Patent ID: 8448233
Filing Date: 2013-05-21
Classification: H04L

Abstract:
1. A method in a security gateway (SG), coupled between a hypertext transport protocol (HTTP) client and a web application server, for detecting web attacks, the method comprising: responsive to a first HTTP message being transmitted between the HTTP client and the web application server as part of an HTTP session, generating security gateway session security state information (SGI) based on a policy and the first HTTP message; generating a digital signature (SGS) from the SGI; creating an SG signed session security state information cookie (SGC) that includes the SGS and not the SGI; sending the SGC to the HTTP client for storage instead of storing the SGI in the SG, wherein the HTTP client should return the SGC as part of a next HTTP request transmitted from the HTTP client to the web application server as part of the HTTP session; and responsive to a second HTTP message being transmitted from the HTTP client to the web application server as part of the HTTP session, attempting to validate a claim made in the second HTTP message using at least the policy and the SGC that is supposed to be returned with the next HTTP request.