Citrix Systems, Inc.

Raghukrishna Hegde

Ratnesh Singh Thakur

Daniel George Wing

Arkesh Kumar

Nivedita Jagdale

Ramachandra Kasyap Marmavula

Joseph Hoelbrandt

Girish Chandra Padhi

Described embodiments provide systems and methods for morphing or regenerating validation information. A client can receive, via a device, an authentication cookie for access to a server. The device may maintain a sequence number and a cryptographic secret. The client may use the cryptographic secret and a cookie engine to generate validation cookie information with an updated sequence number. The client may send the authentication cookie to the device via a hypertext transfer protocol (HTTP) message to validate the authentication cookie. The client may send the validation cookie information with the updated sequence number to the device via a HTTP message to validate the authentication cookie.

Preventing HTTP cookie stealing using cookie morphing

Described embodiments provide systems and methods for validating connections while mitigating cookie hijack attacks. A device intermediary between a client and a server can receive a request from the client to establish a connection. The device may send a cookie to the client, the cookie generated according to a connection identifier and a shared counter. The device may receive a response from the client that includes a client validation cookie for validating the request. The client validation cookie may be generated according to the cookie. The device may determine a candidate validation cookie according to a value of a counter range of the shared counter, that matches the client validation cookie. The device may validate the request responsive to the determination.

Sessionless validation of client connections while mitigating cookie hijack attacks

Growing community of inventors

Milpitas, CA, United States of America

Raghukrishna Hegde