IP Library › Granted Patent US 11,949,714

Granted Patent B2

US 11,949,714 · App. 17/160,840 · Granted Apr 2, 2024

Cross-site request forgery protection

Inventors: Robert Spremulli (Nashua, NH); Chris Smith (Burlington, MA); Radha Shelat (Lexington, MA); Myles Taggart Frothingham (Acton, MA)

Assignee: Salesforce, Inc.

H04L63/168 H04L63/08 H04L63/126 H04L63/1466 H04L63/1483

View Patent ↗

Loading inventors, assignments & file history…

Monitor This Case

Get email alerts when status or documents change.

Order Certified Copies

Most orders are placed with the USPTO same day — all within 24 business hours.

Order via The Patent Place →

Pre-filled with this patent's details

Quick Facts

Patent No.: US 11,949,714
App. No.: 17/160,840
Granted: Apr 2, 2024
Kind: B2

External Links

USPTO Patent Center↗ Full Patent PDF↗

Abstract

Digital data processing systems of the type in which a server digital data device (“server”) is coupled to a client digital data device (“client”) over a network, e.g., the Internet, include web server software executing within an application layer on the server that responds to a request from the client by (i) validating a key received from the client with that request, (ii) generating a result code indicative of a success of that validation, (iii) initiating processing of the request, including invoking server resource software executing outside the application layer. The server resource software, which checks the result code upon invocation and before performing a protected operation required for processing the request, responds to a result code indicating that the result did not validate by exiting before executing the protected operation.

Claims (58)

1. A system comprising

a memory; and

a processor that executes a web server software within an application layer and a server resource software outside of the application layer,

receives, at the web server software, from a client digital data device, a first request that requires a protected operation,

determines, with the web server software, that a key encoded with a time-based code and received with the first request is not valid,

generates, with the web server software, a result code that is a “defer” code in response to the key received with the first request being determined not valid,

stores, with the web server software, the result code in the memory in a buffer accessible outside the application layer,

checks, with the server resource software, the result code stored in the buffer before performing the protected operation required by the first request,

exits, with the server resource software, execution of the first request before performing the protected operation in response to the result code in the buffer being a “defer” code,

receives, at the web server software, from the client digital data device or a second client digital data device, a second request that does not require any protected operations,

determines, with the web server software, a second key encoded with a second time-based code received with the second request is not valid,

generates, with the web server software, a second result code that is a “defer” code in response to the second key being determined not valid,

stores, with the web server software, the second result code in the memory in a second buffer accessible outside the application layer, and

processes, with the server resource software, the second request to completion without checking the second result code, in response to the second request not requiring any protected operations.

2. The system of claim 1 , wherein the web server software is any of a web server application and a framework for execution thereof.

3. The system of claim 1 , wherein the server resource software is any of a database system, a file system and an operating system.

4. The system of claim 1 , wherein the processor executes the web server software and the server resource software in different processes.

5. The system of claim 1 , wherein the processor executes the web server software in user space on a server comprising the processor and the processor executes the server resource software in protected space on the server.

6. The system of claim 1 , wherein the key was generated by a server comprising the processor and sent to the client digital data device in response to a prior request received from the client digital data device.

7. A computer-implemented method comprising:

executing a web server software within an application layer and a server resource software outside of the application layer;

receiving, at the web server software, from a client digital data device, a first request that requires a protected operation;

determining, with the web server software, that a key encoded with a time-based code and received with the first request is not valid;

generating, with the web server software, a result code that is a “defer” code in response to the key received with the first request being determined not valid;

storing, with the web server software, the result code in the memory in a buffer accessible outside the application layer;

checking, with the server resource software, the result code stored in the buffer before performing the protected operation required by the first request;

exiting, with the server resource software, execution of the first request before performing the protected operation in response to the result code in the buffer being a “defer” code;

receiving, at the web server software, from the client digital data device or a second client digital data device, a second request that does not require any protected operations;

determining, with the web server software, a second key encoded with a second time-based code received with the second request is not valid;

generating, with the web server software, a second result code that is a “defer” code in response to the second key being determined not valid;

storing, with the web server software, the second result code in the memory in a second buffer accessible outside the application layer; and

processing, with the server resource software, the second request to completion without checking the second result code, in response to the second request not requiring any protected operations.

8. The method of claim 7 , wherein the web server software is any of a web server application and a framework for execution thereof.

9. The method of claim 7 , wherein the server resource software is any of a database system, a file system and a operating system.

10. The method of claim 7 , further comprising executing the web server software and the server resource software in different processes.

11. The method of claim 7 , further comprising:

executing the web server software in user space on a server; and

executing the server resource software in protected space on the server.

12. The method of claim 7 , wherein the key was generated by a server and sent to the client digital data device in response to a prior request received from the client digital data device.

13. A machine readable non-transitory storage medium having stored thereon a computer program configured to cause a digital data device to perform the steps of: