CN108833518A - A method of generating session ID based on nginx server - Google Patents

Abstract

The invention provides a method for generating a session ID based on an nginx server, comprising: generating a non-repetitive sequence inside the cluster; placing the session ID on multiple Redis clusters, embedding the ID of the Redis node into the session ID; embedding the validity period into the session ID; Convert the data into base64 format; use the verification code and the numerical part to form a session ID; receive the session ID from the client, and use an algorithm to verify whether the ID is within the validity period, whether it is forged, and whether it is valid. The invention realizes the generation and verification function of the session ID on Nginx, reduces the internal network overhead of the system, reduces the pressure of the back-end application server, reduces hardware consumption, improves the system throughput, and realizes the rational utilization of resources.

Description

A method of generating session ID based on nginx server

technical field

The invention relates to the technical field of Web development, and relates to a method for generating a session ID based on an nginx server.

Background technique

Nginx is a high-performance HTTP server and reverse proxy server. It is used by a large number of Internet companies such as Taobao, Netease, and Sina.

Now there is a demand in development, the system needs to provide a session ID for tracking users, so that it is convenient to analyze user behavior and do A/B testing. In a typical distributed solution, it is the responsibility of the back-end application server to generate and verify session IDs. Nginx calls the back-end application server through the interface to complete session ID generation and verification. There are many calling links in this solution, the internal network overhead of the system is large, and a lot of hardware resources are required.

Contents of the invention

In order to solve the above problems, the present invention discloses a method for generating a session ID based on an Nginx server, which can quickly generate a session ID that is not easy to be forged in the form of a corresponding plug-in for nginx.

In order to achieve the above object, the present invention provides the following technical solutions:

A method for generating a session ID based on an nginx server, comprising the steps of:

Step 1: A non-repeating sequence is generated inside the cluster, the sequence includes: nginx instance ID, timestamp, counter, and the nginx instance ID is unique;

Step 2, use the CRC32 algorithm to operate on the sequence generated in step 1 to obtain an integer result, which is modulo operation with the number of Redis nodes, and the obtained result is used as the Redis node ID;

Step 3, write the validity period into the session ID;

Step 4, concatenate the sequence, Redis node ID, and validity period, and use the Base64 algorithm to perform calculations to obtain the numerical part of the session ID;

Step 5: Concatenate the numerical part of the session ID, the User-Agent of the client, the client IP, and the server-side password, and then sort them in ascending order of characters, and finally use the MD5 algorithm to perform calculations, and the calculation results are check codes;

Step 6: Concatenate the numerical part of the session ID generated in step 4 with the verification code generated in step 5 to obtain the final session ID.

As an improvement, it also includes a session ID verification method, including the following process:

When receiving the request from the client, intercept the 128Bit check code at the end of the session ID, and the rest is the numerical part of the session ID; use the Base64 algorithm to decode the numerical part of the session ID, and perform the following operations on the decoded data:

Check if the session ID has expired:

Take the 1st to 40th digits to calculate the effective time;

Take out the 69th to 76th digits and calculate the validity period;

If the effective time + validity period < current time, the session expires;

Check whether the session ID has been forged or tampered with:

Splice the numerical part of the session ID with the client IP and client User-Agent, calculate the MD5 code, and compare the result with the verification code in the session ID to determine whether they are the same; if they are the same, the session ID is correct; if not If the same, it means that the session ID is forged or tampered with, and an error is thrown;

Verify session ID validity:

Intercept the 65th to 68th bits to obtain the Redis node ID. According to the Redis node ID, query the session ID from the corresponding Redis storage node. If the data is queried, the session ID is valid; otherwise, the session ID is invalid.

Furthermore, the current value of the counter is stored in the shared memory, and all Worker processes on a single Nginx server share the counter.

Compared with the prior art, the present invention has the following advantages and beneficial effects:

The invention realizes the generation and verification function of the session ID on Nginx, reduces the internal network overhead of the system, reduces the pressure of the back-end application server, reduces hardware consumption, improves the system throughput, and realizes the rational utilization of resources.

Description of drawings

Fig. 1 is a flow chart of generating a session ID.

Fig. 2 is a flow chart of verification performed by the server after receiving the session ID transmitted from the client.

Detailed ways

The technical solutions provided by the present invention will be described in detail below in conjunction with specific examples. It should be understood that the following specific embodiments are only used to illustrate the present invention and are not intended to limit the scope of the present invention. In addition, the steps shown in the flow diagrams of the figures may be performed in a computer system, such as a set of computer-executable instructions, and, although a logical order is shown in the flow diagrams, in some cases, the sequence may be different. The steps shown or described are performed in the order herein.

The generation method that the Nginx server that the present invention provides generates session ID, as shown in Fig. 1, Fig. 2, specifically comprises the following steps:

Step 1, non-repeated sequence generation scheme within the cluster:

The sequence consists of the following elements: nginx instance ID, timestamp (millisecond level), counter.

field name length timestamp 40bit nginx instance ID 4bit counter 20bit

The calculation method of the timestamp is: current time - January 1, 2016 at 00:00:00:00. 40bit stored data can be supported until 2050;

The length of the Nginx instance ID is 4 bits, and the ID range is [0,15]. Support up to 16 nginx; assign a unique ID to each nginx server in the cluster, and use this ID as part of the sequence.

A counter is combined in the sequence to ensure the uniqueness of the sequence. The length of the counter is 20bit, and the range is [0,1048575], that is, a maximum of 1.04 million IDs can be produced per millisecond. When the counter reaches the upper limit, wait 1 millisecond. Then clear and recalculate. The current value of the counter is kept in shared memory. All Worker processes on a single Nginx server can share this counter.

Step 2: Put the session ID on multiple Redis clusters. Embed the ID of the Redis node into the session ID. In the case of large data, by extracting the storage node ID embedded in the session ID, you can directly query the corresponding Redis database according to the node ID. You can Improve the query efficiency of session ID.

By using the CRC32 algorithm to operate the sequence generated in step 1, an integer result can be obtained, and the result is modulo operation with the number of Redis nodes, and the obtained result is the Redis node ID.

The Redis node ID format is:

field name length Redis node ID 4bit

Step 3, write the validity period into the session ID to reduce the memory overhead of the server.

The validity period format is:

field name length Ranges type 2bit 0-minute; 1-hour; 2-day; 3-month value 6bit 0～64

A total of 8 bits.

The ranges that can be represented are:

1 to 64 points

1 to 64 hours

1 to 64 days

1 to 64 months

for example:

validity period binary integer 1 minute 00000001 1 5 minutes 00000101 5 1 hour 01000001 65 8 hours 01001000 72 1 day 10000001 129 2 days 10000010 130 7 days 10000111 135 January 11000001 193

Step 4, generate the numerical part of the session ID.

Concatenate the sequence, Redis node ID, validity period, and use the Base64 algorithm to obtain the numerical part of the session ID. This step converts the data into base64 format, which can reduce the length of the session ID.

Step five, generate a verification code.

Concatenate the numerical part of the session ID, the client's User-Agent, the client's IP, and the server's password, then sort in ascending order of characters, and finally use the MD5 algorithm to perform calculations, and the calculation result is the check code. Using a verification code can prevent the session ID from being forged.

Step 6, generate a session ID.

The final session ID is obtained by splicing the numerical part of the session ID generated in step 4 and the verification code generated in step 5.

After the session ID is generated, it is stored in the Redis database corresponding to mod_x. After the session ID is successfully stored, it is returned to the client.

Step seven, verify the session ID sent by the client.

When receiving the request from the client, intercept the 128Bit check code at the end of the session ID, and the rest is the numerical part of the session ID.

On nginx, the following checks can be directly performed on the session ID:

1. Is the session ID expired?

2. Whether the session ID has been tampered with or forged.

Verification method:

First, use the Base64 algorithm to decode the numerical part of the session ID, and the following bit operations are performed on the decoded data.

1. Check whether the session ID has expired

Take the 1st to 40th digits to calculate the effective time; take out the 69th to 76th digits to calculate the validity period.

If the effective time + validity period < current time, the session expires.

2. Verify whether the session ID has been tampered with or forged

Concatenate the numerical part of the session ID with the client IP and client User-Agent, calculate the MD5 code, and compare the result with the check code in the session ID to determine whether they are the same.

If they are the same, it is correct; if not, the session ID is forged or tampered, and an error is thrown.

3. Verify the validity of the session ID

Intercept the 65th to 68th bits to obtain the Redis node ID. According to the Redis node ID, query the session ID from the corresponding Redis storage node. If the data is queried, the session ID is valid, otherwise the session ID is invalid.

Those of ordinary skill in the art can understand that all or part of the processes in the methods of the above embodiments can be implemented through computer programs to instruct related hardware, and the programs can be stored in a computer-readable storage medium. During execution, it may include the processes of the embodiments of the above-mentioned methods. Wherein, the storage medium may be a magnetic disk, an optical disk, a read-only memory (Read-Only Memory, ROM) or a random access memory (Random Access Memory, RAM) and the like.

The technical means disclosed in the solutions of the present invention are not limited to the technical means disclosed in the above embodiments, but also include technical solutions composed of any combination of the above technical features. It should be pointed out that for those skilled in the art, some improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications are also regarded as the protection scope of the present invention.

Claims (3)

1. a kind of method for generating session id based on nginx server, which is characterized in that include the following steps：

Step 1, cluster internal generate non repetitive sequence, and sequence includes：Nginx example ID, timestamp, counter, nginx are real Example ID has uniqueness；

Step 2 carries out operation using CRC32 algorithm to the sequence that step 1 generates, obtains a whole-number result, the result with The node number of Redis does modular arithmetic, and obtained result is as Redis node ID；

Session id will be written validity period in step 3；

Step 4 splices sequence, Redis node ID, validity period, and carries out operation using Base64 algorithm and arrive session id to obtain the final product Numerical part；

Step 5 splices the numerical part of session id, the User-Agent of client, client ip, server end password, then According to character ascending sort, operation finally is carried out using MD5 algorithm, operation result is check code；

Step 6, the identifying code that the session id numerical part and step 5 that splicing step 4 generates generate, obtains final session ID。

2. the method according to claim 1 for generating session id based on nginx server, which is characterized in that further include meeting ID method of calibration is talked about, following process is specifically included：

When receiving the request of client, the 128Bit check code at session id end is intercepted, then rest part is the numerical value of session id Part；The numerical part of session id is decoded using Base64 algorithm, decoded data are proceeded as follows：

Whether expired verify session id：

The 1st to the 40th is taken, the entry-into-force time is calculated；

The 69th is taken out to 76, calculates validity period；

If the entry-into-force time+validity period<Current time, then session is expired；

Whether verification session id, which is forged, is distorted：

The numerical part of session id is spliced with client ip, client User-Agent, calculates MD5 code, and by result participant The check code talked about in ID compares, and judges whether identical；If identical, indicate that session id is correct；If it is not the same, then indicating session ID is to forge, or be tampered, mistake of dishing out；

Verify session id validity:

The 65th to 68 is intercepted, Redis node ID is obtained, according to Redis node ID, is inquired from corresponding Redis memory node The session id illustrates that session id is effective if inquiring data, otherwise illustrates that the session id is invalid.

3. the method according to claim 1 for generating session id based on nginx server, it is characterised in that：

Counter current value is stored in shared drive, and all Worker processes share the counter on separate unit Nginx server.