Secure transfer of web application client persistent state information into a new domain

• US 9,699,177 B2
• Filed: 11/07/2016
• Issued: 07/04/2017
• Est. Priority Date: 07/08/2014
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Pajecki, Mariusz, Pogorzelska-Pieczul, Izabela, Pieczul, Olgierd S., Banatwala, Mustansir
• Primary Examiner(s): AVERY, JEREMIAH L
• Application Number:
  US15/344,627
• Publication Number:
  US 20170054705A1
• Time in Patent Office: 239 Days
• Field of Search: None
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/146 Markers for unambiguous identification of a particular session, e.g. session cookie or URL-encoding
• CPC Class Codes: H04L 67/563 Data redirection of data network streams

Abstract

A technique to reassign one or more stored elements of web application client state information is provided in an HTTP-based client upon receipt of an HTTP redirect in response to a request-URI. One or more stored elements associated to the request-URI are saved in or in association with the client. Upon receipt of an HTTP 301 (permanent) redirect, the client automatically reassigns (re-associates) the one or more stored elements to the redirect domain when the redirect can be verified as authentic (e.g., to originate from the application to which the client is attempting to connect).

Claims

1. A method, comprising:

storing, by a browser run on a client computer, a first Uniform Resource Locator (URL) that identifies a first application server domain;

connecting, by the browser, in data communication to a first application server domain using the first URL;

receiving, by the browser, a redirect command that identifies a second application server domain as a redirect target;

determining whether the redirect command can be verified as authentic; and

securely transferring, by the client browser, persistent state information associated with the client computer from the first application server domain to the second application server domain.

2. The method of claim 1, wherein the secure transfer of persistent state information includes associating a stored password and a cookie for the first application server domain to the second application server domain by the client browser.

3. The method of claim 2, further comprising:

prior to associating the stored password and the cookie to the second application server domain, presenting, by the browser, a user prompt inquiring whether the stored password and cookie should be associated with the second application server domain.

4. The method of claim 1, further comprising:

determining whether the second application server domain is trusted.

5. The method as described in claim 1 wherein the persistent state information is one of:

user identifying information, one or more form elements associated with a page located at the first application server domain, and a cookie generated by the first application server domain.

6. The method as described in claim 1 wherein the redirect command is an HTTP permanent redirect.

7. The method as described in claim 1 wherein the secure transfer is a Secure Sockets Layer (SSL) communication link.