Patent ID: 8341200
Filing Date: 2012-12-25
Classification: H04L

Abstract:
1. A method of protecting a Web application against attacks from malicious client-side code in a first shared file of a first application instance of the Web application, as the first shared file is downloaded by the Web application to a user's browser in a response to a download request from the user's browser, the method comprising: the user's browser sending the download request to the Web application, the download request specifying, as a Web address of a file to be downloaded, a user file URL of the first shared file, the user file URL having a hostname portion that includes a differentiating string not found in hostname portions of application page URLs, the hostname portion of the user file URL of the first shared file further including a reference to the first application instance; and the Web application downloading the first shared file to the user's browser, malicious client-side code in the first shared file being prevented by a same-origin policy enforced by the user's browser from accessing content of application pages of the Web application, as a result of application pages having a different origin than the first shared file due to the presence of the differentiating string in the hostname portion of the user file URL of the first shared file, and said malicious client-side code being further prevented from accessing content of shared files of other application instances of the Web application, as a result of the first shared file having a different origin than shared files of other application instances due to the presence of the reference to the first application instance in the hostname portion of the user file URL of the first shared file.