embedded respectively in the Web page and the Web service.