IP Library › Granted Patent US 8,997,180
Granted Patent B2
US 8,997,180 · App. 13/841,663 · Granted Mar 31, 2015

System and method for embedding first party widgets in third-party applications

View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 8,997,180
App. No.
13/841,663
Granted
Mar 31, 2015
Kind
B2
Abstract

Methods and systems provide embeddable user interface widgets to third-party applications so that the widgets can be securely embedded in, and securely used from within, the third-party applications. An embeddable widget may be authorized to access a first-party cloud storage system from a third-party application based on the cloud storage system authenticating a request received from the widget. The authentication may be based on an application identifier, an origin identifier, and/or one or more document identifiers received from the third-party application through the embedded widget. The disclosed methods and systems may significantly mitigate security concerns caused by embedding software in third-party sites, such as clickjacking.

Claims (62)

1. A method for embedding a widget provided by a first-party system in a third-party application, the method comprising:

providing the third-party application with an embeddable first-party widget for embedding in a third-party web page, wherein the third-party web page is controlled by the third-party application;

receiving a message at the embedded first-party widget from the embedding third-party application, wherein the message comprises an application identifier and an origin identifier;

receiving at a first-party server from the embedded first-party widget the application identifier and the origin identifier;

authenticating the application identifier at the first-party server, wherein said authenticating the application identifier comprises determining whether the application identifier references a valid third-party application;

authenticating the origin identifier at the first-party server, wherein said authenticating the origin identifier comprises determining whether the origin identifier is associated with the valid third-party application that is referenced by the authenticated application identifier; and

in response to said authenticating the application identifier and the origin identifier, enabling the first-party widget to access the first-party system from the embedding third-party application.

2. The method of claim 1 , wherein:

the first-party server communicates with a cloud storage system;

the message received at the embedded first-party widget from the embedding third-party application further comprises a document identifier; and

the determining whether the application identifier references the valid third-party application comprises:

determining that the application identifier references a third-party application that was previously installed by a user; and

determining that the application identifier references a third-party application that was previously authorized by the user to access a document referenced by the document identifier, wherein the document is stored on the cloud storage system.

3. The method of claim 1 , wherein the authenticating the application identifier and the origin identifier are performed before rendering visible at least a portion of the first-party widget in the third-party web page, the method further comprising:

in response to the authenticating the application identifier and the origin identifier, rendering visible the at least the portion of the first-party widget.

4. The method of claim 1 , wherein the authenticating the application identifier and the origin identifier are performed after rendering visible a wrapper of the first-party widget in the third-party web page, wherein in response to determining at least one of the application identifier not referencing the valid third-party application and the origin identifier not being associated with the valid third-party application, denying the first-party widget access to the first-party server from the embedding third-party application.

5. The method of claim 1 , further comprising:

including a widget client in the third-party web page;

wrapping the widget client in an application programming interface (API), wherein the API exposes at least one functionality of the widget to the third-party application; and

sending the message with the application identifier and the origin identifier from the wrapped widget client to the embedded widget.

6. The method of claim 5 , further comprising checking, at the widget, that the origin identifier associated with the valid third-party application matches an origin of the embedding third-party web page.

7. The method of claim 5 , wherein the message received at the embedded first-party widget from the widget client is generated using a web browser, wherein the browser automatically sets the origin identifier based on an address of the third-party web page.

8. The method of claim 1 , wherein the embeddable widget comprises one of a sharing interface, a document selection user interface, a file manager user interface, a document editing user interface, a third-party application installation interface, and a toolbar.

9. A system for embedding a widget provided by a first-party system in a third-party application, the system comprising:

a first-party server device configured for:

providing the third-party application with an embeddable first-party widget for embedding in a third-party web page, wherein the third-party web page is controlled by the third-party application, wherein the embedded first-party widget is configured for receiving a message from the embedding third-party application, and wherein the message comprises an application identifier and an origin identifier;

receiving at the first-party server from the embedded first-party widget the application identifier and the origin identifier;

authenticating the application identifier at the first-party server, wherein said authenticating the application identifier comprises determining whether the application identifier references a valid third-party application;

authenticating the origin identifier at the first-party server, wherein said authenticating the origin identifier comprises determining whether the origin identifier is associated with the valid third-party application that is referenced by the authenticated application identifier; and

in response to said authenticating the application identifier and the origin identifier, enabling the first-party widget to access the first-party system from the embedding third-party application.

10. The system of claim 9 , wherein:

the first-party server communicates with a cloud storage system;

the message received at the embedded first-party widget from the embedding third-party application further comprises a document identifier; and

the first-party server is configured for:

determining that the application identifier references a third-party application that was previously installed by a user; and

determining that the application identifier references a third-party application that was previously authorized by the user to access a document referenced by the document identifier, wherein the document is stored on the cloud storage system.

11. The system of claim 9 , wherein the first-party server is configured for authenticating the application identifier and the origin identifier before rendering visible at least a portion of the first-party widget in the third-party web page, wherein:

in response to the first-party server authenticating the application identifier and the origin identifier, rendering visible the at least the portion of the first-party widget.

12. The system of claim 9 , wherein the first-party server is configured for authenticating the application identifier and the origin identifier after rendering visible a wrapper of the first-party widget in the third-party web page, wherein in response to the first-party server determining at least one of the application identifier not referencing the valid third-party application and the origin identifier not being associated with the valid third-party application, the first-party server is configured for denying the first-party widget access to the first-party server from the embedding third-party application.

13. The system of claim 9 , wherein:

a widget client is included in the third-party web page;

the widget client is wrapped in an application programming interface (API), wherein the API exposes at least one functionality of the widget to the third-party application; and

the wrapped widget sends the message with the application identifier and the origin identifier to the embedded widget.

14. The system of claim 13 , wherein the first-party server is configured for checking, at the widget, that the origin identifier associated with the valid third-party application matches an origin of the embedding third-party web page.

15. The system of claim 13 , wherein the message received at the embedded first-party widget from the widget client is generated using a web browser, wherein the browser automatically sets the origin identifier based on an address of the third-party web page.

16. A non-transitory computer readable medium storing computer executable instructions, which, when executed by a processor circuitry, causes the circuitry to carry out a method for embedding a widget provided by a first-party system in a third-party application, the method comprising:

providing the third-party application with an embeddable first-party widget for embedding in a third-party web page, wherein the third-party web page is controlled by the third-party application;

receiving a message at the embedded first-party widget from the embedding third-party application, wherein the message comprises an application identifier and an origin identifier;

receiving at a first-party server from the embedded first-party widget the application identifier and the origin identifier;

authenticating the application identifier at the first-party server, wherein said authenticating the application identifier comprises determining whether the application identifier references a valid third-party application;

authenticating the origin identifier at the first-party server, wherein said authenticating the origin identifier comprises determining whether the origin identifier is associated with the valid third-party application that is referenced by the authenticated application identifier; and

in response to said authenticating the application identifier and the origin identifier, enabling the first-party widget to access the first-party system from the embedding third-party application.

17. The non-transitory computer readable medium of claim 16 , wherein:

the first-party server communicates with a cloud storage system;

the message received at the embedded first-party widget from the embedding third-party application further comprises a document identifier; and

the determining whether the application identifier references the valid third-party application comprises:

determining that the application identifier references a third-party application that was previously installed by a user; and

determining that the application identifier references a third-party application that was previously authorized by the user to access a document referenced by the document identifier, wherein the document is stored on the cloud storage system.

18. The non-transitory computer readable medium of claim 16 , wherein the authenticating the application identifier and the origin identifier are performed before rendering visible at least a portion of the first-party widget in the third-party web page, and wherein:

in response to the authenticating the application identifier and the origin identifier, rendering visible the at least the portion of the first-party widget.

19. The non-transitory computer readable medium of claim 16 , wherein the authenticating the application identifier and the origin identifier are performed after rendering visible a wrapper of the first-party widget in the third-party web page, wherein in response to determining at least one of the application identifier not referencing the valid third-party application and the origin identifier not being associated with the valid third-party application, denying the first-party widget access to the first-party server from the embedding third-party application.

20. The non-transitory computer readable medium of claim 16 , wherein the embeddable widget comprises one of a sharing interface, a document selection user interface, a file manager user interface, a document editing user interface, a third-party application installation interface, and a toolbar.

Assignments (1)
CHANGE OF NAME Recorded Oct 2, 2017
From: GOOGLE INC.
To: GOOGLE LLC
Reel/Frame 044334/0466 →