# US 2018/0322258 A1 · Cross-application authentication on a content management system > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2018/0322258 A1 - Document ID: US20180322258A1 - Status: Published application - Kind: A1 - Application number: 16/031,363 - Filed: 2018-07-10 - Published: 2018-11-08 - Earliest claimed: 2015-02-27 - Assignees: Dropbox, Inc. - Applicants: Dropbox, Inc. - Inventors: Sang Tian; Joshua Kaplan; Devdatta Akhawe - Web page: https://patentgrep.com/patent/US20180322258A1 ## CPC - G06F 21/10: Protecting distributed programs or content, e.g. vending or licensing of copyrighted material (protection in video systems or pay television H04N7/16) {; Digital rights management [DRM]} - G06F 16/00: Information retrieval; Database structures therefor; File system structures therefor - G06F 16/955: using information identifiers, e.g. uniform resource locators [URL] - G06F 21/00: Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity - H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL} - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - G06F 2221/2101: Auditing as a secondary aspect - H04L 63/1483: {service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12)} - H04L 63/168: {above the transport layer} - H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP] - H04L 67/14: Session management (for real-time applications in data packet communications networks H04L65/1066) - H04L 2101/30: Types of network names - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Systems, methods, and computer-readable media for cross-application authentication on a content management system. A client application running at a client device that is not authenticated with a content management system can receive, from a website associated with the content management system, a request to authenticate with the content management system under a user account used to authenticate a current session between a browser application at the client device and the website with the content management system. The client application can then obtain a uniform resource locator (URL) with a nonce associated with the client application, and send a command to the browser application including the URL and nonce. The command can trigger the browser application to use the URL and nonce to authenticate the client application with the content management system under the user account with which the current session between the browser application and the website is currently authenticated. ## Claims ### Claim 1 A method comprising: establishing a communication channel through a content management system, between a client application at a client device and a website associated with the content management system, wherein establishing the communication channel comprises: sending, from the client application to the content management system, a message comprising a nonce that identifies an association between the client application and at least one of a browser application at the client device or a user account used by the client application to authenticate with the content management system, wherein the association enables the content management system to relay one or more communications between the client application and the website; when the browser application at the client device is not authenticated with the content management system, receiving, by the client application from the content management system via the communication channel, a request for the user account used by the client application to authenticate with the content management system; receiving, by the client application, an instruction to authenticate the browser application with the content management system under the user account; and sending, from the client application to the browser application, a command instructing the browser application to open a web page configured to trigger the browser application to authenticate with the content management system under the user account. ### Claim 2 (depends on 1) The method of claim 1, further comprising: after sending the message to the content management system, obtaining, by the client application from the content management system, a uniform resource locator (URL) associated with the web page, wherein the command triggers the browser application to use the URL and the nonce to authenticate with the content management system. ### Claim 3 (depends on 2) The method of claim 2, wherein the command triggers a script associated with the web page, wherein the script is configured to instruct the content management system to authenticate the browser application based on the nonce and validate a session associated with the browser application under the user account based on credentials used to authenticate a current session between the client application and the content management system. ### Claim 4 (depends on 1) The method of claim 1, wherein the command comprises an operating system (OS) command. ### Claim 5 (depends on 1) The method of claim 1, wherein the nonce is associated with a client identifier at the content management system, the client identifier being associated with at least one of the client application or the browser application. ### Claim 6 (depends on 1) The method of claim 1, wherein the request for the user account used by the client application to authenticate with the content management system is received by the client application from the website via the communication channel. ### Claim 7 (depends on 1) The method of claim 1, wherein the web page comprises a local web page file on the client device generated by the client application. ### Claim 8 A system comprising: one or more processors; and at least one computer-readable medium storing computer-readable instructions that, when executed by the one or more processors, cause the system to: establish a communication channel through a content management system, between a client application at a client device and a website associated with the content management system, wherein establishing the communication channel comprises: sending, from the client application to the content management system, a message comprising a nonce that identifies an association between the client application and at least one of a browser application at the client device or a user account used by the client application to authenticate with the content management system, wherein the association enables the content management system to relay one or more communications between the client application and the website; when the browser application at the client device is not authenticated with the content management system, receive, by the client application from the content management system via the communication channel, a request for the user account used by the client application to authenticate with the content management system; receive, by the client application, an instruction to authenticate the browser application with the content management system under the user account; and send, from the client application to the browser application, a command instructing the browser application to open a web page configured to trigger the browser application to authenticate with the content management system under the user account. ### Claim 9 (depends on 8) The system of claim 8, the at least one computer-readable medium storing computer-readable instructions that, when executed by the one or more processors, cause the system to: obtain, by the client application from the content management system, a uniform resource locator (URL) associated with the web page, wherein the command triggers the browser application to use the URL and the nonce to authenticate with the content management system. ### Claim 10 (depends on 9) The system of claim 9, wherein the command triggers a script associated with the web page, wherein the script is configured to instruct the content management system to authenticate the browser application based on the nonce and validate a session associated with the browser application under the user account based on credentials used to authenticate a current session between the client application and the content management system. ### Claim 11 (depends on 8) The system of claim 8, wherein the nonce is associated with a client identifier at the content management system, the client identifier being associated with the client application. ### Claim 12 (depends on 8) The system of claim 8, wherein the command comprises an operating system (OS) command. ### Claim 13 (depends on 8) The system of claim 8, wherein the request for the user account used by the client application to authenticate with the content management system is received by the client application from the website via the communication channel. ### Claim 14 (depends on 8) The system of claim 8, wherein the web page comprises a local web page file on the client device generated by the client application. ### Claim 15 A non-transitory computer-readable storage medium comprising: computer-readable instructions stored thereon, wherein the computer-readable instructions, when executed by one or more processors, cause the one or more processors to: establish a communication channel through a content management system, between a client application at a client device and a website associated with the content management system, wherein establishing the communication channel comprises: sending, from the client application to the content management system, a message comprising a nonce that identifies an association between the client application and at least one of a browser application at the client device or a user account used by the client application to authenticate with the content management system, wherein the association enables the content management system to relay one or more communications between the client application and the website; when the browser application at the client device is not authenticated with the content management system, receive, by the client application from the content management system via the communication channel, a request for the user account used by the client application to authenticate with the content management system; receive, by the client application, an instruction to authenticate the browser application with the content management system under the user account; and send, from the client application to the browser application, a command instructing the browser application to open a web page configured to trigger the browser application to authenticate with the content management system under the user account. ### Claim 16 (depends on 15) The non-transitory computer-readable storage medium of claim 15, storing additional computer-readable instructions that when executed by the one or more processors, cause the one or more processors to: obtain, by the client application from the content management system, a uniform resource locator (URL) associated with the web page, wherein the command triggers the browser application to use the URL and the nonce to authenticate with the content management system. ### Claim 17 (depends on 16) The non-transitory computer-readable storage medium of claim 16, wherein the command triggers a script associated with the web page, wherein the script is configured to instruct the content management system to authenticate the browser application based on the nonce and validate a session associated with the browser application under the user account based on credentials used to authenticate a current session between the client application and the content management system. ### Claim 18 (depends on 15) The non-transitory computer-readable storage medium of claim 15, wherein the nonce is associated with a client identifier at the content management system, the client identifier being associated with the client application. ### Claim 19 (depends on 15) The non-transitory computer-readable storage medium of claim 15, wherein the web page comprises a local web page file on the client device generated by the client application. ### Claim 20 (depends on 15) The non-transitory computer-readable storage medium of claim 15, wherein the request for the user account used by the client application to authenticate with the content management system is received by the client application from the website via the communication channel.