A bookmarklet is a bookmark stored in a web browser that contains one or more script commands to extend the browser's functionality. For example, a bookmarklet may allow the user to select text on a page, click the bookmarklet, and be presented with a search engine results page for the search term selected.
Bookmarklets are unobtrusive scripts stored as the URL of a bookmark in a web browser or as a hyperlink on a web page. Typical bookmarklets are designed to add one-click functionality to a browser or web page. When clicked, a bookmarklet may perform a function, one of a wide variety such as a search query, image extraction, text extraction, or similar ones. An example of bookmarklets is a clipper, which is a tool that generally runs on a web browser to enable “clipping” of content from a web page displayed by the web browser. In this context, clipping refers to the extraction or capture of the hypertext markup language (HTML), text and/or graphic elements from a web page to facilitate the storage of content for future access (e.g., reading, annotating, collecting) when not on the web site, and even off-line.
A web clipper may be associated with a specific destination application or storage. Functionality of a web clipper may often be provided by a developer of the destination application as a plug-in or add-on for a web browser. The user may be enabled to insert content from a web page easily into a document hosted by a client application.
This summary is provided to introduce a selection of concepts in a simplified form that are further described below in the Detailed Description. This summary is not intended to exclusively identify key features or essential features of the claimed subject matter, nor is it intended as an aid in determining the scope of the claimed subject matter.
Embodiments are directed to persistence of a bookmarklet through authentication of a user and authorization of the bookmarklet upon first activation. According to some examples, a bookmarklet provided through a browser or similar application on a client device may trigger authentication of a user activating it for the first time. Upon user authentication through one or more techniques, the bookmarklet may be authorized and its functionality made available. A bookmarklet identifier may be used to persist the bookmarklet functionality without re-authorization through the same instance of the browser or through different instances on the same client device.
These and other features and advantages will be apparent from a reading of the following detailed description and a review of the associated drawings. It is to be understood that both the foregoing general description and the following detailed description are explanatory and do not restrict aspects as claimed.
As briefly described above, a browser application may provide one or more bookmarklets or bookmarklets may be imported to the browser upon user action. Upon first time activation of the bookmarklet, the user may be authenticated and the bookmarklet authorized for that user and the client device. Using a bookmarklet identifier, the bookmarklet functionality may be persisted on the same client device without re-authorization indefinitely, for a predefined period, for a random period, or for a predefined number of uses allowing enhanced protection against malware that may attempt to access user resources through the bookmarklet.
In the following detailed description, references are made to the accompanying drawings that form a part hereof, and in which are shown by way of illustrations specific embodiments or examples. These aspects may be combined, other aspects may be utilized, and structural changes may be made without departing from the spirit or scope of the present disclosure. The following detailed description is therefore not to be taken in a limiting sense, and the scope of the present invention is defined by the appended claims and their equivalents.
While the embodiments will be described in the general context of program modules that execute in conjunction with an application program that runs on an operating system on a computing device, those skilled in the art will recognize that aspects may also be implemented in combination with other program modules.
Generally, program modules include routines, programs, components, data structures, and other types of structures that perform particular tasks or implement particular abstract data types. Moreover, those skilled in the art will appreciate that embodiments may be practiced with other computer system configurations, including hand-held devices, multiprocessor systems, microprocessor-based or programmable consumer electronics, minicomputers, mainframe computers, and comparable computing devices. Embodiments may also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules may be located in both local and remote memory storage devices.
Embodiments may be implemented as a computer-implemented process (method), a computing system, or as an article of manufacture, such as a computer program product or computer readable media. The computer program product may be a computer storage medium readable by a computer system and encoding a computer program that comprises instructions for causing a computer or computing system to perform example process(es). The computer-readable storage medium is a computer-readable memory device. The computer-readable storage medium can for example be implemented via one or more of a volatile computer memory, a non-volatile memory, a hard drive, and a flash drive.
Throughout this specification, the term “platform” may be a combination of software and hardware components to authorize a bookmarklet in a persistent manner. Examples of platforms include, but are not limited to, a hosted service executed over a plurality of servers, an application executed on a single computing device, and comparable systems. The term “server” generally refers to a computing device executing one or more software programs typically in a networked environment. However, a server may also be implemented as a virtual server (software programs) executed on one or more computing devices viewed as a server on the network. More detail on these technologies and example embodiments may be found in the following description.
According to some embodiments, a browser 108 executed on a client device 104 may receive content from a third party provider such a server 106 and display The server 106 may provide content such as documents, web pages, video, audio, and similar media for consumption by one or more applications executing in client devices or services provided by other servers. In an example scenario, a web page displayed on the client device 104 may include textual, graphic, audio, and/or video content.
Various bookmarklets may also be provided through the browser 108 to allow specific functionality associated with the displayed content such as performing searches, providing translations, mapping functionality, and content capture, among other functions. Bookmarklets may be activated through specific controls such as button 112 on the browser or other methods such as drop-down menus, performance of a specific action (e.g., selection of a portion of displayed content), etc.
In an example scenario, a user 102 may select a portion of the content 110 displayed by the browser 108. The portion of content 110 may be captured by a bookmarklet (also referred to as a “clipper”) as a clip to be stored and used for a variety of purposes. As the bookmarklet captures the portion of the content 110 as rendered by the browser 108, executable content associated with the portion of the content 110 may also be captured. The executable content may present security risks associated with execution of a malicious script since content displayed by the browser may come from a variety of sources.
Embodiments may prevent capture and execution of malicious content by the bookmarklet. A bookmarklet identifier stored, for example, as a cookie may be used in a combination process of authenticating the user and authorizing the bookmarklet such that the bookmarklet can be used repeatedly on the same client device without re-authorization.
Embodiments are not limited to an authentication and authorization scheme of the bookmarklet through a bookmarklet identifier. Other mechanisms may also be used to authorize the bookmarklet persistently employing the principles described herein. A cookie based mechanism may alternatively be used to authorize the bookmarklet. A cookie maybe associated with a user account that is validated against a stored user accounts within a trusted user account data store. The cookie may be used to authorize the bookmarklet and allow persistent use on the same client device.
As illustrated in diagram 200, a browser application 202 may provide one or more bookmarklets, which may be activated through dedicated controls such as button 204. The bookmarklets may provide a range of functionality associated with the displayed content 206 such as capture of content portions for storage or otherwise consumption. To prevent security concerns associated with malicious executables that may be captured by a bookmarklet along with a portion of the content, the bookmarklet may be persistently authorized through a user authentication and bookmarklet authorization process using a bookmarklet identifier.
As shown in diagram 200, a user may activate a bookmarklet through button 204 to perform an action associated with the displayed content 206. If this is the first activation of the bookmarklet, an authentication user interface 208 may be displayed for the user to authenticate themselves. As the user authenticates themselves, a bookmarklet identifier may be generated or retrieved from a local store and passed on to a next step in the process, where an authorization user interface 210 may be displayed to confirm the user's intent to activate the bookmarklet. Upon affirmative response by the user, the bookmarklet identifier may be used to persist the authorization of the bookmarklet, for example, in form of a cookie 212. Thus, after the first use, the user may activate and use the bookmarklet repeatedly on the same instance or on different instances of the browser application 202.
The persistence of the bookmarklet's authorization may be indefinite, for a predefined period, for a randomly selected period, or for a number of uses to provide additional security against malware. According to some embodiments, the authentication of the user may take many forms such as capture of user credentials including a user name, a password, a biological identifier, a secure token, and similar ones to authenticate the user. In response to validating the user against stored user credentials (or accounts) within a trusted user account data store, the user account may be associated with the bookmarklet identifier to authorize the bookmarklet. In some examples, the bookmarklet may be processed in a relay page that disallows rendering of frames to prevent execution of a malicious script potentially embedded within the content.
The bookmarklet identifier may be stored as a variable within a script code of the bookmarklet. The bookmarklet identifier may be stored as a secret. The bookmarklet identifier may also be stored as a secret from a third party provider hosting the content.
In some examples, upon determining that the bookmarklet lacks the authorized status, the authentication user interface (UI) may be presented to authenticate the user (e.g., first use). Following the authorization, the bookmarklet's authorization status may be determined based on the identifier (e.g., cookie 212) and the bookmarklet may be allowed to be activated by the browser application 202.
The bookmarklet identifier and a user account used to authorize the bookmarklet may be stored in a trusted cloud storage, for example. Alternatively, the bookmarklet and the user information may be stored as a cookie in the browser application.
Diagram 300 shows authorization of a bookmarklet similar to the process discussed in
Upon selection of the clipper activation 318, the user authentication user interface 308 may be displayed. Following authentication of the user, authorization user interface 310 may be displayed and the authorization of the clipper may be persisted through a clipper identifier, which may be numeric or alphanumeric, for example, in form of a cookie stored at the browser 302. The clipper identifier may be generated at the time of activation or a pre-assigned identifier may be used. In the latter case, the identifier may be generated by a trusted third party, by the content provider, or by the bookmarklet (clipper) source.
The example applications, devices, and modules, depicted in
Client devices 401-403 are used to access the functionality provided by the hosted service or application. One or more of the servers 406 or server 408 may be used to persistently authorize a bookmarklet. Relevant data may be stored in one or more data stores (e.g. data store 409), which may be managed by any one of the servers 406 or by database server 414.
Network(s) 410 may comprise any topology of servers, clients, Internet service providers, and communication media. A system according to embodiments may have a static or dynamic topology. Network(s) 410 may include a secure network such as an enterprise network, an unsecure network such as a wireless open network, or the Internet. Network(s) 410 may also coordinate communication over other networks such as PSTN or cellular networks. Network(s) 410 provides communication between the nodes described herein. By way of example, and not limitation, network(s) 410 may include wireless media such as acoustic, RF, infrared and other wireless media.
Many other configurations of computing devices, applications, data sources, and data distribution systems may be employed to authorize a bookmarklet in a persistent manner. Furthermore, the networked environments discussed in
The bookmarklet module 524 (a script) may operate in conjunction with the operating system 506 or the application 522 to provide bookmarklet functionality associated with content delivered by the application 522 (e.g., browser application). The bookmarklet may be authorized through authentication of the user upon first time activation and allowed to be used without re-authorization on the same machine. This basic configuration is illustrated in
Computing device 500 may have additional features or functionality. For example, the computing device 500 may also include additional data storage devices (removable and/or non-removable) such as, for example, magnetic disks, optical disks, or tape. Such additional storage is illustrated in
Computing device 500 may also contain communication connections 516 that allow the device to communicate with other devices 518, such as over a wireless network in a distributed computing environment, a satellite link, a cellular link, and comparable mechanisms. Other devices 515 may include computer device(s) that execute communication applications, other directory or policy servers, and comparable devices. Communication connection(s) 516 is one example of communication media. Communication media can include therein computer readable instructions, data structures, program modules, or other data in a modulated data signal, such as a carrier wave or other transport mechanism, and includes any information delivery media. The term “modulated data signal” means a signal that has one or more of its characteristics set or changed in such a manner as to encode information in the signal. By way of example, and not limitation, communication media includes wired media such as a wired network or direct-wired connection, and wireless media such as acoustic, RF, infrared and other wireless media.
Example embodiments also include methods. These methods can be implemented in any number of ways, including the structures described in this document. One such way is by machine operations, of devices of the type described in this document.
Another optional way is for one or more of the individual operations of the methods to be performed in conjunction with one or more human operators performing some. These human operators need not be collocated with each other, but each can be only with a machine that performs a portion of the program.
Process 600 begins with operation 610, “RECEIVE ACTIVATION REQUEST FOR BOOKMARKLET FUNCTIONALITY,” where the bookmarklet may be activated for the first time through activation of a dedicated control or selection of a portion of displayed content, for example.
Operation 610 is followed by operation 620, “AUTHENTICATE THE USER” where the user may be authenticated through a variety of methods. The authentication may be associated with a bookmarklet identifier.
Operation 620 is followed by operation 630, “AUTHORIZE THE BOOKMARKLET WITH BOOKMARKLET ID,” where the bookmarklet may be authorized for the authenticated user on the computing device and the bookmarklet functionality allowed to be used.
Operation 630 is followed by operation 640, “ALLOW BOOKMARKLET FUNCTIONALITY TO PERSIST USING THE BOOKMARKLET ID,” where the bookmarklet's authorization may be persisted such that the bookmarklet can be used on the same instance or on different instances of the browser (on the same machine) indefinitely, for a predefined period, for a randomly selected period, or for a predefined number of uses.
The operations included in process 600 are for illustration purposes. Persistent authorization of a bookmarklet, according to embodiments, may be implemented by similar processes with fewer or additional steps, as well as in different order of operations using the principles described herein.
The above specification, examples and data provide a complete description of the manufacture and use of the composition of the embodiments. Although the subject matter has been described in language specific to structural features and/or methodological acts, it is to be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or acts described above. Rather, the specific features and acts described above are disclosed as example forms of implementing the claims and embodiments.