US 11,811,760 B2
Sessionless validation of client connections while mitigating cookie hijack attacks
Ratnesh Singh Thakur, San Jose, CA (US); and Raghukrishna Hegde, Milpitas, CA (US)
Filed by Citrix Systems, Inc., Fort Lauderdale, FL (US)
Filed on Apr. 14, 2021, as Appl. No. 17/230,334.
Prior Publication US 2022/0337587 A1, Oct. 20, 2022
Int. Cl. G06F 7/04 (2006.01); H04L 9/40 (2022.01)
CPC H04L 63/0876 (2013.01) [H04L 63/083 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A method comprising:
receiving, by a device that is intermediary between a client and a server, a request from the client to establish a connection;
sending, by the device to the client, a cookie, the cookie generated according to a connection identifier and a shared counter;
receiving, by the device, a response from the client that includes a client validation cookie for validating the request, the client validation cookie generated according to the cookie;
determining, by the device, a candidate validation cookie according to a value of a plurality of values of a counter range of the shared counter identified according to a sliding window, that matches the client validation cookie; and
validating, by the device, the request responsive to the determination.