# US 10,313,381 B2 · Identifying requests that invalidate user sessions > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,313,381 B2 - Document ID: US10313381B2 - Status: Granted - Kind: B2 - Application number: 16/100,174 - Filed: 2018-08-09 - Published: 2018-12-06 - Granted: 2019-06-04 - Earliest claimed: 2011-12-20 - Assignees: International Business Machines Corporation - Applicants: International Business Machines Corporation - Inventors: Paul Ionescu; Iosif Viorel Onut; Ori Segal; Wayne Duncan Smith - Web page: https://patentgrep.com/patent/US10313381B2 ## CPC - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - G06F 11/3668: Testing of software - G06F 11/3676: {for coverage analysis} - G06F 11/368: {for test version control, e.g. updating test cases to a new software version} - G06F 16/951: Indexing; Web crawling techniques - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - H04L 63/1433: {Vulnerability analysis} - G06F 2221/033: Test or assess software - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract An illustrative embodiment of a computer-implemented process for identifying a request invalidating a session excludes all marked logout requests of a Web application, crawls an identified next portion of the Web application and responsive to a determination, in one instance, that the state of the crawl is out of session, logs in to the Web application. The computer-implemented process further selects all crawl requests sent since a last time the crawl was in-session, excluding all marked logout requests and responsive to a determination that requests remain, crawls a selected next unprocessed request. Responsive to a determination, in the next instance, that state of the crawl is out of session and the selected request meets logout request criteria, the computer-implemented process marks the selected request as a logout request. ## Claims ### Claim 1 A computer-implemented method for performing a crawl of a Web application, comprising: selecting, from a first set of requests including only those crawl requests sent since a last time the crawl was in session, a next unprocessed crawl request; executing the selected next unprocessed crawl request; and determining, after logging into the Web application and after the executing, that a state of the crawl is out of session; marking, as a logout request and based upon the determining, the selected next unprocessed crawl request, wherein the first set of requests, from which the next unprocessed crawl request is selected, excludes all crawl requests previously marked as a logout request, and a crawl request marked as a logout request is a request sent to the Web Application that invalidates a user session with the Web application. ### Claim 2 (depends on 1) The method of claim 1, wherein the marking the selected next unprocessed crawl request as a logout request is based upon the next unprocessed crawl request not returning an error message from the Web application. ### Claim 3 (depends on 1) The method of claim 1, wherein the marking the selected next unprocessed crawl request as a logout request is based upon the next unprocessed crawl request meeting both a mandatory criteria and a selected optional criteria. ### Claim 4 (depends on 1) The method of claim 1, wherein a determination that the state of the crawl is out of session includes: sending an in-session check request to a server; and analyzing a response, associated with the in-session check request, received from the server. ### Claim 5 (depends on 1) The method of claim 1, further comprising: second logging, based upon the determining, into the Web application to establish that the state of the crawl is in session; selecting, from the first set of requests and after the second logging, a second next unprocessed crawl request; and executing the selected second next unprocessed crawl request. ### Claim 6 (depends on 1) The method of claim 1, wherein the marking is performed: directly using a machine-readable symbol, or indirectly using a logically associated descriptor. ### Claim 7 A computer hardware system configured to perform a crawl of a Web application, comprising: a hardware processor configured to initiate the following executable operations: selecting, from a first set of requests including only those crawl requests sent since a last time the crawl was in session, a next unprocessed crawl request; executing the selected next unprocessed crawl request; and determining, after logging into the Web application and after the executing, that a state of the crawl is out of session; marking, as a logout request and based upon the determining, the selected next unprocessed crawl request, wherein the first set of requests, from which the next unprocessed crawl request is selected, excludes all crawl requests previously marked as a logout request, and a crawl request marked as a logout request is a request sent to the Web Application that invalidates a user session with the Web application. ### Claim 8 (depends on 7) The system of claim 7, wherein the marking the selected next unprocessed crawl request as a logout request is based upon the next unprocessed crawl request not returning an error message from the Web application. ### Claim 9 (depends on 7) The system of claim 7, wherein the marking the selected next unprocessed crawl request as a logout request is based upon the next unprocessed crawl request meeting both a mandatory criteria and a selected optional criteria. ### Claim 10 (depends on 7) The system of claim 7, wherein a determination that the state of the crawl is out of session includes: sending an in-session check request to a server; and analyzing a response, associated with the in-session check request, received from the server. ### Claim 11 (depends on 7) The system of claim 7, wherein the hardware processor is further configured to initiate the following executable operations: second logging, based upon the determining, into the Web application to establish that the state of the crawl is in session; selecting, from the first set of requests and after the second logging, a second next unprocessed crawl request; and executing the selected second next unprocessed crawl request. ### Claim 12 (depends on 7) The system of claim 7, wherein the marking is performed: directly using a machine-readable symbol, or indirectly using a logically associated descriptor. ### Claim 13 A computer program product, comprising: a hardware storage device having stored therein computer executable program code for performing a crawl of a Web application, the computer executable program code, which when executed by a computer hardware system, causes the computer hardware system to perform: selecting, from a first set of requests including only those crawl requests sent since a last time the crawl was in session, a next unprocessed crawl request; executing the selected next unprocessed crawl request; and determining, after logging into the Web application and after the executing, that a state of the crawl is out of session; marking, as a logout request and based upon the determining, the selected next unprocessed crawl request, wherein the first set of requests, from which the next unprocessed crawl request is selected, excludes all crawl requests previously marked as a logout request, and a crawl request marked as a logout request is a request sent to the Web Application that invalidates a user session with the Web application. ### Claim 14 (depends on 13) The computer program product of claim 13, wherein the marking the selected next unprocessed crawl request as a logout request is based upon the next unprocessed crawl request not returning an error message from the Web application. ### Claim 15 (depends on 13) The computer program product of claim 13, wherein the marking the selected next unprocessed crawl request as a logout request is based upon the next unprocessed crawl request meeting both a mandatory criteria and a selected optional criteria. ### Claim 16 (depends on 13) The computer program product of claim 13, wherein a determination that the state of the crawl is out of session includes: sending an in-session check request to a server; and analyzing a response, associated with the in-session check request, received from the server. ### Claim 17 (depends on 13) The computer program product of claim 13, wherein the computer executable program code further causes the computer hardware system to perform: second logging, based upon the determining, into the Web application to establish that the state of the crawl is in session; selecting, from the first set of requests and after the second logging, a second next unprocessed crawl request; and executing the selected second next unprocessed crawl request. ### Claim 18 (depends on 13) The computer program product of claim 13, wherein the marking is performed: directly using a machine-readable symbol, or indirectly using a logically associated descriptor.