Plugin authorization workflow for web applications

A system comprising:

• a processing device;
• and
• a computer-readable storage medium storing instructions that, responsive to execution by the processing device, causes the processing device to perform operations including:
• receiving an input approving execution of a plugin, the input received via a user interface (UI);
• communicating the input via a network for receipt by a target authorization system, the input configured to cause the target authorization system to generate an authorization code for communication to an authorization provider module, the plugin as executed within a sandboxed iframe of a web browser, the authorization provider module, and the target authorization system implemented separately, one to another, via the network;
• receiving the authorization code at the plugin via the network from as redirected via the authorization provider module from the target authorization system, the plugin executed within the sandboxed iframe of the web browser, the sandboxed iframe having a sandbox attribute that limits execution of the plugin within the sandboxed iframe of the web browser;
• generating a call via the network to the target authorization system by the plugin as executed within the sandboxed iframe of the web browser, the call including the authorization code;
• receiving an authorization token by the plugin as executed within the sandboxed iframe of the web browser directly from the target authorization system via the network in response to the target authorization system receiving the authorization code;
• and
• executing the plugin based on the authorization token within the sandboxed iframe of the web browser.

A non-transitory computer-readable storage medium storing executable instructions, which when executed by a processing device, cause the processing device to perform operations comprising:

• registering, via a network, a plugin associated with a target authorization system using an authorization redirect application;
• retrieving, via the network, a client identifier via a plugin application programming interface of an authorization provider module;
• receiving, by the authorization provider module via the network, a request for an authorization token by the plugin executed within a sandboxed iframe of a web browser, the sandboxed iframe having a sandbox attribute that limits execution of the plugin within the sandboxed iframe of the web browser;
• causing, in response to the request, display of a user interface received from a target authorization system by the authorization provider module, the user interface configured to receive an input approving execution of the plugin, the plugin, the authorization provider module, and the target authorization system implemented separately via the network;
• communicating the input approving execution of the plugin within the sandboxed iframe of the web browser for receipt by the target authorization system, the input configured to cause the target authorization system to generate an authorization code for communication to the authorization provider module;
• and
• sending the authorization code received from the target authorization system as redirected to the plugin executed within the sandboxed iframe of the web browser by the authorization provider module, the authorization code configured to enable receipt of an authorization token from the target authorization system by the plugin executed within the sandboxed iframe of the web browser in response to the target authorization system receiving the authorization code.