Granted Patent B2

US 12,432,245 · App. 17/898,931 · Granted Sep 30, 2025

Inventor: Kelly Shortridge (New York, NY)

Assignee: Fastly, Inc.

H04L63/1433H04L63/1425H04L63/20

Abstract

Claims (60)

1. A method of operating a server in an infrastructure service to verify security of a website, the method comprising:

receiving a request message that comprises a header portion and a content indicator that indicates at least a portion of a website that is requested, wherein the header portion comprises verification information;

determining that the request message will be tested;

removing the verification information from the header portion to create a modified header portion;

creating a second request message, wherein the second request message comprises the content indicator and the modified header portion;

forwarding, from the server, the request message and the second request message to a supply server;

receiving, at the server, a first response to the request message and a second response to the second request message;

returning, from the server, the first response in response to the request message;

comparing the first response and the second response; and

creating a security report based on the comparison, wherein the security report indicates if the server provided the requested portion of the website to the server in response to receiving the second request message with the modified header portion that did not include the verification information.

2. The method of claim 1 , wherein the supply server is an origin server.

3. The method of claim 1 , wherein the infrastructure service comprises an edge network, and the server is a server within the edge network.

4. The method of claim 3 , wherein the supply server is a server within the edge network.

5. The method of claim 1 , wherein removing the verification information from the header portion comprises removing the verification information and one or more cookies from the header portion to create the modified header portion.

6. The method of claim 1 , wherein removing the verification information from the header portion comprises removing the verification information from the header portion and inserting a cross-site origin into the header portion to create the modified header portion.

7. The method of claim 1 , further comprising transferring the security report for delivery to a manager associated with the website.

8. The method of claim 1 , further comprising:

receiving a further request message, wherein the further request message comprises a further header portion and a further content indicator that indicates at least a portion of a further website that is requested;

determining that the request message will not be tested;

forwarding the further request message to a supply server without creating a second further request message;

receiving a further response to the further request message; and

returning the further response in response to the further request message.

9. A server in an infrastructure service, the server configured to:

test security of a website, wherein testing the security of the website comprises:

receiving a request message that comprises a header portion and a content indicator that indicates at least a portion of the website that is requested, wherein the header portion comprises verification information;

determining that the request message will be tested;

removing the verification information from the header portion to create a modified header portion;

creating a second request message, wherein the second request message comprises the content indicator and the modified header portion;

forwarding, from the server, the request message and the second request message to a supply server;

receiving, at the server, a first response to the request message and a second response to the second request message;

returning, from the server, the first response in response to the request message;

comparing the first response and the second response; and

creating a security report based on the comparison, wherein the security report indicates if the server provided the requested portion of the website to the server in response to receiving the second request message with the modified header portion that did not include the verification information.

10. The server of claim 9 , wherein the supply server is an origin server.

11. The server of claim 9 , wherein the infrastructure service comprises an edge network, and the server is a server within the edge network.

12. The server of claim 11 , wherein the supply server is a server within the edge network.

13. The server of claim 9 , wherein removing the verification information from the header portion comprises removing the verification information from the header portion and one or more cookies from the header portion to create the modified header portion.

14. The server of claim 9 , wherein removing the verification information from the header portion comprises removing the verification information from the header portion and inserting a cross-site origin into the header portion to create the modified header portion.

15. The server of claim 9 , wherein testing the security of the website further comprises transferring the security report for delivery to a manager associated with the website.

16. The server of claim 9 , wherein testing the security of the website further comprises:

receiving a further request message, wherein the further request message comprises a further header portion and a further content indicator that indicates at least a portion of a further website that is requested;

determining that the request message will not be tested;

forwarding the further request message to a supply server without creating a second further request message;

receiving a further response to the further request message; and

returning the further response in response to the further request message.

17. A server in an infrastructure service, the server comprising:

a processor and tangible memory;

the tangible memory storing instructions, which, when executed by the processor, instruct the processor to test security of a website, wherein testing the security of the website comprises:

receiving a request message that comprises a header portion and a content indicator that indicates at least a portion of the website that is requested, wherein the header portion comprises verification information;

determining that the request message will be tested;

removing the verification information from the header portion to create a modified header portion;

creating a second request message, wherein the second request message comprises the content indicator and the modified header portion;

forwarding, from the server, the request message and the second request message to a supply server;

receiving, at the server, a first response to the request message and a second response to the second request message;

returning, from the server, the first response in response to the request message;

comparing the first response and the second response; and

creating a security report based on the comparison, wherein the security report indicates if the server provided the requested portion of the website to the server in response to receiving the second request message with the modified header portion that did not include the verification information.

18. The server of claim 17 , wherein removing the verification information from the header portion comprises removing the verification information from the header portion and one or more cookies from the header portion to create the modified header portion.

19. The server of claim 17 , wherein removing the verification information from the header portion comprises removing the verification information from the header portion and inserting a cross-site origin into the header portion to create the modified header portion.

20. The server of claim 17 , wherein testing the security of the website further comprises transferring the security report for delivery to a manager associated with the website.

Assignments (2)

Continuity (1)

References Cited (27)