Transparently using origin isolation to protect access tokens

A tangible non-transitory computer readable storage media, including program instructions loaded into memory that, when executed on processors cause the processors to implement a method of safely attaching an access token to a browser-based request to a resource server, made on behalf of a first app loaded by a webpage, without exposing the access token to a malicious app loaded by the webpage with the first app, the method including:

• providing an identity proxy and a secrets management proxy running in an iFrame on the browser that is running the first app, wherein
• the identity proxy transparently determines which network requests to relay via the secrets management proxy;
• and
• the secrets management proxy provides access token management services transparently to the request when communicating with the resource server, including providing access tokens to requests to the resource server;
• the identity proxy intercepting a request from the first app to the resource server, determining to reroute, and relaying the request via the secrets management proxy;
• the secrets management proxy providing the access token management services on behalf of the first app for interaction with the resource server and forwarding the request to the resource server with the access token attached;
• and
• the secrets management proxy receiving a response from the resource server and forwarding the response to the identity proxy for return to the first app, without providing the access token to the first app or the malicious app.

A system comprising:

• a memory storing program instructions;
• and
• one or more processors coupled to the memory, wherein when the one more processors execute the program instructions, causing the one or more processors to implement a method of safely attaching an access token to a browser-based request to a resource server, made on behalf of a first app loaded by a webpage, without exposing the access token to a malicious app loaded by the webpage with the first app, the method including:
• providing an identity proxy and a secrets management proxy running in an iFrame on the browser that is running the first app, wherein
• the identity proxy transparently determines which network requests to relay via the secrets management proxy;
• and
• the secrets management proxy provides access token management services transparently to the request when communicating with the resource server, including providing access tokens to requests to the resource server;
• the identity proxy intercepting a request from the first app to the resource server, determining to reroute, and relaying the request via the secrets management proxy;
• the secrets management proxy providing the access token management services on behalf of the first app for interaction with the resource server and forwarding the request to the resource server with the access token attached;
• and
• the secrets management proxy receiving a response from the resource server and forwarding the response to the identity proxy for return to the first app, without providing the access token to the first app or the malicious app.