INTER-FRAME MESSAGING BETWEEN DIFFERENT DOMAINS

• US 20090328063A1
• Filed: 06/27/2008
• Published: 12/31/2009
• Est. Priority Date: 06/27/2008
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Moore, George, Corvera, Gabriel, Thorpe, Daniel, Kato, Koji
• Granted Patent: US 8,209,706 B2
• Time in Patent Office: Days
• US Class Current: 719/315
• CPC Class Codes: G06F 9/54 Interprogram communication

Abstract

Cross-domain communication between a parent web page hosted in a parent domain and a child web page hosted in a different child domain is provided. Upon downloading the parent page and child page into a client'"'"'s web browser, an IFM-channel connection can be established within the browser between the parent page and child page, which can be used to bidirectionally communicate text-based messages containing commands and HTML content directly between the parent page and child page. Additionally, an XML-channel connection can be established within the browser between the parent page and child page, which can be used to bidirectionally communicate text-based messages containing HTTP commands and XML content directly between the parent page and child page. This cross-domain communication of messages takes place completely within the browser.

Claims

1. In a system comprising a parent web page which is hosted in a parent domain, a child web page which is hosted in a different child domain, and a client computing device comprising a web browser, wherein the parent web page embeds hypertext markup language (HTML) content from the child web page, a computer-implemented process for cross-domain communication between the parent web page and the child web page, comprising process actions of:

upon downloading the parent web page into the browser, constructing an IFM-frame object within the parent web page, wherein the IFM-frame object comprises a parent instantiation of a channel-control object;

upon downloading the child web page into the browser, constructing an IFM-channel object within the browser, wherein the IFM-channel object comprises a child instantiation of the channel-control object;

establishing an IFM-channel connection between the parent instantiation of the channel-control object and the child instantiation of the channel-control object; and

using the established IFM-channel connection to bidirectionally communicate text-based messages directly between the parent web page and the child web page, wherein said messages comprise commands and HTML content, and the cross-domain communication takes place completely within the web browser.

2. The process of claim 1, wherein the process action of constructing an IFM-frame object within the parent web page comprises actions of:

constructing an iframe which hosts the child web page;

making the iframe a child of the IFM-frame object;

setting the width and height of the iframe equal to the width and height of the IFM-frame object; and

generating an ID for the IFM-channel connection between the parent web page and the child web page which is unique within the parent domain.

3. The process of claim 1, wherein the child instantiation of the channel control object comprises an allowed-domains parameter which specifies parent domains that are sanctioned by the child web page.

4. The process of claim 3, wherein the allowed-domains parameter specifies a select set of parent domains.

5. The process of claim 3, wherein the allowed-domains parameter specifies that no parent domains are sanctioned.

6. The process of claim 3, wherein the allowed-domains parameter specifies that all possible parent domains are sanctioned.

7. The process of claim 3, wherein the process action of establishing an IFM-channel connection between the parent instantiation of the channel-control object and the child instantiation of the channel-control object comprises actions of:

using the parent instantiation of the channel-control object to send a request message to the child instantiation of the channel-control object requesting to establish the IFM-channel connection there-between; and

using the child instantiation of the channel-control object to,

receive the request message,

compare the parent domain that the request message originated from against the allowed-domains parameter,

whenever the allowed-domains parameter specifies that the request message originated from a sanctioned parent domain, accept the request and establish the IFM-channel connection to the parent instantiation of the channel-control object that sent the request message, and

whenever the allowed-domains parameter specifies that the request message originated from an unsanctioned parent domain, reject the request and prevent the IFM-channel connection from being established to the parent instantiation of the channel-control object that sent the request message.

8. The process of claim 7, wherein the process action of establishing an IFM-channel connection between the parent instantiation of the channel-control object and the child instantiation of the channel-control object further comprises an action of using the established IFM-channel connection to exchange a unique pair of cryptographically strong random numbers between the parent web page and the child web page, wherein said pair of numbers are employed as IFM-session keys to enhance the security of the IFM-channel connection.

9. The process of claim 8, wherein a central random number generating web service is employed to supply the random numbers to the parent web page and the child web page.

10. The process of claim 1, wherein the channel-control object comprises an Adobe Flash LocalConnection object.

11. The process of claim 1, wherein the IFM-frame object and IFM-channel object comprise a transport-speed parameter which specifies the throughput of the established IFM-channel connection, and whenever a slow throughput is specified by the transport-speed parameter, the process action of using the established IFM-channel connection to bidirectionally communicate text-based messages directly between the parent web page and the child web page comprises actions of:

whenever a text-based message which is larger than a prescribed size is to be transmitted across the established IFM-channel connection, using the channel-control object to chunk said message into a series of smaller messages before they are transmitted; and

whenever a chunked series of smaller messages is received from the established IFM-channel connection, using the channel-control object to reassemble the chunked series of smaller messages.

12. The process of claim 2, wherein the process action of using the established IFM-channel connection to bidirectionally communicate text-based messages directly between the parent web page and the child web page comprises an action of using the child instantiation of the channel-control object to download HTML content from the child web page over the established IFM-channel connection to the parent instantiation of the channel-control object for rendering and display in the iframe.

13. The process of claim 1, wherein the IFM-frame object and IFM-channel object are constructed using either a declarative markup style or a functional object constructor.

14. The process of claim 1, wherein the IFM-frame object, IFM-channel object and channel-control object are constructed using a single script file.

15. In a system comprising a parent web page which is hosted on a website server residing in a parent domain, a child web page which is hosted on another website server residing in a different child domain, and a client computing device comprising a web browser, wherein the parent web page embeds extensible markup language (XML) content from the child web page, a computer-implemented process for cross-domain communication between the parent web page and the child web page, comprising process actions of:

upon downloading the parent web page into the browser, constructing an IFM-frame object within the parent web page, wherein the IFM-frame object comprises an IFM-XMLHTTP-request object;

upon downloading the child web page into the browser, constructing an IFM-channel object within the browser, wherein the IFM-channel object comprises an IFM-XMLHTTP-proxy object; and

using an XML-channel connection between the IFM-XMLHTTP-request object and the IFM-XMLHTTP-proxy object to bidirectionally communicate text-based messages directly between the parent web page and the child web page, wherein said messages comprise hypertext transfer protocol (HTTP) commands and XML content, and the cross-domain communication takes place completely within the web browser.

16. The process of claim 15, wherein the process action of constructing an IFM-frame object within the parent web page comprises actions of:

constructing an iframe which hosts the child web page;

making the iframe a child of the IFM-frame object; and

setting the width and height of the iframe equal to the width and height of the IFM-frame object.

17. The process of claim 16, wherein the IFM-XMLHTTP-proxy object comprises an allowed-domains parameter which specifies parent domains that are sanctioned by the child web page.

18. The process of claim 17, wherein the process action of using an XML-channel connection between the IFM-XMLHTTP-request object and the IFM-XMLHTTP-proxy object to bidirectionally communicate text-based messages directly between the parent web page and the child web page comprises actions of:

using the IFM-XMLHTTP-request object to send an IFM-XMLHTTP-request message to the IFM-XMLHTTP-proxy object, wherein the request message requests XML content from the child web page; and

using the IFM-XMLHTTP-proxy object to,

receive the request message,

compare the parent domain that the request message originated from against the allowed-domains parameter,

whenever the allowed-domains parameter specifies that the request message originated from an unsanctioned parent domain, block the request message to prevent the parent web page from accessing the child web page, and

whenever the allowed-domains parameter specifies that the request message originated from a sanctioned parent domain,

pass the request message to the website server which hosts the child web page, and

receive a response message from said website server comprising the requested XML content from the child web page and pass said received XML content to the web browser for rendering and display in the iframe.

19. The process of claim 18, wherein the IFM-XMLHTTP-request message comprises:

a content-type HTTP header which specifies a content-type associated with said message, wherein said content-type comprises either plain format XML content or Atom format XML content;

an authentication HTTP header comprising a declaration token which is used to authenticate the request message;

an HTTP verb;

a uniform resource locator path; and

a text-based message body comprising XML content to be sent to the particular child web page.

20. In a system comprising a parent web page which is hosted in a parent domain, a child web page which is hosted in a different child domain, and a client computing device comprising a web browser, wherein the parent web page embeds HTML content from the child web page, a computer-implemented process for cross-domain communication between the parent web page and the child web page, comprising process actions of:

upon downloading the parent web page into the browser,

constructing an IFM-frame object within the parent web page, wherein the IFM-frame object comprises a parent instantiation of an Adobe Flash LocalConnection object,

constructing an iframe which hosts the child web page,

making the iframe a child of the IFM-frame object,

setting the width and height of the iframe equal to the width and height of the IFM-frame object, and

generating an ID for an IFM-channel connection between the parent web page and the child web page which is unique within the parent domain;

upon downloading the child web page into the browser, constructing an IFM-channel object within the browser, wherein the IFM-channel object comprises a child instantiation of the LocalConnection object, said instantiation comprising an allowed-domains parameter which specifies parent domains that are sanctioned by the child web page;

using the parent instantiation of the LocalConnection object to send a request message to the child instantiation of the LocalConnection object requesting to establish the IFM-channel connection there-between;

using the child instantiation of the LocalConnection object to,

receive the request message and compare the parent domain that the request message originated from against the allowed-domains parameter,

whenever the allowed-domains parameter specifies that the request message originated from a sanctioned parent domain, accept the request and establish the IFM-channel connection to the parent instantiation of the LocalConnection object that sent the request message, and

whenever the allowed-domains parameter specifies that the request message originated from an unsanctioned parent domain, reject the request and prevent the IFM-channel connection from being established to the parent instantiation of the LocalConnection object that sent the request message; and

using the established IFM-channel connection to bidirectionally communicate text-based messages directly between the parent web page and the child web page, wherein,

said messages comprise commands, HTML content, and a unique pair of cryptographically strong random numbers which are exchanged between the parent web page and the child web page, wherein said pair of numbers are employed as IFM-session keys to enhance the security of the IFM-channel connection, and

the cross-domain communication takes place completely within the web browser.