Selectively processing cookies in a proxy
View Patent ↗An intermediary (such as a web reverse proxy), which is located between a web browser and one or more backend applications, manages cookies that are provided by the backend applications and returned to the web browser during a user session. The intermediary decides which cookies should be sent to the browser and which cookies should be stored therein. Preferably, this determination is made in an automated manner by examining the response for any cookie-dependent code (e.g., scripting) included in the response.
1. A method, operative at an intermediary between a client browser and one or more backend applications during an existing authenticated session with a user operating the client browser, the method comprising:
responsive to forwarding a request to a backend application, receiving a response;
making a determination whether the response is associated with a cookie that should be returned to the client browser by examining the response for presence of code whose execution in the client browser requires a cookie, wherein if the response includes code whose execution in the client browser requires a cookie, marking the response as associated with a cookie that should be returned to the client browser;
if the response is associated with a cookie that should be returned to the client browser, tracking the cookie in a per-user session cache object associated with the session; and
forwarding the response including the cookie to the client browser;
wherein at least one of the receiving, making, tracking and forwarding steps is carried out in software executing in a hardware element.
2. The method as described in claim 1 wherein if the response is associated with a cookie that need not be returned to the client browser:
tracking the cookie in the per-user session cache object associated with the session; and
caching the cookie for re-use by the intermediary on a subsequent request to a backend application on behalf of the client browser.
3. The method as described in claim 1 wherein the code whose execution in the client browser requires a cookie is a script.
4. The method as described in claim 1 wherein the intermediary is a web reverse proxy and the response from the backend application is an HTTP response.
5. The method as described in claim 1 wherein tracking the cookie in the per-user session cache object stores a name of the cookie and its value.
6. The method as described in claim 1 wherein, if the response is associated with a cookie that should be returned to the client browser, the method further includes making a determination whether the response includes the cookie.
7. The method as described in claim 6 wherein, if the response does not include the cookie, making a determination whether the cookie is stored in the per-user session cache object.