Method and system for secure server-based session management using single-use HTTP cookies
View Patent ↗A methodology for providing secure session management is presented. After a single-use token has been issued to a client, it presents the token, and the server may identify the client based upon the presented token. However, the token may be used only once without being refreshed prior to re-use, thereby causing the token to be essentially reissued upon each use. The token comprises a session identifier that allows the issuer of the token to perform session management with respect to the receiving entity. Tokens can be classified into two types: domain tokens and service tokens. Domain tokens represent a client identity to a secure domain, and service tokens represent a client identity to a specific service. A domain token may be used with any service within a domain that recognizes the domain token, but a service token is specific to the service from which it was obtained.
1. A method for controlling access to protected resources within a distributed data processing system, the method comprising:
using a processor configured to perform data processing operations;
receiving at a first server from a client a first single-use domain token associated with said client and a request to access a protected resource;
validating said single-use domain token;
generating a client authorization credential request;
sending to a second server said client authorization credential request, said first single-use domain token, and a second single-use domain token associated with said first server, wherein said first server and said second server are operated within a common domain;
receiving a single-use service token from said second server, said single-use service token associated with said client;
processing said single-use service token to generate a response to said request;
refreshing said single-use service token; and
providing said response and said refreshed single-use service token to said client.
2. The method of claim 1 , wherein said first server:
refreshes said first single-use domain token; and
provides said refreshed first single-use domain token to said client.
3. The method of claim 1 , wherein said first single-use domain token comprises session information for performing session management with respect to said client.
4. The method of claim 3 , wherein said session information comprises a session key.
5. The method of claim 1 , further comprising:
receiving a login request from said client at said second server;
challenging said client to provide authentication data;
receiving said authentication data;
processing said authentication data to authenticate said client;
generating said first single-use domain token;
generating an authentication response; and
providing said authentication response and said first single-use domain token to said client.
6. The method of claim 5 , further comprising:
determining that said login request is a redirected request from said first server; and
modifying said authentication response to redirect said client to said first server.
7. A system comprising:
a processor;
a data bus coupled to the processor; and
a computer-readable medium embodying computer program code, the computer-readable medium being coupled to the data bus, the computer program code maintaining persistent links to information stored on a network and comprising instructions executable by the processor and configured for:
using a processor configured to perform data processing operations;
receiving at a first server from a client a first single-use domain token associated with said client and a request to access a protected resource;
validating said single-use domain token;
generating a client authorization credential request;
sending to a second server said client authorization credential request, said first single-use domain token, and a second single-use domain token associated with said first server, wherein said first server and said second server are operated within a common domain;
receiving a single-use service token from said second server, said single-use service token associated with said client;
processing said single-use service token to generate a response to said request;
refreshing said single-use service token; and
providing said response and said refreshed single-use service token to said client.
8. The system of claim 7 , wherein said first server:
refreshes said first single-use domain token; and
provides said refreshed first single-use domain token to said client.
9. The system of claim 7 , wherein said first single-use domain token comprises session information for performing session management with respect to said client.
10. The system of claim 9 , wherein said session information comprises a session key.
11. The system of claim 7 , further comprising:
receiving a login request from said client at said second server;
challenging said client to provide authentication data;
receiving said authentication data;
processing said authentication data to authenticate said client;
generating said first single-use domain token;
generating an authentication response; and
providing said authentication response and said first single-use domain token to said client.
12. The system of claim 11 , further comprising:
determining that said login request is a redirected request from said first server; and
modifying said authentication response to redirect said client to said first server.
13. A computer program product on a non-transitory computer-readable medium embodying computer program code for controlling access to protected resources within a distributed data processing system, the computer program code comprising computer executable instructions configured for:
using a processor configured to perform data processing operations;
receiving at a first server from a client a first single-use domain token associated with said client and a request to access a protected resource;
validating said single-use domain token;
generating a client authorization credential request;
sending to a second server said client authorization credential request, said first single-use domain token, and a second single-use domain token associated with said first server, wherein said first server and said second server are operated within a common domain;
receiving a single-use service token from said second server, said single-use service token associated with said client;
processing said single-use service token to generate a response to said request;
refreshing said single-use service token; and
providing said response and said refreshed single-use service token to said client.
14. The computer-readable medium of claim 13 , wherein said first server:
refreshes said first single-use domain token; and
provides said refreshed first single-use domain token to said client.
15. The computer-readable medium of claim 13 , wherein said first single-use domain token comprises session information for performing session management with respect to said client.
16. The computer-readable medium of claim 15 , wherein said session information comprises a session key.
17. The computer-readable medium of claim 13 , further comprising:
receiving a login request from said client at said second server;
challenging said client to provide authentication data;
receiving said authentication data;
processing said authentication data to authenticate said client;
generating said first single-use domain token;
generating an authentication response; and
providing said authentication response and said first single-use domain token to said client.
18. The computer-readable medium of claim 17 , further comprising:
determining that said login request is a redirected request from said first server; and
modifying said authentication response to redirect said client to said first server.
19. The computer-readable medium of claim 13 , wherein the computer executable instructions are deployable to a client computer from a server at a remote location.
20. The computer-readable medium of claim 13 , wherein the computer executable instructions are provided by a server on an on-demand basis.