Patent ID: 8353036

Claim:
A system for protecting cross-domain interaction of a web application on an unmodified browser, the system comprising: a security framework created by a browser, wherein the security framework further includes: a component creator, configured to create components from a plurality of sources; and a supervision module configured to supervise and control scripts and codes executed during the creation of components, and invocation and interaction operations performed by various components after the creation of components; wherein the component creator is further configured to: obtain the scripts and codes of the component from a corresponding server, based on a component to be created; generate a random string for each created component as a token of the component, the token being usable for determining the identity of the component by the security framework; and place the created token and a security framework reference engine into the component; wherein the security framework further comprises a component repository configured to store the reference, token, host, and component name of each created component; and wherein the supervision module further comprises an Ajax request delegate configured to supervise and control Ajax requests of the components, thereby prohibiting direct cross-site Ajax requests, the supervising and controlling further comprising checking whether the target host in the Ajax request is the host that the component belongs to, allowing the Ajax request in response to the target host being the host that the component belongs to, and denying in response to the target host being not the host that the component belongs to.