PLUGIN AUTHORIZATION WORKFLOW FOR WEB APPLICATIONS

A plugin authorization workflow for web applications is described. A plugin makes a request for an authorization token. An authorization provider module receives the request and displays a user interface (UI) to receive an input for approving execution of the plugin. A target authorization system receives the approval and generates an authorization code which is communicated to the authorization provider module and back to the plugin. The plugin directly calls the target authorization system with the authorization code. In return, the target authorization system sends an authorization token back to the plugin allowing execution of the plugin.

BACKGROUND

Web applications have been developed to support functionality in a cloud-based environment. Examples of web applications include office tools such as spreadsheets and word processors, design tools such as computer aided design (CAD) tools, drawing tools, and photo and video editing tools, and so on.

Plugins have been developed to expand functionality and usefulness of web applications. Conventional techniques used to authorize plugins for use as part of web applications, however, expose the web applications to potentially malicious behavior. Conventional techniques, for instance, disrupt behavior of the web application and limit an ability to incorporate the plugin as part of the web applications, which hinders functionality of the web applications, computing devices that implement the web applications, and so on.

SUMMARY

A plugin authorization workflow for web applications is described. To do so in one example, a plugin makes a request for an authorization token. An authorization provider module receives the request and displays a user interface (UI) to receive an input for approving execution of the plugin. A target authorization system receives the approval and generates an authorization code which is communicated to the authorization provider module and back to the plugin. The plugin directly calls the target authorization system with the authorization code. In return, the target authorization system sends an authorization token back to the plugin allowing execution of the plugin.

DETAILED DESCRIPTION

Overview

Plugins (i.e., plugin modules) are employed by web applications (e.g., browsers, network-enabled applications) as a straightforward way to expand functionality available via the web applications to enrich a user's experience. Examples of the use of plugins include provisioning of additional functions, components, tools, or additional content as part of a web application. In a first example of a conventional technique, plugins are embedded into an existing web page. However, such a simplistic embedding does not support control over operation of the plugin. Consequently, the plugin may cause output of a popup menu, resize windows, or cause unauthorized use of other applications such as video players, etc. Thus, this lack of control is exploitable by malicious parties.

In a second example, plugins are implemented as an inline frame (iframe). An iframe is a web page element configured to load another HTML element into the web page. In this way, the iframe provides a mechanism to embed content or functionality of a plugin into an existing web page. The iframe is also used to provide separation between execution of the web application and execution of the plugin. The iframe, for instance, is usable to restrict access by framed content within the iframe to a web application's domain or data that is stored locally. As well, the iframe is also configured to restrict embedded content from arbitrarily editing other portions on a web page but rather is limited to edits within the iframe's outline. However, separation provided by the iframe is not suitably robust in some real world situations because various types of malicious behavior by the plugin are still possible like unwanted autoplaying of videos and popups within the iframe as well as others.

For added control, a “sandbox attribute” is added to the iframe. The sandbox attribute limits execution of the plugin within the iframe as described above. This ability supports greater control by the web application and helps to avoid risks from malicious parties. For example, in the iframe example given above, addition of the sandbox attribute has the capability to prevent malicious autoplaying of videos and malicious popups.

Conventional techniques used to implement sandbox attribute of the iframe, however, often impede an ability for a plugin to receive authorizations in a conventional authorization workflow in real world scenarios. For example, plugin developers wishing to implement a plugin for the web application are not able to implement a conventional authorization process. This is because the restrictions imposed by the sandboxed iframe prevent conventional authorization processes due to conventional limitations of execution within the sandboxed iframe. To address this in conventional techniques, plugin developers are tasked with creating a dedicated backend authorization service.

To address these technical challenges, an authorization workflow is described that supports execution of a plugin in conjunction with a web application. The authorization workflow provides a plugin with an application programming interface (API) as part of the plugin software development kit (SDK). The software development kit is usable to integrate the API into a corresponding plugin. The API supports output of a user interface (UI) to the authorization workflow to support user authentication via a user interface, e.g., by supplying a username and password.

The API then sends the authorization request to a target authorization system where the plugin has been registered as an authorized plugin. If the plugin has been registered with the target authorization system and the authorization request identifies the plugin as the registered plugin, the target authorization system returns an authorization code to the plugin via a redirect web application. The redirect web application is added to the web application to ensure that the authorization code is sent back to the plugin and not to a malicious server. Once the plugin receives the authorization code, the plugin requests an authorization token, using the authorization code, directly from the authorization system. When the plugin is run and it has already obtained the authorization token, the token is passed to the web application in a request header authorization which allows its use by the web application.

Generally, the authorization code is obtained by using the target authorization system as an intermediary between the client and the plugin developer. The plugin developer pre-registers the plugin with the target authorization system. Instead of requesting authorization directly from the plugin developer, the client is directed to the target authorization system by the web application, which sends the authorization code back to the client. Because the plugin is limited to authentication with the target authorization system, the plugin developer's credentials are not shared with the client. With the authorization code, the plugin then requests the authorization token directly from the target authorization system. The authorization code provides security benefits, such as the ability to authenticate the client, as well as the transmission of the access token directly to the client without passing it through the web application and potentially exposing it to others.

Using this framework, the plugin developer is not tasked with creating its own backend authorization workflow. Rather, the developer leverages the plugin API which is part of the web application's SDK. Systems and processes for carrying out the authorization workflow using the plugin API and the redirect web application are described in greater detail below.

Example Environment

FIG.1is an illustration of a digital medium environment100in an example implementation that is operable to employ plugin authorization workflow techniques described herein. The illustrated digital medium environment100includes a service provider system102, a client device104, and a target system106that are communicatively coupled, one to another, via a network108. Computing devices that implement the service provider system102, the client device104, and the target system106may be configured in a variety of ways.

A computing device, for instance, may be configured as a desktop computer, a laptop computer, a mobile device (e.g., assuming a handheld configuration such as a tablet or mobile phone), and so forth. Thus, computing devices may range from full resource devices with substantial memory and processor resources (e.g., personal computers, game consoles) to a low-resource device with limited memory and/or processing resources (e.g., mobile devices). Additionally, although a single computing device is shown in some instances, a computing device may be representative of a plurality of different devices, such as multiple servers110utilized by many to perform operations “over the cloud” by running containers or virtual machines.

The service provider system102includes a service manager module112configurable to coordinate services executed by the service provider system102. One such service executed by the service provider system102is illustrated as an application manager module114. The application manager module114is representative of functionality to retrieve and manage execution of a web application118from a storage medium116. The web application118is configurable as any of a variety of web applications such as but not limited to word processors, design and drawing tools, photo and video editing tools, sound editing tools, communications platforms, shopping carts, social networking apps, file conversion tools, file scanning apps, email programs, etc.

The application manager module114also includes an authorization management system120. The authorization management system120is configured to coordinate an authorization process for plugins (e.g., add-ons) to the web application118. The authorization management system120, as illustrated, includes an authorization provider API122, an authorization provider module124, and an authorization redirect application126. The authorization management system120is utilized as part of the plugin authorization workflow in support of simplifying authorization of plugins (e.g., addons and applications from third parties) that are to be embedded in the web application118.

The client device104is representative of a computing device which as stated above is configurable in any of a variety of forms including, but not limited to personal, desktop, and mobile computing devices. The client device104includes a communication module128which is representative of functionality to support wired or wireless connections that are configured to provide communications between the client device104and other devices communicating over the network108. A frame130is representative of a web browser window or other application for accessing the web application118. A protected frame132is embedded in the frame130which is configurable, but is not limited to, an iframe as described above.

The authorization provider API122provides a user interface, via which, inputs are received for registration of plugins. The authorization provider module124, in one or more examples, is provided as part of a plugin SDK and is configurable to include, among other elements, a plugin API that provides plugin data and receives login information as part of the plugin authorization workflow. The authorization redirect application126is configured to be embedded in web application118in support of uniform resource locator (URL) redirection of authorization codes. The authorization redirect application is configured to aid in preventing redirection attacks and other malicious redirection behavior because the authorization code is provided to the plugin.

The protected frame132supports sandbox attributes. The sandbox attributes are configured to restrict execution of the plugin134by the client device104within the web application118. A plugin API136is provided with a plugin SDK. The plugin API136is configured to request an authorization code. In accordance with various illustrative examples, the plugin API136specifies any of, but not limited to, a target authorization URL, an authorization type (e.g., Plain, PKCE, Secret, etc.), a client ID, a response type (e.g., authorization code), scope (additional access requested by the plugin), or a challenger code. Once the plugin134is authorized in the authorization process described herein, digital content138is used by web application118and plugin134, the digital content residing in a storage medium140which is local or remote.

As part of the plugin authorization workflow, the plugin API136is configured to request authorization from a target authorization system150to verify the pre-registration of the plugin with the target authorization system150and to allow use of the plugin with the web application118. The target authorization system150includes a plugin manager module152which is configured to manage the registration of plugins for the web application118. The target authorization system150also includes a target authorization module154configurable to control the sending and receiving of authorization codes156, check for acceptance or rejection of authorization requests, and send and receive authorization tokens158. The authorization codes156and authorization tokens158are stored and retrieved from a storage medium160which are local or remote. Further discussion of these and other examples are included in the following section and shown in corresponding figures.

Generally, in operation, the web application118(e.g., executing on the servers110and within the frame130of the client device104), initiates execution of the plugin134within the protected frame132. The plugin API136sends an authorization request to the target authorization module154of the target authorization system150. Upon approval, the target authorization module154returns the authorization code156to the authorization redirect application126which assures that the authorization code156is sent to plugin134. The plugin134sends the authorization code156directly to the target authorization module154which returns the authorization token158directly back to plugin134so that the plugin134is authorized for operation within the frame130embedded in the web application118. In this way, the plugin authorization workflow avoids the third-party development of backend authorization processes for each plugin, which is discussed with reference to the additional figures and described in more detail herein, so that third-party developed plugins can be used with web applications with much greater security without adding plugin development complexity.

In general, functionality, features, and concepts described in relation to the examples above and below may be employed in the context of the example procedures described in this section. Further, functionality, features, and concepts described in relation to different figures and examples in this document may be interchanged among one another and are not limited to implementation in the context of a particular figure or procedure. Moreover, blocks associated with different representative procedures and corresponding figures herein may be applied together and/or combined in different ways. Thus, individual functionality, features, and concepts described in relation to different example environments, devices, components, figures, and procedures herein may be used in any suitable combinations and are not limited to the particular combinations represented by the enumerated examples in this description.

Authorization Code Request

FIG.2depicts a sub-process of the web application plugin authorization process in accordance with an illustrative example. The sub-process depicted is an authorization code request process which is part of the overall plugin authorization workflow. In some examples, the plugin SDK for the web application118supports OAuth 2.0 PKCE authorization however, other known and to be developed authorization algorithms are also usable. The illustrated sub-process begins with the plugin134, which is executed within the protected frame132. The plugin134initiates an authorization request (arrow210) via the plugin API136.

The protected frame132, is configurable as an iframe with sandbox attributes embedded in the web application118. The plugin134is developed, at least in part, using a software development kit (SDK) provided by the web application118. The SDK defines a plugin API136. Prior to first use, plugin134registers with the target authorization system150using the authorization redirect application126. As the plugin134is loaded, a pop-up window216is output that is configured to receive user credentials using the plugin API136. The plugin API136is used to check whether the plugin134is already authorized for use. If the plugin134is not authorized, the plugin API136issues a call-to-action in the pop-up window216, such as but not limited to an offer to setup an account, payment of a license fee, and so forth.

Upon verification of registration of the plugin134, the plugin134is executed to generate an authorization code request215configured to request an authorization code using the plugin API136. The authorization code request215, for instance, is configurable to include a target authorization system uniform resource locator (URL), an authorization type (e.g., Plain, PKCE, secret, etc.), a client identifier (ID), a response type (e.g., code), a scope (e.g., additional access requested by the plugin134), a challenger code, and so on.

The plugin API136is configured to send the authorization code request215to an authorization provider API122(arrow220) of the authorization management system120. The authorization provider API122is used to pass the authorization code request215to an authorization provider module124(arrow230). In response, the authorization provider module124generates a pop-up window226, e.g., for communication back to the client device104. The pop-up window226is configured to receive inputs to approve the request, e.g., which is performed upon receipt of user credentials as part of a login. The authorization provider module124, upon receipt of the user credentials, directs the authorization code request to a URL of a target authorization module154(arrow240) of the authorization system150. The target authorization system150processes the authorization code request215and approves or rejects the request.

Authorization Code Redirect

FIG.3depicts an authorization code redirect sub-process of the web application plugin authorization process in accordance with an illustrative example. If the authorization code request215is approved by the target authorization system150, an authorization code redirect sub-process depicted inFIG.3begins by the target authorization module154of the target authorization system150sending the authorization code and authorization state to an authorization redirect application126(arrow310).

The authorization redirect application126is configured to avoid malicious behavior, such as but not limited to open redirection attacks, which can be used to redirect the authorization code to a malicious URL. The authorization redirect application126sends the authorization code to the authorization provider module124(arrow320) which in turn passes the authorization code to the authorization provider API122(arrow330). The authorization provider API122sends the authorization code to the plugin API136(arrow340) and to the plugin134(arrow350).

Authorization Token Request

FIG.4depicts an authorization token request sub-process of the web application plugin authorization process in accordance with illustrative examples. Once the plugin134has received the authorization code, the plugin134sends a request for an authorization token with the authorization code directly to the target authorization module154(arrow410) of target authorization system150. The target authorization system150identifies the authorization code as valid, and in response, sends back the associated authorization token directly by HTTP service (arrow420). The plugin134then sends the authorization token to the plugin API136(arrow430) which includes functionality for storing the authorization token. The plugin134then uses the plugin API136to selectively retrieve the authorization token whenever the plugin134is to be used with the web application118.

Plugin Authorization Process

FIG.5depicts the plugin authorization process as exemplified inFIGS.2-4. The example plugin authorization process depicted and described is a variation of an OAuth workflow in part with the addition of the functionality of the plugin API136, the authorization provider module124and authorization provider API122, and the authorization redirect application126. The addition of these functional elements provides the ability for a uniform implementation of plugins134such that plugin developers are not tasked with creating their own back-end authorization service to circumvent any restrictions imposed by the protected frame132. Other authorization workflows may be used and similarly adapted for the restrictions imposed by protected frame132such as but not limited to MIRACL, Fusion Auth, and so on. Plugins134include any of a variety of programs and are sometimes referred to as add-ons and add-on programs. Various types of code structures and challenge codes can be used without departing from the scope of the disclosure.

User Interfaces

FIG.6depicts an example user interface (UI) displayed on a display device600of the client device104. The UI includes the web application118. During the web application plugin authorization process, the pop-up window216includes a user identification input field602and a password input field604for logging into the user's account with the plugin provider. A submit button606and a cancel button608are provided for continuing the login process (using the submit button606) or ending the login process (using the cancel button608), respectively. A Forgot Password link610is provided for the case in which the user decides to change the password because it was forgotten or has become inadvertently known by others. A New Account link612is used if the user does not yet have an account with the plugin provider.

The pop-up window226appears similar to the depicted pop-up window216but allows users to log into the web application provider account to approve the authorization request. The UI depicted on the display device600is an example of a user interface that may be used to carry out the login function. Other UI's with various looks, fields, and user interactive elements may be used without departing from the scope of the disclosure.

Plugin Authorization Processes

FIG.7depicts an example process700applied to authorization of a plugin for a web application. The plugin is executed in a protected frame such as but not limited to an iframe and in some examples a sandboxed iframe. The process700starts by generating a request for an authorization token by a plugin (block702). The plugin has been previously registered and is known by a target authorization system in this example. The process700also includes causing, responsive to the plugin request, display of a user interface (UI) executed by an authorization provider module, the user interface configured to receive an input approving execution of the plugin (block704).

Further, the process700includes communicating, by the processing device, the input approving execution of the plugin for receipt by the target authorization system, the input configured to cause the target authorization system to generate an authorization code for communication to the authorization provider module (block706). Once the authorization code is generated the process700proceeds by receiving the authorization code at the plugin from the authorization provider module (block708).

At this point, the target authorization system identifies and approves the use of the pre-registered plugin and process700then proceeds by generating a call to the target authorization system. The call includes the authorization code (block710). The call is performed directly to the target authorization system by HTTP request which returns with the authorization token. Process700then includes receiving the authorization token from the target authorization system (block712).

At this point the use of the plugin has been fully authorized and the process700includes executing the plugin using the authorization token (block714). In accordance with various illustrative examples the authorization token may be stored locally and accessed locally such that the plugin may then be repeatedly used, by the user as they access the web application.

FIG.8depicts an example process800that is executed by a processing device for approval of a prior registered plugin for use with a web application in a protected frame. The process800includes receiving an input approving execution of a plugin, the input received via a user interface (block802). The process800includes communicating the input for receipt by the target authorization system, the input configured to cause the target authorization system to generate an authorization code for communication to the authorization provider module (block804).

The process800also includes receiving the authorization code at the plugin from the authorization provider module (block806). Since the target authorization system has authorized use of the plugin, the plugin is not operable until it receives an authorization token. Process800further includes generating a call to a target authorization system, the call including the authorization code (block808). The call is made directly from the plugin to the target authorization system and the process800still further includes receiving the authorization token from the target authorization system (block810) and executing the plugin based on the authorization token (block812).

FIG.9depicts a non-transitory computer-readable storage medium that stores executable instructions, which when executed by a processing device, cause the processing device to perform operations900. The operations are carried out for the authorization of a plugin to a web application, the plugin being embedded in the web application in a protected frame. The operations include but are not limited to registering a plugin associated with a target authorization system using an authorization redirect application (block902) and retrieving a client identifier via a plugin application programming interface of an authorization provider module (block904).

The operations also include receiving, by the authorization provider module, a request for an authorization token by the plugin (block906) and causing, in response to the request, display of a user interface received from a target authorization system by the authorization provider module, the user interface configured to receive an input approving execution of the plugin (block908).

The operations further include communicating the input approving execution of the plugin for receipt by the target authorization system, the input configured to cause the target authorization system to generate an authorization code for communication to the authorization provider module (block910) and sending the authorization code to the plugin from the authorization provider module, the authorization code enabling receiving an authorization token from the target authorization system by the plugin (block912).

Example System and Device

FIG.10illustrates an example system that includes an example computing device, client device104that is representative of one or more computing systems and/or devices that may implement the various techniques described herein. This is illustrated through inclusion of the browser which is an example implementation of frame130. Frame130includes the protected frame132in which the plugin134is executed. The client device104may be, for example, a server of a service provider, a device associated with a client (e.g., a client device), an on-chip system, and/or any other suitable computing device or computing system. The target authorization system is also represented as a server in the cloud for authorizing plugins such as the plugin134.

Combinations of the foregoing may also be employed to implement various techniques described herein. Accordingly, software, hardware, or executable modules may be implemented as one or more instructions and/or logic embodied on some form of computer-readable storage media and/or by one or more hardware elements1010. The client device104may be configured to implement particular instructions and/or functions corresponding to the software and/or hardware modules. Accordingly, implementation of a module that is executable by the client device104as software may be achieved at least partially in hardware, e.g., through use of computer-readable storage media and/or hardware elements1010of the processing system1004. The instructions and/or functions may be executable/operable by one or more articles of manufacture (for example, one or more client devices104and/or processing systems1004) to implement techniques, modules, and examples described herein.

The techniques described herein may be supported by various configurations of the client device104and are not limited to the specific examples of the techniques described herein. This functionality may also be implemented all or in part through use of a distributed system, such as over a “cloud” network108via a service provider system102as described below.

The service provider system102is configurable on any of a variety of servers, cloud servers, or the like running web application118and accessible over the network108. The service provider system102abstracts underlying functionality of hardware (e.g., servers) and software resources of the network108. The web application118may include applications and/or data that can be utilized while computer processing is executed on servers that are remote from the client device104. Web application118can also include services provided over the Internet and/or through a subscriber network, such as a cellular or Wi-Fi network.

The service provider system102may abstract resources and functions to connect the client device104with other computing devices. The service provider system102may also serve to abstract scaling of resources to provide a corresponding level of scale to encountered demand for the web application118that are implemented via the service provider system102. Accordingly, in an interconnected device example, implementation of functionality described herein may be distributed throughout the system. For example, the functionality may be implemented in part on the client device104as well as via the service provider system102that abstracts the functionality of the network108.

CONCLUSION