Securing ordered resource access
Ordered access to resources is controlled by restricting access to additional resources that are accessible when a client device provides an authentication provided when accessing an initial resource. When the client device accesses the initial resources, a set of access parameters are identified describing the request and the client device providing the request, and included with an expiration time in generating a token. The token and expiration date are provided in an authorization for the additional resources. When requesting the additional resources, the authorization is provided and verified by comparing the token in the authorization with a test token generated with reference to access parameters of the request for additional resources. When the tokens match, the additional resource is provided to the client device.
1. A method for securing ordered resource access of an initial and an additional resource, the method comprising:
receiving, at a service provider over a network, a request for the initial resource from a client device;
responsive to receiving the request for the initial resource:
identifying access parameters of the request for the initial resource, the access parameters describing one or more characteristics of the request or client device that are also identifiable for a future request from the client device for the additional resource at a resource provider;
verifying that the client device is authorized to access the initial resource;
identifying an expiration time for authorized access by the client device to the additional resource after accessing the initial resource;
generating, by the service provider, a token for the initial request, the token derived by applying the access parameters and the expiration time to a hash function using a secret key;
generating an authorization for access to the additional resource, the authorization including the token and the expiration time;
responsive to generating the authorization, transmitting, by the service provider over the network, the initial resource to the client device;
transmitting, by the service provider over the network, the secret key to the resource provider to authorize requests for the additional resource; and
providing the authorization to the client device for inclusion by the client device in the future request for the additional resource, the future request authorized by the resource provider, using the authorization, by applying the access parameters in the future request to the hash function using the secret key to confirm the initial resource was first provided to the client device by the service provider.
2. The method of claim 1 , wherein the access parameters include a hostname designated in the request for the initial resource, a user-agent designated in the request for the initial resource, or a networking address originating the request for the initial resource.
3. The method of claim 1 , wherein the expiration time is within a short time range from a current time.
4. The method of claim 1 , wherein the resource provider authorizes the future request by:
identifying the access parameters in the future request;
generating a test token for the second request for the second resource, the resource provider deriving the test token by applying the secret key to the access parameters and the expiration time; and
comparing the test token to the token included in the authorization.
5. The method of claim 4 , wherein the resource provider and the service provider are components of a content-delivery network.
6. The method of claim 1 , wherein the initial resource is a containing page including a reference to the additional resource.
7. The method of claim 1 , wherein the additional resource is embedded in the first resource.
8. The method of claim 1 , wherein the authorization is an authorization token encoding the token and the expiration time.
9. The method of claim 8 , wherein the authorization includes a risk score of the client device.
10. The method of claim 1 , wherein the authorization is a modification of a reference to the additional resource.
11. A non-transitory computer-readable storage medium containing computer program code for:
receiving, at a service provider over a network, a request for the initial resource from a client device;
responsive to receiving the request for the initial resource:
identifying access parameters of the request for the initial resource, the access parameters describing one or more characteristics of the request or client device that are also identifiable for a future request from the client device for the additional resource at a resource provider;
verifying that the client device is authorized to access the initial resource;
identifying an expiration time for authorized access by the client device to the additional resource after accessing the initial resource;
generating, by the service provider, a token for the initial request, the token derived by applying the access parameters and the expiration time to a hash function using a secret key;
generating an authorization for access to the additional resource, the authorization including the token and the expiration time;
responsive to generating the authorization, transmitting, by the service provider over the network, the initial resource to the client device;
transmitting, by the service provider over the network, the secret key to the resource provider to authorize requests for the additional resource; and
providing the authorization to the client device for inclusion by the client device in the future request for the additional resource, the future request authorized by the resource provider, using the authorization, by applying the access parameters in the future request to the hash function using the secret key to confirm the initial resource was first provided to the client device by the service provider.
12. The storage medium of claim 11 , wherein the access parameters include a hostname designated in the request for the initial resource, a user-agent designated in the request for the initial resource, or a networking address originating the request for the initial resource.
13. The storage medium of claim 11 , wherein the expiration time is within a short time range from a current time.
14. The storage medium of claim 11 , wherein the resource provider authorizes the future request by:
identifying the access parameters in the future request;
generating a test token for the second request for the second resource, the resource provider deriving the test token by applying the secret key to the access parameters and the expiration time; and
comparing the test token to the token included in the authorization.
15. The storage medium of claim 14 , wherein the resource provider and the service provider are components of a content-delivery network.
16. The storage medium of claim 11 , wherein the initial resource is a containing page including a reference to the additional resource.
17. The storage medium of claim 11 , wherein the additional resource is embedded in the first resource.
18. The storage medium of claim 11 , wherein the authorization is an authorization token encoding the token and the expiration time.
19. The storage medium of claim 18 , wherein the authorization includes a risk score of the client device.
20. The storage medium of claim 11 , wherein the authorization is a modification of a reference to the additional resource.
21. A method for verifying access to a resource to be accessed subsequent to an initial resource, comprising:
receiving, by a resource provider, a secret key from a service provider over a network;
receiving, by the resource provider from a client device over the network, a resource access request for a first resource, the resource access request including an authorization for access to the first resource generated by the service provider during a previous request for an initial resource and provided by the service provider to the client device responsive to providing the initial resource to the client device;
identifying one or more access parameters of the resource access request, the access parameters describing one or more characteristics of the resource access request or client device identifiable for the previous request for the initial resource;
identifying, in the authorization, an expiration time and a token for the resource access request;
generating, by the resource provider, a test token, the test token derived by applying the access parameters and the expiration time in the authorization to a hash function using the secret key;
comparing the test token to the token identified in the authorization in order to confirm that the initial resource was first provided to the client device by the service provider; and
responsive to the test token matching the token identified in the authorization based on the comparison, transmitting the resource to the client device over the network.
22. The method of claim 21 , wherein the access parameters include a hostname designated in the resource access request, a user-agent designated in the resource access request, or a networking address originating the resource access request.
23. The method of claim 21 , wherein the first resource is an embedded resource for another page.
24. The method of claim 21 , wherein the authorization is an authorization token encoding the token and the expiration time identified in the authorization.
25. The method of claim 21 , wherein the authorization is a modification to a reference to the first resource.