Method and system for secure server-based session management using single-use HTTP cookies
View Patent ↗A methodology for providing secure session management is presented. After a single-use token has been issued to a client, it presents the token, and the server may identify the client based upon the presented token. However, the token may be used only once without being refreshed prior to re-use, thereby causing the token to be essentially reissued upon each use. The token comprises a session identifier that allows the issuer of the token to perform session management with respect to the receiving entity. Tokens can be classified into two types: domain tokens and service tokens. Domain tokens represent a client identity to a secure domain, and service tokens represent a client identity to a specific service. A domain token may be used with any service within a domain that recognizes the domain token, but a service token is specific to the service from which it was obtained.
1. A method for controlling access to protected resources within a distributed data processing system, the method comprising:
receiving at a first server from a client a request to access a protected resource and a single-use token associated with the client or a user of the client;
validating the single-use token, wherein the single-use token comprises session information for performing session management with respect to the client;
determining that the single-use token is a domain token;
generating a client authorization credential request;
sending to a second server the client authorization credential request, the single-use domain token associated with the client or the use of the client, and a single-use domain token associated with the first server, wherein the first server and the second server are operated within a common domain;
generating a response to the request;
refreshing the single-use token;
validating at the second server the single-use domain token associated with the client or the user of the client and the single-use domain token associated with the first server;
generating the client authorization credential; refreshing at the second server the single-use domain token associated with the client or the user of the client and the single-use domain token associated with the first server; and
sending to the first server the client authorization credential, the refreshed single-use domain token associated with the client or the user of the client, and the refreshed single-use domain token associated with the first server; and
sending the response and the refreshed single-use token to the client.
2. The method of claim 1 further comprising:
receiving the single-use service token, wherein the single-use service token is issued by the first server; and
refreshing the single-use service token at the first server.
3. The method of claim 1 wherein the session information in the single-use token is a session key.
4. The method of claim 1 further comprising:
storing the client authorization credential at the first server;
generating a single-use service token associated with the client or the user of the client; and
sending to the client the single-use service token along with the response and the single-use domain token.
5. The method of claim 1 further comprising:
receiving a login request from the client at the second server;
challenging the client to provide authentication data; receiving authentication data from the client;
authenticating the client;
generating a single-use domain token associated with the client or the user of the client;
generating an authentication response; and
sending the authentication response and the single-use domain token to the client.
6. The method of claim 5 further comprising:
determining that the login request is a redirected request from the first server; and
modifying the authentication response to redirect the client to the first server.
7. An apparatus for controlling access to protected resources within a distributed data processing system, the apparatus comprising:
processing logic receiving at a first server from a client a request to access a protected resource and a single-use token associated with the client or a user of the client;
processing logic validating the single-use token, wherein the single-use token comprises session information for performing session management with respect to the client;
processing logic determining that the single-use token is a domain token;
processing logic generating a client authorization credential request;
processing logic sending to a second server the client authorization credential request, the single-use domain token associated with the client or the user of the client, and a single-use domain token associated with the first server, wherein the first server and the second server are operated within a common domain;
processing logic generating a response to the request;
processing logic refreshing the single-use token;
validating at the second server the single-use domain token associated with the client or the user of the client and the single-use domain token associated with the first server;
generating the client authorization credential;
means for refreshing at the second server the single-use domain token associated with the client or the user of the client and the single-use domain token associated with the first server; and
sending to the first server the client authorization credential, the refreshed single-use domain token associated with the client or the user of the client, and the refreshed single-use domain token associated with the first server; and
processing logic sending the response and the refreshed single-use token to the client.
8. The apparatus of claim 7 further comprising:
processing logic receiving a single-use service token, wherein the single-use service token is issued by the first server; and
processing logic refreshing the single-use service token at the first server.
9. The apparatus of claim 7 wherein the session information in the single-use token is a session key.
10. The apparatus of claim 7 further comprising:
processing logic storing the client authorization credential at the first server;
processing logic generating a single-use service token associated with the client or the user of the client; and
processing logic sending to the client the single-use service token along with the response and the single-use domain token.
11. The apparatus of claim 7 further comprising:
processing logic receiving a login request from the client at the second server;
processing logic challenging the client to provide authentication data; means for receiving authentication data from the client;
processing logic authenticating the client;
processing logic generating a single-use domain token associated with the client or the user of the client;
processing logic generating an authentication response; and
processing logic sending the authentication response and the single-use domain token to the client.
12. The apparatus of claim 11 further comprising:
processing logic determining that the login request is a redirected request from the first server; and
processing logic modifying the authentication response to redirect the client to the first server.
13. A computer program product on a non-transitory computer readable medium for controlling access to protected resources within a distributed data processing system, the computer program product comprising executable instructions configured for:
receiving at a first server from a client a request to access a protected resource and a single-use token associated with the client or a user of the client;
validating the single-use token, wherein the single-use token comprises session information for performing session management with respect to the client;
determining that the single-use token is a domain token;
sending to a second server the client authorization credential request, the single-use domain token associated with the client or the user of the client, and a single-use domain token associated with the first server, wherein the first server and the second server are operated within a common domain;
generating a response to the request;
refreshing the single-use token;
validating at the second server the single-use domain token associated with the client or the user of the client and the single-use domain token associated with the first server;
generating the client authorization credential;
refreshing at the second server the single-use domain token associated with the client or the user of the client and the single-use domain token associated with the first server; and
sending to the first server the client authorization credential, the refreshed single-use domain token associated with the client or the user of the client, and the refreshed single-use domain token associated with the first server; and
sending the response and the refreshed single-use token to the client.
14. The computer program product of claim 13 , said instructions further configured for:
receiving a single-use service token is a service token, wherein the single-use service token is issued by the first server; and
refreshing the single-use service token at the first server.
15. The computer program product of claim 13 wherein the session information in the single-use token is a session key.
16. The computer program product of claim 13 , said instructions further configured for:
storing the client authorization credential at the first server;
generating a single-use service token associated with the client or the user of the client; and
sending to the client the single-use service token along with the response and the single-use domain token.
17. The computer program product of claim 13 , said instructions further configured for:
receiving a login request from the client at the second server;
challenging the client to provide authentication data;
receiving authentication data from the client;
authenticating the client;
generating a single-use domain token associated with the client or the user of the client;
generating an authentication response; and
sending the authentication response and the single-use domain token to the client.
18. The computer program product of claim 17 , said instructions further configured for:
determining that the login request is a redirected request from the first server; and
modifying the authentication response to redirect the client to the first server.