Method and apparatus for protecting a single sign-on domain from credential leakage

An authentication server, comprising:

• means for providing an authentication cookie to a user browser client, wherein the authentication cookie has at least one user authentication credential for the single sign-on domain, and is associated with an authentication subdomain of the single sign-on domain;
• means for receiving the authentication cookie in an access request from the user browser client, wherein the access request is based on a redirection received by the user browser client from a content server within the single sign-on domain in response to a content request from the user browser client;
• means for responding to the access request, upon authentication of the user authentication credential in the received authentication cookie, by forwarding, to the user browser client, a limited-use cookie for the single sign-on domain;
• means for receiving a request from the content server to validate a session identifier of the limited-use cookie, wherein the content server received the limited-use cookie from the user browser client;
• means for providing, upon validation of the session identifier of the limited-use cookie, a valid session message to the content server for enabling the content server to forward requested content to the user browser client;
• and
• means for invalidating, upon validation of the session identifier of the limited-use cookie, the limited-use cookie to prohibit further use of the limited-use cookie.

An authentication server, comprising:

• a processor configured to:
• provide an authentication cookie to a user browser client, wherein the authentication cookie has at least one user authentication credential for the single sign-on domain, and is associated with an authentication subdomain of the single sign-on domain;
• receive the authentication cookie in an access request from the user browser client, wherein the access request is based on a redirection received by the user browser client from a content server within the single sign-on domain in response to a content request from the user browser client;
• respond to the access request, upon authentication of the user authentication credential in the received authentication cookie, by forwarding, to the user browser client, a limited-use cookie for the single sign-on domain;
• receive a request from the content server to validate a session identifier of the limited-use cookie, wherein the content server received the limited-use cookie from the user browser client;
• provide, upon validation of the session identifier of the limited-use cookie, a valid session message to the content server for enabling the content server to forward requested content to the user browser;
• and
• invalidate, upon validation of the session identifier of the limited-use cookie, the limited-use cookie to prohibit further use of the limited-use cookie.

A computer program product, comprising:

• non-transitory computer-readable medium, comprising:
• code for causing a computer to provide an authentication cookie to a user browser client, wherein the authentication cookie has at least one user authentication credential for the single sign-on domain, and is associated with an authentication subdomain of the single sign-on domain;
• code for causing a computer to receive the authentication cookie in an access request from the user browser client, wherein the access request is based on a redirection received by the user browser client from a content server within the single sign-on domain in response to a content request from the user browser client;
• code for causing a computer to respond to the access request, upon authentication of the user authentication credential in the received authentication cookie, by forwarding, to the user browser client, a limited-use cookie for the single sign-on domain;
• code for causing a computer to receive a request from the content server to validate a session identifier of the limited-use cookie, wherein the content server received the limited-use cookie from the user browser client;
• code for causing a computer to provide, upon validation of the session identifier of the limited-use cookie, a valid session message to the content server for enabling the content server to forward requested content to the user browser client;
• and
• code for causing a computer to invalidate, upon validation of the session identifier of the limited-use cookie, the limited-use cookie to prohibit further use of the limited-use cookie.