Securing ordered resource access

1. A method for securing ordered resource access of an initial and an additional resource, the method comprising:

receiving, at a service provider over a network, a request for the initial resource from a client device;

identifying access parameters of the request for the initial resource, wherein the access parameters are identifiable for a future request from the client device for the additional resource at a resource provider, wherein the access parameters comprise a hostname designated in the request for the initial resource, a user-agent designated in the request for the initial resource, a network address originating the request for the initial resource, a content identifier specific to a content item or a group of content items of the additional resource, a session identifier that describes a session token or session information for the client device, and a salt for a cryptographic signature, such that at least one parameter of the cryptographic signature is not accessible by the client device;

generating, by the service provider, a token for the request, the token derived by applying the access parameters to a hash function using a secret key, the secret key shared with the resource provider over the network for authorizing requests for the additional resource;

providing the token to the client device for inclusion by the client device in the future request for the additional resource, the future request authorized by the resource provider, using the token, by applying the access parameters in the future request to the hash function using the secret key to confirm whether the initial resource was first provided to the client device by the service provider; and

generating, based on the access parameters and a risk score of the client device, an authorization including an authorization token for access to the additional resource, wherein the authorization token encodes the token and an expiration time,

wherein when the content identifier is used, a different authorization is generated for each additional content item to be accessible by the client device.

2. The method of claim 1 , wherein generating the token further comprises: identifying the expiration time for authorized access by the client device to the additional resource after accessing the initial resource; and applying the hash function to the expiration time to generate the token.

3. The method of claim 2 , wherein the expiration time is set by adding a predefined amount of time to a current time.

4. The method of claim 1 , wherein authorization of the future request by the resource provider comprises: identifying the access parameters in the future request; generating a test token for the second request for the second resource from the access parameters; and comparing the test token to the token.

5. The method of claim 1 , wherein the resource provider is a separate computing system relative to the service provider.

6. The method of claim 1 , wherein the initial resource is a containing page including a reference to the additional resource.

7. The method of claim 1 , wherein the additional resource is embedded in the initial resource.

8. The method of claim 1 , wherein the authorization is a modification of a reference to the additional resource.

9. A non-transitory computer-readable storage medium containing computer program code for:

receiving, at a service provider over a network, a request for the initial resource from a client device;

identifying access parameters of the request for the initial resource, wherein the access parameters are identifiable for a future request from the client device for the additional resource at a resource provider, wherein the access parameters comprise a hostname designated in the request for the initial resource, a user-agent designated in the request for the initial resource, a network address originating the request for the initial resource, a content identifier specific to a content item or a group of content items of the additional resource, a session identifier that describes a session token or session information for the client device, and a salt for a cryptographic signature, such that at least one parameter of the cryptographic signature is not accessible by the client device;

generating, by the service provider, a token for the initial request, the token derived by applying the access parameters to a hash function using a secret key, the secret key shared with the resource provider over the network for authorizing requests for the additional resource;

providing the token to the client device for inclusion by the client device in the future request for the additional resource, the future request authorized by the resource provider, using the token, by applying the access parameters in the future request to the hash function using the secret key to confirm whether the initial resource was first provided to the client device by the service provider; and

generating, based on the access parameters and a risk score of the client device, an authorization including an authorization token for access to the additional resource, wherein the authorization token encodes the token and an expiration time,

wherein when the content identifier is used, a different authorization is generated for each additional content item to be accessible by the client device.

10. The storage medium of claim 9 , wherein generating the token further comprises: identifying the expiration time for authorized access by the client device to the additional resource after accessing the initial resource; and applying the hash function to the expiration time to generate the token.

11. The storage medium of claim 9 , wherein authorization of the future request by the resource provider comprises: identifying the access parameters in the future request; generating a test token for the second request for the second resource from the access parameters; and comparing the test token to the token.

12. The storage medium of claim 9 , wherein the resource provider is a separate computing system relative to the service provider.

13. The storage medium of claim 9 , wherein the initial resource is a containing page including a reference to the additional resource.

14. The storage medium of claim 9 , wherein the additional resource is embedded in the initial resource.

15. A method for verifying access to a resource to be accessed subsequent to an initial resource, comprising:

receiving, by a resource provider, a secret key from a service provider over a network;

receiving, by the resource provider from a client device over the network, a resource access request for a first resource, the resource access request including a token generated by the service provider for the resource access request during a previous request for an initial resource and provided by the service provider to the client device responsive to providing the initial resource to the client device;

identifying one or more access parameters of the resource access request, the access parameters identifiable for the previous request for the initial resource, wherein the access parameters comprise a hostname designated in the previous request for the initial resource, a user-agent designated in the previous request for the initial resource, a network address originating the previous request for the initial resource, a content identifier specific to a content item or a group of content items of an additional resource, a session identifier that describes a session token or session information for the client device, and a salt for a cryptographic signature, such that at least one parameter of the cryptographic signature is not accessible by the client device;

generating, by the resource provider, a test token, the test token derived by applying the access parameters to a hash function using the secret key;

comparing the test token to the token in the resource access request to confirm that the initial resource was first provided to the client device by the service provider, wherein the token in the resource access request comprises a risk score of the client device; and

responsive to the test token matching the token in the access request based on the comparison, transmitting the resource to the client device over the network,

wherein when the content identifier is used, a different authorization is received for each additional content item to be accessible by the client device.