# US 8,789,204 B2 · Method and apparatus for secure cross-site scripting > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,789,204 B2 - Document ID: US8789204B2 - Status: Granted - Kind: B2 - Application number: 12/645,013 - Filed: 2009-12-22 - Published: 2011-06-23 - Granted: 2014-07-22 - Earliest claimed: 2009-12-22 - Assignees: Nokia Corporation - Applicants: Antti Mikael Helander; Tuomas Veli Keskitalo; Jyrki Tapani Laurila - Inventors: Antti Mikael Helander; Tuomas Veli Keskitalo; Jyrki Tapani Laurila - Web page: https://patentgrep.com/patent/US8789204B2 ## CPC - G06F 21/51: at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 63/168: {above the transport layer} - H04L 65/1069: Session establishment or de-establishment - H04L 65/1104: Session initiation protocol [SIP] - G06F 2221/2119: Authenticating web pages, e.g. with suspicious links - H04L 9/3226: {using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083)} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract An approach is provided for providing secure cross-site scripting. A web services platform causes, at least in part, reception of an initiation request from at least a first inline frame of at least one web page. The initiation request specifies a developer identifier associated with a domain of the at least one web page. The web services platform determines a callback resource identifier based on the developer identifier. The web services platform then determines to cause, at least in part, transmission of the callback resource identifier to the at least the first inline frame for use in creation of at least a second inline frame associated with the at least the first inline frame. ## Claims ### Claim 1 A method comprising: causing, at least in part, reception of an initiation request from at least a first inline frame of at least one web page, the initiation request specifying a developer identifier associated with a domain of the at least one web page; determining a callback resource identifier based on the developer identifier; and determining to cause, at least in part, transmission of the callback resource identifier to the at least the first inline frame for use in creation of at least a second inline frame associated with the at least the first inline frame. ### Claim 2 (depends on 1) A method of claim 1, wherein the initiation request further specifies a secure user identifier, the method further comprising: associating the initiation request with an account based on the secure user identifier; generating a token based on the secure user identifier; and determining to cause, at least in part, transmission of the token to the at least the first inline frame for use in the creation of the at least the second inline frame. ### Claim 3 (depends on 2) A method of claim 2, further comprising: causing, at least in part, reception of a user identifier and authentication information; generating the secure user identifier based on the user identifier and the authentication information; and determining to cause, at least in part, transmission of the secure user identifier to the at least one web page. ### Claim 4 (depends on 2) A method of claim 2, further comprising: causing, at least in part, reception of another request from the at least the first inline frame via a connection based, at least in part, on the token, wherein the request is for access to service data; and authenticating the token to allow access to the service data. ### Claim 5 (depends on 1) A method of claim 1, wherein the callback resource identifier further includes a revocation status of the developer identifier. ### Claim 6 An apparatus comprising: at least one processor; and at least one memory including computer program code, the at least one memory and the computer program code configured to, with the at least one processor, cause the apparatus to perform at least the following, cause, at least in part, reception of an initiation request from at least a first inline frame of at least one web page, the initiation request specifying a developer identifier associated with a domain of the at least one web page; determine a callback resource identifier based on the developer identifier; and determine to cause, at least in part, transmission of the callback resource identifier to the at least the first inline frame for use in creation of at least a second inline frame associated with the at least the first inline frame. ### Claim 7 (depends on 6) An apparatus of claim 6, wherein the initiation request further specifies a secure user identifier, and wherein the apparatus is further caused, at least in part, to: associate the initiation request with an account based on the secure user identifier; generate a token based on the secure user identifier; and determine to cause, at least in part, transmission of the token to the at least the first inline frame for use in the creation of the at least the second inline frame. ### Claim 8 (depends on 7) An apparatus of claim 7, wherein the apparatus is further caused, at least in part, to: cause, at least in part, reception of a user identifier and authentication information; generate the secure user identifier based on the user identifier and the authentication information; and determine to cause, at least in part, transmission of the secure user identifier to the at least one web page. ### Claim 9 (depends on 7) An apparatus of claim 7, wherein the apparatus is further caused, at least in part, to: cause, at least in part, reception of another request from the at least the first inline frame via a connection based, at least in part, on the token, wherein the request is for access to service data; and authenticate the token to allow access to the service data. ### Claim 10 (depends on 6) An apparatus of claim 6, wherein the callback resource identifier further includes a revocation status of the developer identifier. ### Claim 11 A method comprising: causing, at least in part, creation of an inline frame within a web page of a first domain associated with a developer identifier, wherein the inline frame is associated with a second domain; determining to cause, at least in part, transmission of the developer identifier to a platform associated with the second domain; causing, at least in part, reception at the inline frame of a callback resource identifier from the platform, wherein the callback resource identifier is determined based, at least in part, on the developer identifier; and causing, at least in part, creation of another inline frame within the inline frame, wherein the other inline frame is based, at least in part, on the callback resource identifier. ### Claim 12 (depends on 11) A method of claim 11, wherein the content of the other inline frame is associated with the first domain. ### Claim 13 (depends on 12) A method of claim 12, wherein the other inline frame includes service data, the method further comprising: causing, at least in part, accessing the service data at the web page of the first domain, wherein the service data includes a token for authenticating communications to the second domain. ### Claim 14 (depends on 12) A method of claim 12, further comprising: determining content information to send to the second domain; generating another resource identifier based, at least in part, on the token and the content information; and updating a location identifier of the inline frame with the other resource identifier to send the content information. ### Claim 15 (depends on 11) A method of claim 11, wherein the content of the other inline frame is associated with a third domain different from the first domain and wherein the other inline frame includes service data, the method further comprising: detecting an attempt to access the service data at the web page; and returning an error message associated with the attempt. ### Claim 16 An apparatus comprising: at least one processor; and at least one memory including computer program code, the at least one memory and the computer program code configured to, with the at least one processor, cause the apparatus to perform at least the following, cause, at least in part, creation of an inline frame within a web page of a first domain associated with a developer identifier, wherein the inline frame is associated with a second domain; determine to cause, at least in part, transmission of the developer identifier to a platform associated with the second domain; cause, at least in part, reception at the inline frame of a callback resource identifier from the platform, wherein the callback resource identifier is determined based, at least in part, on the developer identifier; and cause, at least in part, creation of another inline frame within the inline frame, wherein the other inline frame is based, at least in part, on the callback resource identifier. ### Claim 17 (depends on 16) An apparatus of claim 16, wherein the content of the other inline frame is associated with the first domain. ### Claim 18 (depends on 17) An apparatus of claim 17, wherein the other inline frame includes service data, and wherein the apparatus is further caused, at least in part, to: cause, at least in part, accessing the service data at the web page of the first domain, wherein the service data includes a token for authenticating communications to the second domain. ### Claim 19 (depends on 17) An apparatus of claim 17, wherein the apparatus is further caused, at least in part, to: determine content information to send to the second domain; generate another resource identifier based, at least in part, on the token and the content information; and update a location identifier of the inline frame with the other resource identifier to send the content information. ### Claim 20 (depends on 16) An apparatus of claim 16, wherein the content of the other inline frame is associated with a third domain different from the first domain and wherein the other inline frame includes service data, and wherein the apparatus is further caused, at least in part, to: detect an attempt to access the service data at the web page; and return an error message associated with the attempt.