Access control list checking
View Patent ↗Method for dynamically checking an access control list during the data transfers between a client web browser and a web server. The method allows checking of access control list by an application firewall, independent from the web application. The rules, upon which the checking is based, can be easily updated without affecting the web application.
1. A method of checking an access control list for a web application comprising the steps of:
a) receiving a request from a web client;
b) parsing the request to an application firewall; said application firewall having a rule and residing independently of the web application, said rule having syntax to identify a parameter in the request;
c) checking the received request based on said rule;
d) allowing the received request passing through the application firewall upon matching the rules; and
e) checking the access control list with an authentication provider.
2. The method as claimed in claim 1 , wherein the access control list is provided by an independent authentication provider.
3. The method as claimed in claim 1 , wherein the authentication provider is a remote software module.
4. The method as claimed in claim 1 , wherein the authentication provider is a remote system.
5. The method as claimed in claim 1 , wherein the application firewall is operatively responsible for a plurality of web applications.
6. The method as claimed in claim 1 , wherein the syntax is selected from a group consisting of name, operand type; context, method, content, and combination thereof.
7. The method as claimed in claim 6 , wherein the method is selected from a group consisting of GET or POST.
8. The method as claimed in claim 6 , wherein the content is selected from a group consisting of HTTP encoded form variables, and XML content.
9. The method as claimed in claim 6 , wherein the context is dependent of the web application.
10. The method as claimed in claim 1 , wherein the access control list is checked for a user's permission to access an object within a system.
11. The method as claimed in claim 1 , wherein the access control list is checked for a user's capability to access a service provided by a system.