CN115550047A - Configuration-free interface authority verification method, device and system - Google Patents

Abstract

The present invention provides a configuration-free interface authority verification method, device and system, which are applied to the front-end system, and the generated Http message header and random number are retrieved in response to the login operation. The user token, and the back-end system has correspondingly stored the user token and random number; in response to the access operation of the target control on the front-end page, use the random number to encrypt the URL address and parameters of the API interface called by the target control, and encrypt the The obtained encrypted string is added to the Http message header; the Http request carrying the Http message header is sent to the backend system, so that the backend system: determines the random number based on the user token in the Http message header; uses the random number The number decrypts the encrypted string in the Http message header, and compares the URL address and parameters obtained by decryption with the URL address and parameters of the queried API interface; if the two are the same, execute the Http request; If the two are different, refuse to perform the Http request.

Description

Configuration-free interface authority verification method, device and system

technical field

The present invention relates to the technical field of software, and more specifically, relates to a configuration-free interface authority verification method, device and system.

Background technique

Rights management is a very important part of system development. With the development of business and technology, the separation of front and back ends has become a very popular development model. In the development mode where front-end and back-end are separated, the user's functional authority management is divided into two parts: the front-end page is responsible for controlling the user's page function authority, page button authority, page control use authority, etc.; the back-end system needs to verify the control calls on the page The access authority of the backend API (Application Programming Interface, application program interface) interface.

The entire business system needs to provide two parts of functional authority maintenance, including page function authority, page button authority, page control use authority, and back-end API interface access authority, and assign these two parts of authority data to the user's function authority on the list. In practical applications, a lot of data will be displayed on a page, and many API interfaces will be accessed at the same time. The number of API interfaces in a general system will be dozens of times the number of pages. The maintenance of API interface function permissions has become very cumbersome. Every time a new page is added, it brings about the operation and maintenance of a large amount of data on the back-end API interface.

Contents of the invention

In view of this, in order to solve the above problems, the present invention provides a configuration-free interface authority verification method, device and system. The technical solution is as follows:

A configuration-free interface authority verification method, the method is applied to a front-end system, and the method includes:

In response to the login operation, call the generated Http message header and random number, the Http message header is provided with a user token, the user token is returned by the back-end system, and the back-end system has correspondingly stored the user token and the random number;

In response to an access operation on the target control on the front-end page, use the random number to encrypt the URL address and parameters of the API interface called by the target control, and add the encrypted character string obtained by encryption to the Http message in the head;

Send the Http request carrying the Http message header to the backend system, so that the backend system:

Determine the random number based on the user token in the Http message header; use the random number to decrypt the encrypted character string in the Http message header, and decrypt the obtained URL address and parameters are compared with the queried URL address and parameters of the API interface; if they are the same, execute the Http request; if they are different, refuse to execute the Http request.

Preferably, the process of generating the Http message header and the random number includes:

Obtain login information, and send the login information to the backend system, so that the backend system can verify the login information;

receiving the user token returned by the backend system when the login information is verified, and setting the user token into the Http message header;

generating the random number, and sending the random number to the backend system, so that the backend system stores the user token and the random number in its backend cache correspondingly.

A configuration-free interface authority verification device, the device comprising:

The login response module is used to respond to the login operation and retrieve the generated Http message header and random number, the Http message header is provided with a user token, the user token is returned by the back-end system, and the The backend system has correspondingly stored the user token and the random number;

The access response module is used for responding to the access operation of the target control on the front-end page, using the random number to encrypt the URL address and parameters of the API interface called by the target control, and encrypting the obtained encrypted string Add in the Http message header; send the Http request carrying the Http message header to the backend system, so that the backend system:

Determine the random number based on the user token in the Http message header; use the random number to decrypt the encrypted character string in the Http message header, and decrypt the obtained URL address and parameters are compared with the queried URL address and parameters of the API interface; if they are the same, execute the Http request; if they are different, refuse to execute the Http request.

Preferably, the process of generating the Http message header and the random number by the login response module includes:

Obtain login information, and send the login information to the back-end system, so that the back-end system can verify the login information; Return the user token, and set the user token in the Http message header; generate the random number, and send the random number to the backend system, so that the backend The system stores the user token and the random number in its backend cache.

A configuration-free interface authority verification method, the method is applied to a backend system, and the method includes:

Receive the Http request sent by the front-end system, the Http message header carried by the Http request includes a user token and an encrypted string, and the encrypted string is the response of the front-end system to the target control on the front-end page The access operation is obtained by encrypting the URL address and parameters of the API interface called by the target control with a random number. The random number and the Http message header with the user token are the front-end system response login Called by the operation, the user token is returned by the backend system, and the backend system has correspondingly stored the user token and the random number;

determining the random number based on the user token in the Http message header;

Using the random number to decrypt the encrypted character string in the Http message header, and comparing the URL address and parameters obtained by decryption with the URL address and parameters of the API interface queried;

If both are the same, execute said Http request;

If the two are different, then refuse to execute the Http request.

Preferably, the method also includes:

If the two are different, return error information to the front-end system, so that the front-end system outputs the error information.

A configuration-free interface authority verification device, the device comprising:

The request receiving module is used to receive the Http request sent by the front-end system, the Http message header carried by the Http request includes a user token and an encrypted string, and the encrypted string is the response of the front-end system to The access operation of the target control on the front-end page is obtained by encrypting the URL address and parameters of the API interface called by the target control with a random number, and the random number and the Http message header provided with the user token are Called by the front-end system in response to a login operation, the user token is returned by the back-end system, and the back-end system has correspondingly stored the user token and the random number;

An authority verification module, configured to determine the random number based on the user token in the Http message header; use the random number to decrypt the encrypted string in the Http message header, and The URL address and parameters obtained by decryption are compared with the queried URL address and parameters of the API interface; if the two are the same, the Http request is executed; if the two are different, the Http request is refused to be executed.

Preferably, the authority verification module is also used for:

If the two are different, return error information to the front-end system, so that the front-end system outputs the error information.

A configuration-free interface authority verification system, the system includes: a front-end system and a back-end system, the front-end system is used to execute the configuration-free interface authority verification method, and the back-end system is used to execute the described A configuration-free interface permission verification method.

Compared with the prior art, the beneficial effects realized by the present invention are:

The present invention provides a configuration-free interface authority verification method, device and system, which are applied to the front-end system, and the generated Http message header and random number are retrieved in response to the login operation. User token, and the back-end system has correspondingly stored the user token and random number; in response to the access operation of the target control on the front-end page, use the random number to encrypt the URL address and parameters of the API interface called by the target control, and encrypt The obtained encrypted string is added to the Http message header; the Http request carrying the Http message header is sent to the backend system, so that the backend system: determines the random number based on the user token in the Http message header; uses the random number The number decrypts the encrypted string in the Http message header, and compares the URL address and parameters obtained by decryption with the URL address and parameters of the queried API interface; if the two are the same, execute the Http request; If the two are different, refuse to perform the Http request. The present invention can eliminate the API interface authority configuration, only need to configure the function authority of the front-end page for the user, reduce the workload of the system configuration personnel for the system authority configuration, save the operation and maintenance cost, and eliminate the need for each API interface call of the back-end system. The process of verifying whether the current user has the access authority of the API interface greatly improves the efficiency while ensuring the security of the system.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are only It is an embodiment of the present invention, and those skilled in the art can also obtain other drawings according to the provided drawings without creative work.

Fig. 1 is a method flowchart of a configuration-free interface authority verification method provided by an embodiment of the present invention;

FIG. 2 is a signaling flowchart of a configuration-free interface authority verification method provided by an embodiment of the present invention;

FIG. 3 is a schematic diagram of authority control provided by an embodiment of the present invention;

4 is a schematic structural diagram of a configuration-free interface authority verification device provided by an embodiment of the present invention;

Fig. 5 is a method flowchart of another configuration-free interface authority verification method provided by an embodiment of the present invention;

FIG. 6 is a schematic structural diagram of another configuration-free interface authority verification device provided by an embodiment of the present invention.

detailed description

The following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only some, not all, embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the protection scope of the present invention.

In order to make the above objects, features and advantages of the present invention more comprehensible, the present invention will be further described in detail below in conjunction with the accompanying drawings and specific embodiments.

For the convenience of understanding the present invention, the relevant concepts involved in the present invention are described below:

Separation of front-end and back-end: A very popular development model at present, which makes the division of labor of the project more clear: the back-end is responsible for processing and storing data; the front-end is responsible for displaying data. Front-end and back-end developers exchange data through the API interface.

Front-end: the front-end part of the website, which runs on the browser on the PC side and presents the webpage to the user.

Backend: The system responsible for accessing, processing, and storing data.

API interface: the way of front-end and back-end interaction, Http+Json is generally used in the front-end and back-end separation mode.

Request Header: Also known as the Http message header, it represents the field used to transfer additional information in the Http request or response. The Http message header is used to accurately describe the resource being acquired, the behavior of the server or client, and define the specific operating parameters in the Http transaction.

Http Interceptor: An interceptor that blocks or changes an Http request or response.

Permission management: which pages the user is allowed to visit after logging in, which APIs are allowed to be requested, etc., are the permissions set by the administrator. Only users who meet the permissions can browse pages and access and call API interfaces. Permissions are the limits of rights.

Token: According to the token generated by the user, it is generally used for authentication in the front-end and back-end separation mode.

Symmetric encryption: The data sender processes the plaintext (original data) and the encryption key together with a special encryption algorithm, turning it into complex encrypted ciphertext and sending it out. After the recipient receives the ciphertext, if he wants to interpret the original text, he needs to use the encrypted key and the inverse algorithm of the same algorithm to decrypt the ciphertext to restore it to readable plaintext.

With the development of business and technology, the front-end technology stack is becoming more and more abundant, so most systems adopt the development mode of front-end and back-end separation. Separation of front-end and back-end has become a very popular development model at present, which makes the division of labor of the project more clear: the back-end is responsible for processing and storing data; the front-end is responsible for displaying data. Front-end and back-end developers exchange data through the API interface.

In the development mode where the front and back ends are separated, the user's functional rights management is divided into two parts. The front-end page is responsible for controlling the user's page function permissions, page button permissions, and page control usage permissions. The back-end system needs to verify the access rights of the back-end API interface called by the controls on the page. Based on the front-end and back-end separation mode, the system needs to provide two parts of functional authority maintenance, the functional authority on the front-end page and the functional authority of the back-end API interface, and assign these two parts of authority data to the functional authority list owned by the user. Users can access the system safely.

In the front-end and back-end separation mode, the traditional authority verification process is: the user accesses the system login page, enters the user name and password, and the login is successful. The back-end system returns to the front-end system the user's function authority list and the Token token for authenticating the user's identity. ; The front-end system obtains the functional permission list owned by the user, and displays the corresponding page to the user according to the data in the functional permission list. When a user visits a page, the page needs to query data through the backend API. When the page initiates an API request call, the general processing method is to put the user token Token in the Request Header and send it to the backend system at the same time. The backend system determines the user's identity through the user token, and then queries the list of API interface permissions owned by the user to verify whether the user can access the current API interface.

In practical applications, a lot of data will be displayed on a page, and many API interfaces will be accessed at the same time. The number of API interfaces in the system will be dozens of times the number of pages. In practical applications, these data must also be synchronized and maintained in development, testing, UAT, production and other environments. If some data is missing, resulting in the inability of users to access the data, it is necessary to check one by one from the maintained page function list and the backend API list, which increases the difficulty of troubleshooting. Every time a user accesses a back-end API interface, the back-end system must query and filter from a large number of API interface lists to determine whether the user has access to this API interface. When the number of API interfaces is large, the matching verification process It will also bring a lot of performance consumption to the system.

Referring to FIG. 1, FIG. 1 is a method flow chart of a configuration-free interface authority verification method provided by an embodiment of the present invention. The configuration-free interface authority verification method is applied to a front-end system, and the method includes the following steps:

S101, in response to the login operation, retrieve the generated Http message header and random number, the Http message header is provided with a user token, the user token is returned by the backend system, and the backend system has correspondingly stored the user token and random number.

In the embodiment of the present invention, when the user logs in for the first time, the front-end system can send the login information to the back-end system for verification, and the back-end system returns the user token (i.e. Token) to the front-end system, and then the front-end system generates a random number and sets it to the Http In the message header, this can make the Http message header (ie Request Header) of each subsequent Http request contain the user token, and the random number can be sent to the backend system through the Http request carrying the Http message header. When the backend system receives the random number and the user token (ie Token) requested by Http, it caches the correspondence between the random number and the user token (ie Token) and saves it in the backend cache.

When the user subsequently logs in, the Http message header and the random number that have been set with the user token (ie Token) can be called.

In the specific implementation process, the process of generating the Http message header and the random number includes the following steps:

Obtain the login information, and send the login information to the backend system, so that the backend system can verify the login information;

Receive the user token returned by the backend system when the login information is verified, and set the user token in the Http message header;

Generate a random number and send the random number to the backend system, so that the backend system stores the user token and the random number in its backend cache.

Referring to FIG. 2 , FIG. 2 is a signaling flowchart of a configuration-free interface authority verification method provided by an embodiment of the present invention. Wherein, the front-end system may be composed of a front-end framework and a front-end page, and the back-end system may be composed of a back-end authority management service and a back-end API service.

The user logs in to the system through the front-end framework; the back-end rights management service verifies the user name and password for login, and after the verification is passed, a user token (ie Token) is generated for the user's current login according to the user name and login time information, and Determine that the user has successfully logged in, and return the user token (ie Token) to the front-end framework; after the front-end framework receives the user token (ie Token), set the user token (ie Token) to the Http request Http through the Http interceptor In the message header (that is, Request Header), this can make the Http message header (that is, Request Header) of each Http request contain the user token (that is, Token); the front-end framework further generates a random number, and the random number Send it to the back-end authority management service through the Http request; the back-end authority management service receives the random number and the user token (ie Token) requested by Http, and caches the correspondence between the random number and the user token (ie Token) Guaranteed to the backend cache.

S102. In response to the access operation on the target control on the front-end page, use random numbers to encrypt the URL address and parameters of the API interface called by the target control, and add the encrypted character string obtained by encryption to the Http message header.

The present invention does not need to maintain the list data of the API interface, but only needs to maintain the front-end page authority list data. When the user is assigned the authority of the front-end page and the controls on the front-end page, the user can access the front-end page and the controls on the page.

When a control on the front-end page (that is, the target control) calls the back-end API interface, it first encrypts the URL (uniform resource locator, Uniform Resource Locator) address and parameters in the API interface to be requested, and generates a The encrypted character string is uniformly sent to the backend system along with the Http message header (Request Header) of the Http request. Thus, by adding Http request interception processing in the front-end system, the user token (ie Token) and the encrypted string ( That is, the encrypted URL address and parameters).

Continue to refer to Figure 2, the user accesses the data in the front-end page, the front-end page uses the random number generated after the user logs in as the key, uses a symmetric encryption algorithm to encrypt the URL address and parameters of the Http request to be accessed currently, and encrypts The final string is added to the field of the Http message header (Request Header), and the access API interface is passed to the backend system. The following are the main processing steps of Http interception in the front-end system:

Obtain the user token (that is, Token) of the user's current login; obtain the generated random number; perform symmetric encryption on the URL address and parameters with the random number as the key, and generate the encrypted string ApiKeys.

The Http request sent through the front-end system will be intercepted by the Http interceptor, and the Http message header (ie Request Header) of the Http request will be assigned the user token (ie Token) and the encrypted string ApiKeys, and then sent to the backend system. Among them, the encrypted string ApiKeys is assigned to the Header field item of the Http message header.

S103, sending the Http request carrying the Http message header to the backend system, so that the backend system:

Determine the random number based on the user token in the Http message header; use the random number to decrypt the encrypted string in the Http message header, and combine the URL address and parameters obtained by decryption with the URL address of the API interface queried Compare with the parameters; if the two are the same, execute the Http request; if they are different, refuse to execute the Http request.

In the embodiment of the present invention, for the API interface that stores the association between the user token and the random number, the backend system does not verify the specific content of the encrypted character string ApiKeys, but only verifies the user token (ie Token).

The back-end system intercepts the Http request, first obtains the URL address and parameters of the Http request currently accessing the API interface from the Http request, and then decrypts the encrypted string ApiKeys in the Http message header (Request Header) to obtain the required data before encryption. The URL address and parameters of the accessed API request are compared and verified. In this way, the backend system does not need to judge whether the user has access to the API interface, but only needs to verify whether the encrypted string ApiKeys in the Http message header (Request Header) is the same as the currently accessed API interface, so as to achieve verification Whether the user can access the authority of this API interface, whether the user has modified the URL and parameters without authorization, or accessed the API interface without authorization. The above process ensures that the encrypted string ApiKeys must be sent when calling the back-end API, and the encrypted string ApiKeys must be generated in a trusted front-end system. This ensures that when the front-end system calls the back-end API interface, it does not need to verify the preset permissions, but only needs to verify the encrypted string.

Continue referring to Figure 2, the front-end page access API interface sends the Http request to the back-end authority management service; the back-end authority management service intercepts the Http request, and obtains the User token (ie Token), query the backend cache through the user token (ie Token), and obtain the random number generated after the current user associated with the user token (ie Token); the backend authority management service will The random number is used as the key to decrypt the encrypted string ApiKeys in the Header field item of the Http message header. Of course, if the encrypted string ApiKeys is empty, you can directly report an error, return the error message to the front-end page, and pass the rendering The page outputs the error message from the front-end page; the back-end rights management service obtains the URL address and parameters of the Http request through the interface provided by the web server, and then compares it with the URL address and parameters obtained by decryption; if the queried URL address It is completely consistent with the URL address obtained by decryption, and the queried parameters are completely consistent with the parameters obtained by decryption, then the verification is passed, continue to execute the Http request, and access the API resources provided by the back-end API service; if the queried If the URL address is not completely consistent with the URL address obtained by decryption, or the query parameters are not completely consistent with the parameters obtained by decryption, then the verification is not passed, the Http request is refused to be executed, and the Http request is terminated.

Of course, if the queried URL address is not completely consistent with the decrypted URL address, or the queried parameters are not completely consistent with the decrypted parameters, while refusing to execute the Http request, the back-end authority management service You can also report an error, return the error message to the front-end page, and output the error message from the front-end page by rendering the page.

Through the above method, the present invention can verify and manage the API interface authority without requiring the user to maintain and configure the authority of the back-end API interface, which can effectively save the labor cost of the system configuration personnel. In addition, because it is free of configuration, the permission configuration information does not need to be stored, does not need to occupy database resources, does not need to be synchronized to various environments, and will not cause problems in query, screening, and processing efficiency due to the large amount of permission data. Referring to FIG. 3 , FIG. 3 is a schematic diagram of authority control provided by an embodiment of the present invention. As shown in Figure 3, the system only needs to control the user's authority control over the page and the functions on the page. For the user, what you see is what you get. The functions of the page that the user can obtain can obtain the access authority of the API interface accordingly. And it ensures that users cannot access the API interface without unauthorized access.

The configuration-free interface authority verification method provided by the embodiment of the present invention has the following advantages:

1) The API interface permission list does not need to be maintained, nor does it need to maintain the association between users and API interfaces, which greatly reduces the workload of system configuration personnel and ensures the security of data access.

2) When the backend verifies API permissions, it does not need to read the permission configuration data, nor does it need to filter the permission data through the user ID, and it does not need to query the database, which improves the efficiency of permission verification.

3) Random key encryption is used. The random key is generated at the front end of the authenticated client, and the back-end stores the association between the authenticated user and the random key, ensuring that the encryption action can only be generated on a trusted client and ensuring the integrity of the API interface. safety. Problems such as access to API by untrusted clients, or unauthorized modification of access parameters through technical means after user authentication, and unauthorized access by users can all be solved.

Based on the configuration-free interface authority verification method provided by the above-mentioned embodiments, the embodiment of the present invention provides a corresponding device for performing the configuration-free interface authority verification method. The structural diagram of the device is shown in Figure 4, including:

The login response module 101 is used to respond to the login operation and retrieve the generated Http message header and random number. The Http message header is provided with a user token. The user token is returned by the back-end system, and the back-end system has corresponded Store user tokens and random numbers;

The access response module 102 is used to respond to the access operation for the target control on the front-end page, encrypt the URL address and parameters of the API interface called by the target control with random numbers, and add the encrypted character string obtained by encryption to the Http In the message header; send the Http request carrying the Http message header to the backend system, so that the backend system:

Determine the random number based on the user token in the Http message header; use the random number to decrypt the encrypted string in the Http message header, and combine the URL address and parameters obtained by decryption with the URL address of the API interface queried Compare with the parameters; if the two are the same, execute the Http request; if they are different, refuse to execute the Http request.

Optionally, the process of generating the Http message header and the random number by the login response module 101 includes:

Obtain login information, and send the login information to the backend system, so that the backend system can verify the login information; receive the user token returned by the backend system when the login information is verified, and set the user token to into the Http message header; generate a random number, and send the random number to the backend system, so that the backend system stores the user token and the random number in its backend cache.

It should be noted that, for detailed functions of each module in the embodiment of the present invention, refer to the corresponding disclosure part of the embodiment of the configuration-free interface authority verification method, and details are not repeated here.

Based on the configuration-free interface authority verification method provided in the above embodiments, the embodiment of the present invention also provides another configuration-free interface authority verification method, which is applied to the back-end system, and the method flow chart of the method As shown in Figure 5, it includes the following steps:

S201. Receive the Http request sent by the front-end system. The Http message header carried by the Http request contains the user token and the encrypted string. The encrypted string is the front-end system response to the access operation of the target control on the front-end page. The number is obtained by encrypting the URL address and parameters of the API interface called by the target control. The random number and the Http message header with the user token are retrieved by the front-end system in response to the login operation, and the user token is obtained by the back-end system. Returned, and the backend system has correspondingly stored the user token and random number.

S202. Determine a random number based on the user token in the Http message header.

S203. Use the random number to decrypt the encrypted character string in the Http message header, and compare the URL address and parameters obtained by decryption with the URL address and parameters of the queried API interface.

S204, if the two are the same, execute the Http request.

S205, if the two are different, refuse to execute the Http request.

The above method also includes the steps of:

If the two are different, return an error message to the front-end system, so that the front-end system outputs the error message.

It should be noted that, for detailed implementation of each step in the embodiment of the present invention, reference may be made to the corresponding disclosure of the embodiment of the configuration-free interface authority verification method, and details are not repeated here.

Based on the configuration-free interface authority verification method provided in the above-mentioned embodiments, the embodiment of the present invention provides a corresponding device for executing the configuration-free interface authority verification method. The structural diagram of the device is shown in Figure 6, including:

The request receiving module 201 is used to receive the Http request sent by the front-end system. The Http message header carried by the Http request contains a user token and an encrypted string. The encrypted string is the response of the front-end system to the target control on the front-end page. The access operation uses a random number to encrypt the URL address and parameters of the API interface called by the target control. The random number and the Http message header with the user token are called by the front-end system in response to the login operation. The user token It is returned by the backend system, and the backend system has correspondingly stored the user token and random number;

Authority verification module 202, for determining random number based on the user token in the Http message header; use the random number to decrypt the encrypted character string in the Http message header, and decrypt the obtained URL address and parameters with the query Compare the URL address and parameters of the API interface to be accessed; if the two are the same, execute the Http request; if they are different, refuse to execute the Http request.

Optionally, the authority verification module 202 is also used for:

If the two are different, return an error message to the front-end system, so that the front-end system outputs the error message.

It should be noted that, for detailed implementation of each step in the embodiment of the present invention, reference may be made to the corresponding disclosure of the embodiment of the configuration-free interface authority verification method, and details are not repeated here.

The embodiment of the present invention also provides a configuration-free interface authority verification system, the system includes: a front-end system and a back-end system, the front-end system is used to execute its corresponding configuration-free interface authority verification method, and the back-end system is used to execute its Corresponding configuration-free interface permission verification method.

The configuration-free interface authority verification method, device and system provided by the present invention have been described in detail above. In this paper, specific examples are used to illustrate the principle and implementation of the present invention. The description of the above embodiments is only for To help understand the method of the present invention and its core idea; at the same time, for those of ordinary skill in the art, according to the idea of the present invention, there will be changes in the specific implementation and scope of application. In summary, the content of this specification It should not be construed as a limitation of the invention.

It should be noted that each embodiment in this specification is described in a progressive manner, and each embodiment focuses on the difference from other embodiments. For the same and similar parts in each embodiment, refer to each other, that is, Can. As for the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and for the related information, please refer to the description of the method part.

It should also be noted that in this article, relational terms such as first and second etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply that these entities or operations Any such actual relationship or order exists between. Furthermore, the term "comprises", "comprises" or any other variation thereof is intended to encompass a non-exclusive inclusion such that elements inherent in a process, method, article, or apparatus comprising a set of elements are included or are also included as such , method, article or device inherent in the elements. Without further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article or apparatus comprising said element.

The above description of the disclosed embodiments is provided to enable any person skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the present invention will not be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims (9)

1. A configuration-free interface authority verification method is applied to a front-end system, and comprises the following steps:

responding to login operation, calling a generated Http message header and a random number, wherein a user token is set in the Http message header, the user token is returned by a back-end system, and the back-end system stores the user token and the random number correspondingly;

responding to an access operation aiming at a target control on a front-end page, encrypting a URL (Uniform resource locator) address and parameters of an API (application program interface) called by the target control by using the random number, and adding an encrypted character string obtained by encryption into the Http message header;

sending the Http request carrying the Http message header to the backend system, so that the backend system:

determining the random number based on the user token in the Http message header; decrypting the encrypted character string in the Http message header by using the random number, and comparing the URL address and the parameter obtained by decryption with the queried URL address and parameter of the API; if the two are the same, executing the Http request; and if the two are different, refusing to execute the Http request.

2. The method of claim 1, wherein generating the Http header and the nonce comprises:

acquiring login information, and sending the login information to the back-end system so that the back-end system verifies the login information;

receiving the user token returned by the back-end system under the condition that the login information passes the verification, and setting the user token into the Http message header;

and generating the random number, and sending the random number to the back-end system so that the back-end system correspondingly stores the user token and the random number in a back-end cache thereof.

3. A configuration-free interface permission verification apparatus, the apparatus comprising:

the login response module is used for responding to login operation and calling a generated Http message header and a random number, wherein a user token is set in the Http message header, the user token is returned by a back-end system, and the back-end system stores the user token and the random number correspondingly;

the access response module is used for responding to the access operation of a target control on a front-end page, encrypting the URL address and the parameter of the API called by the target control by using the random number, and adding an encrypted character string obtained by encryption into the Http message header; sending the Http request carrying the Http message header to the backend system, so that the backend system:

determining the random number based on the user token in the Http message header; decrypting the encrypted character string in the Http message header by using the random number, and comparing a URL address and parameters obtained by decryption with the queried URL address and parameters of the API; if the two are the same, executing the Http request; and if the two are different, refusing to execute the Http request.

4. The apparatus of claim 1, wherein the login response module generates the Http header and the nonce, and comprises:

acquiring login information, and sending the login information to the back-end system so that the back-end system verifies the login information; receiving the user token returned by the back-end system under the condition that the login information passes the verification, and setting the user token into the Http message header; and generating the random number, and sending the random number to the back-end system so that the back-end system correspondingly stores the user token and the random number in a back-end cache thereof.

5. A configuration-free interface authority verification method is applied to a back-end system, and comprises the following steps:

receiving an Http request sent by a front-end system, wherein an Http message header carried by the Http request comprises a user token and an encrypted string, the encrypted string is obtained by encrypting a URL address and parameters of an API interface called by a target control on a front-end page by using a random number in response to an access operation of the target control on the front-end page, the random number and the Http message header provided with the user token are called by the front-end system in response to a login operation, the user token is returned by the back-end system, and the user token and the random number are stored in the back-end system correspondingly;

determining the random number based on the user token in the Http message header;

decrypting the encrypted character string in the Http message header by using the random number, and comparing a URL address and parameters obtained by decryption with the queried URL address and parameters of the API;

if the two are the same, executing the Http request;

and if the two are different, refusing to execute the Http request.

6. The method of claim 5, further comprising:

and if the two are different, returning error information to the front-end system so that the front-end system outputs the error information.

7. A configuration-free interface permission verification apparatus, the apparatus comprising:

a request receiving module, configured to receive an Http request sent by a front-end system, where an Http message header carried by the Http request includes a user token and an encrypted string, where the encrypted string is obtained by encrypting, by the front-end system, a URL address and a parameter of an API interface called by a target control using a random number in response to an access operation on the target control on a front-end page, the random number and the Http message header provided with the user token are called by the front-end system in response to a login operation, and the user token is returned by the back-end system and the user token and the random number are stored in the back-end system correspondingly;

an authority verification module for determining the random number based on the user token in the Http message header; decrypting the encrypted character string in the Http message header by using the random number, and comparing the URL address and the parameter obtained by decryption with the queried URL address and parameter of the API; if the two are the same, executing the Http request; and if the two are different, refusing to execute the Http request.

8. The apparatus of claim 7, wherein the permission verification module is further configured to:

if the two are different, returning error information to the front-end system so that the front-end system outputs the error information.

9. A configuration-free interface permission verification system, the system comprising: a front-end system and a back-end system, wherein the front-end system is used for executing the configuration-free interface authority verification method of claim 1 or 2, and the back-end system is used for executing the configuration-free interface authority verification method of claim 5 or 6.

Images