Selectively processing cookies in a proxy

• US 8,650,249 B2
• Filed: 10/13/2010
• Issued: 02/11/2014
• Est. Priority Date: 10/13/2010
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Canning, Simon Gilbert, Exton, Scott Anthony, Readshaw, Neil Ian
• Primary Examiner(s): SALAD, ABDULLAHI ELMI
• Application Number:
  US12/903,537
• Publication Number:
  US 20120096068A1
• Time in Patent Office: 1,217 Days
• Field of Search: 709 22-225, 709227-228, 726/12
• US Class Current: 709/203
• CPC Class Codes: H04L 65/1066 Session management
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/564 Enhancement of application control based on intercepted application data

Abstract

An intermediary (such as a web reverse proxy), which is located between a web browser and one or more backend applications, manages cookies that are provided by the backend applications and returned to the web browser during a user session. The intermediary decides which cookies should be sent to the browser and which cookies should be stored therein. Preferably, this determination is made in an automated manner by examining the response for any cookie-dependent code (e.g., scripting) included in the response.

Claims

1. Apparatus positioned between a client browser and one or more backend applications, comprising:

a processor;

computer memory holding computer program instructions that when executed by the processor perform a method during an existing authenticated session with a user operating the client browser, the method comprising;

responsive to forwarding a request to a backend application, receiving a response;

making a determination whether the response is associated with a cookie that should be returned to the client browser by examining the response for presence of code whose execution in the client browser requires a cookie, wherein if the response includes code whose execution in the client browser requires a cookie, marking the response as associated with a cookie that should be returned to the client browser;

if the response is associated with a cookie that should be returned to the client browser, tracking the cookie in a per-user session cache object associated with the session; and

forwarding the response including the cookie to the client browser.

2. Apparatus as described in claim 1 wherein the method further includes:

if the response is associated with a cookie that need not be returned to the client browser, tracking the cookie in the per-user session cache object associated with the session; and

caching the cookie for re-use by the intermediary on a subsequent request to a backend application on behalf of the client browser.

3. The apparatus as described in claim 1 wherein the code whose execution in the client browser requires a cookie is a script.

4. The apparatus as described in claim 1 wherein the response from the backend application is an HTTP response.

5. The apparatus as described in claim 1 wherein the step of tracking the cookie in the per-user session cache object stores a name of the cookie and its value.

6. The apparatus as described in claim 1 wherein the method further includes the step of making a determination whether the response includes the cookie if the response is associated with a cookie that should be returned to the client browser.

7. The apparatus as described in claim 2 wherein the method further includes making a determination whether the cookie is stored in the per-user session cache object if the response does not include the cookie.

8. A computer program product in a non-transitory computer readable medium for use in a data processing system positioned between a client browser and one or more backend applications, the computer program product holding computer program instructions which, when executed by the data processing system, perform a method during an existing authenticated session with a user operating the client browser, the method comprising:

responsive to forwarding a request to a backend application, receiving a response;

making a determination whether the response is associated with a cookie that should be returned to the client browser by examining the response for presence of code whose execution in the client browser requires a cookie, wherein if the response includes code whose execution in the client browser requires a cookie, marking the response as associated with a cookie that should be returned to the client browser;

if the response is associated with a cookie that should be returned to the client browser, tracking the cookie in a per-user session cache object associated with the session; and

forwarding the response including the cookie to the client browser.

9. The computer program product as described in claim 8 wherein the method further includes:

if the response is associated with a cookie that need not be returned to the client browser, tracking the cookie in the per-user session cache object associated with the session; and

caching the cookie for re-use by the intermediary on a subsequent request to a backend application on behalf of the client browser.

10. The computer program product as described in claim 8 wherein the code whose execution in the client browser requires a cookie is a script.

11. The computer program product as described in claim 8 wherein the response from the backend application is an HTTP response.

12. The computer program product as described in claim 8 wherein the step of tracking the cookie in the per-user session cache object stores a name of the cookie and its value.

13. The apparatus as described in claim 8 wherein the method further includes the step of making a determination whether the response includes the cookie if the response is associated with a cookie that should be returned to the client browser.

14. The apparatus as described in claim 13 wherein the method further includes making a determination whether the cookie is stored in the per-user session cache object if the response does not include the cookie.

15. A web proxy operating as an intermediary between a client browser and a backend application during an existing authenticated session with a user operating the client browser, comprising:

a processor;

computer memory holding computer program instructions that when executed by the processor automatically examines each HTTP response received from a backend application during the authenticated session, parses the HTTP response to identify cookie-dependent client-side scripting code whose execution in the client browser requires a cookie, marks the HTTP response as associated with a cookie that should be returned to the client browser if the HTTP response includes the cookie-dependent client-side scripting code, tracks in a per user-session cache object the cookie associated with the cookie-dependent client-side code, and forwards the HTTP response, together with the cookie, to the client browser.