Secure way to authenticate from file protocol while handling third party cookies and browser inconsistencies
A system and method for authenticating a user from file protocol for viewing secure data in a browser is provided. The authentication method requires a server dedicated to validate authToken for monitoring document access requests and enforcing rules and policies to limit access to others having invalid authToken. Further, the method for authenticating a user for viewing a secured file in a browser, comprising using cross origin security policies; using history trick functions for redirecting the user back to the file; using signed tokens for making authentication context tampering resistant; using combination of AUTH session token and secret to support multiple AUTH sessions; and using multiple use cases where multiple files can be opened simultaneously with different authorization requirements.
1. A method for authenticating a user for viewing a secured file in a browser, the method comprising:
selecting a secured file in a server to access via a browser on a user device;
reading a file wrapper which appears in a user interface associated with the user device as an original file type and which comprises metadata and data as a different file type;
generating an inline frame in the browser informing the server to create an authorization session;
generating an authorization session by the server with the browser on the user device; storing the authorization session data and history path in the browser;
verifying user data access rights associated with the user device using an authorization key;
opening the secured file in the browser on the successful validation of authorization key using stored history path in the browser.
2. The method of claim 1 , wherein the history path uses history trick functions for redirecting the user back to the file after successful authentication.
3. The method of claim 1 , wherein the method further comprises validating user using combination of authorization session tokens and secret from server to support multiple sessions.
4. The method of claim 1 further comprising: using multiple use cases where multiple files can be opened simultaneously with different authorization requirements.
5. The method of claim 1 wherein the method uses history path to redirect the user back to insecure browsing context once the user authenticates in the secure browsing context.
6. The method of claim 1 wherein the history path is used to help in handling authentication schemes such as Security Assertion Markup Language or work flows where the user can reset password using the created history length.
7. The method of claim 1 wherein the method provides protection from tampering of secured file by using a signed token to ensure protection against document tampering by storing the said signed token of the reason for which an authentication request was initiated.
8. The method of claim 1 wherein the method tackles multiple browser inconsistencies by passing the authorization session token in URL of the inline frame that makes the inline frame unique and non cacheable.
9. A system for authenticating a user for viewing a secured file in a browser, the system comprising:
a processor configured to:
select a secured file in a server to access via a browser on a user device;
read a file wrapper which appears in a user interface associated with the user device as an original file type and which comprises metadata and data as a different file type;
generate an inline frame in the browser informing the server to create an authorization session; and
generate an authorization session by the server with the browser on the user device; and
a memory to store the authorization session data and history path in the browser; wherein the processor is configured to verify user data access rights associated with the user device using an authorization key and to open the secured file in the browser on the successful validation of authorization key using stored history path in the browser.
10. The system of claim 9 , wherein the history path uses history trick functions for redirecting the user back to the file after successful authentication.
11. The system of claim 9 , wherein the system further validates a user using combination of authorization session tokens and secret from server to support multiple sessions.
12. The system of claim 9 , wherein the system uses multiple use cases where multiple files can be opened simultaneously with different authorization requirements.
13. The system of claim 9 , wherein the system uses history path to redirect the user back to insecure browsing context once the user authenticates in the secure browsing context.
14. The system of claim 9 , wherein the history path is used to help in handling authentication schemes such as Security Assertion Markup Language or work flows where the user can reset password using the created history length.
15. The system of claim 9 , wherein the system provides protection from tampering of secured file by using a signed token to ensure protection against document tampering by storing the said signed token of the reason for which an authentication request was initiated.
16. The system of claim 9 , wherein the system tackles multiple browser inconsistencies by passing the authorization session token in URL of the inline frame that makes the inline frame unique and non cacheable.