US 11,381,555 B2 · State token based approach to secure web applications

Abstract

Techniques for securing a single page application (SPA) are provided. An API server that receives an API call from an SPA to navigate a first user to a first state of the SPA navigates the first user to the first state of the SPA and generates a first token indicating that the first user has accessed the first state of the SPA. When the API server receives a request from the first user to navigate to a second state of the SPA (the request including the first token), the API server verifies that the first token indicating that the first user has accessed the first state of the SPA is valid for the second state of the SPA before navigating the first user to the second state of the SPA. Additionally, the API server expires the first token upon navigating the first user to the second state of the SPA.

Claims20

Dependent claims

A computer-implemented method for securing a single page web application, comprising:

receiving, at an application programming interface (API) server, a call from a single page application (SPA) to navigate a first user to a first state of the SPA;
navigating, by the API server, the first user to the first state of the SPA;
generating, by the API server, a first token indicating that the first user has previously accessed the first state of the SPA;
receiving, by the API server, a request from the first user to navigate to a second state of the SPA, the request including the first token;
verifying, by the API server, that the first token indicating that the first user has previously accessed the first state of the SPA is valid for the second state of the SPA;
navigating, by the API server, the first user to the second state of the SPA based on the API server verifying the first token;
and
expiring, by the API server, the first token upon navigating the first user to the second state of the SPA.

5 more elements

A computer system for securing a single page web application, comprising:

an application programming interface (API) server, the API server comprising:
one or more processors;
and
a non-transitory program memory communicatively coupled to the one or more processors and storing executable instructions that, when executed by the one or more processors, cause the processors to:
receive an API call from a single page application (SPA) to navigate a first user to a first state of the SPA;
navigate the first user to the first state of the SPA;
generate a first token indicating that the first user has previously accessed the first state of the SPA;
receive a request, from the first user, to navigate to a second state of the SPA, the request including the first token;
verify that the first token indicating that the first user has previously accessed the first state of the SPA is valid for the second state of the SPA;
navigate the first user to the second state of the SPA based on verifying the first token;
and
expire the first token upon navigating the first user to the second state of the SPA.

9 more elements

A tangible, non-transitory computer-readable medium storing executable instructions for securing a single page web application that, when executed by at least one processor of a computer system, cause the at least one processor to:

receive a call from a single page application (SPA) to navigate a first user to a first state of the SPA;
navigate the first user to the first state of the SPA;
generate a first token indicating that the first user has previously accessed the first state of the SPA;
receive a request, from the first user, to navigate to a second state of the SPA, the request including the first token;
verify that the first token indicating that the first user has previously accessed the first state of the SPA is valid for the second state of the SPA;
navigate the first user to the second state of the SPA based on verifying the first token;
and
expire the first token upon navigating the first user to the second state of the spa.

5 more elements

Dependencies are inferred from the claim text.

State token based approach to secure web applications

Life of this patent

State token based approach to secure web applications

Life of this patent

Abstract

Claims20