Access control list checking
View Patent ↗Method and system for dynamically checking an access control list during the data transfers between a client web browser and a web server. The method and system allow checking of access control list by an application firewall, independent from the web application. The rules, upon which the checking is based, can be easily updated without affecting the web application.
1. A computer software product stored on a medium for checking an access control list for a web application comprising:
a memory having microcontroller-readable code embedded therein for checking an access control list for a web application, said code comprising:
code means for receiving a request from a web client;
code means for parsing the request to an application firewall, said application firewall having a rule and residing independently of the web application, said rule having syntax to identify a parameter in the request;
code means for checking the received request based on said rule;
code means for allowing the received request passing through the application firewall upon matching the rules; and
code means for checking the access control list with an authentication provider.
2. The computer software product as claimed in claim 1 , wherein the access control list is provided by an independent authentication provider.
3. The computer software product as claimed in claim 1 , wherein the authentication provider is a remote software module.
4. The computer software product as claimed in claim 1 , wherein the authentication provider is a remote system.
5. The computer software product as claimed in claim 1 , wherein the application firewall is operatively responsible for a plurality of web applications.
6. The computer software product as claimed in claim 1 , wherein the syntax is selected from a group consisting of name, operand type; context, method, content, and combination thereof.
7. The computer software product as claimed in claim 1 , wherein the access control list is checked for a user's permission to access an object within a system.
8. The computer software product as claimed in claim 1 , wherein the access control list is checked for a user's capability to access a service provided by a system.
9. A system for checking an access control list for a web application, comprising:
means for receiving a request from a web client;
means for parsing the request to an application firewall, said application firewall having a rule and residing independently of the web application, said rule having syntax to identify a parameter in the request;
means for checking the received request based on said rule;
means for allowing the received request passing through the application firewall upon matching the rules; and
means for checking the access control list with an authentication provider.
10. The system as claimed in claim 9 , wherein the access control list is provided by an independent authentication provider.
11. The system as claimed in claim 9 , wherein the authentication provider is a remote software module.
12. The system as claimed in claim 9 , wherein the authentication provider is a remote system.
13. The system as claimed in claim 9 , wherein the application firewall is operatively responsible for a plurality of web applications.
14. The system as claimed in claim 9 , wherein the syntax is selected from a group consisting of name, operand type; context, method, content, and combination thereof.
15. The system as claimed in claim 9 , wherein the access control list is checked for a user's permission to access an object within a system.
16. The system as claimed in claim 9 , wherein the access control list is checked for a user's capability to access a service provided by a system.