Securing ordered resource access

A non-transitory computer-readable storage medium containing computer program code for:

• receiving, at a service provider over a network, a request for the initial resource from a client device;
• responsive to receiving the request for the initial resource:
• identifying access parameters of the request for the initial resource, the access parameters describing one or more characteristics of the request or client device that are also identifiable for a future request from the client device for the additional resource at a resource provider;
• verifying that the client device is authorized to access the initial resource;
• identifying an expiration time for authorized access by the client device to the additional resource after accessing the initial resource;
• generating, by the service provider, a token for the initial request, the token derived by applying the access parameters and the expiration time to a hash function using a secret key;
• generating an authorization for access to the additional resource, the authorization including the token and the expiration time;
• responsive to generating the authorization, transmitting, by the service provider over the network, the initial resource to the client device;
• transmitting, by the service provider over the network, the secret key to the resource provider to authorize requests for the additional resource;
• and
• providing the authorization to the client device for inclusion by the client device in the future request for the additional resource, the future request authorized by the resource provider, using the authorization, by applying the access parameters in the future request to the hash function using the secret key to confirm the initial resource was first provided to the client device by the service provider.

A method for verifying access to a resource to be accessed subsequent to an initial resource, comprising:

• receiving, by a resource provider, a secret key from a service provider over a network;
• receiving, by the resource provider from a client device over the network, a resource access request for a first resource, the resource access request including an authorization for access to the first resource generated by the service provider during a previous request for an initial resource and provided by the service provider to the client device responsive to providing the initial resource to the client device;
• identifying one or more access parameters of the resource access request, the access parameters describing one or more characteristics of the resource access request or client device identifiable for the previous request for the initial resource;
• identifying, in the authorization, an expiration time and a token for the resource access request;
• generating, by the resource provider, a test token, the test token derived by applying the access parameters and the expiration time in the authorization to a hash function using the secret key;
• comparing the test token to the token identified in the authorization in order to confirm that the initial resource was first provided to the client device by the service provider;
• and
• responsive to the test token matching the token identified in the authorization based on the comparison, transmitting the resource to the client device over the network.