We are using a program that runs on the client machine to control its devices (scanner, printer, etc).
On the server side, a .net website generates javascript to call methods of that program using cross-domain.
A schema will explain it better, the command request and response is in red:
Problem comes when we talk about security, any website (which does not belong to us) could use cross-domain to call our program and possibily execute anything.
I have no idea how to make it secure, we would like to make sure the command has been initiated by our servers.
Is there any already existing pattern for this kind of security behaviour ?
If not, any suggestion is welcome.
When the client browser connects it can get a token(SSL?) from the company lan, which could be passed to the executable. executable then sends token to company lan for verification.