CN117955698B - Swagger-based call request authentication method and swagger-based call request authentication device - Google Patents

Abstract

The embodiment of the invention provides a call request authentication method and device based on swagger, and relates to the technical field of data processing. The specific implementation scheme is as follows: receiving a call request for an interface carrying a channel identifier and request verification information; determining a first authentication channel corresponding to a channel identifier in the existing authentication channels, wherein the authentication channel corresponds to a service provided by an online service platform, and an interface for accessing the service corresponding to the authentication channel is bound to the authentication channel; judging whether the first verification information corresponding to the first authentication channel is matched with the request verification information or not; if the first authentication channel is matched with the second authentication channel, determining that the interface bound by the first authentication channel is an interface which is authorized to be called by the call request. The scheme provided by the embodiment of the invention can improve the convenience of configuring the authentication scheme for the call request of the interface when the interface needing authentication is changed.

Description

A call request authentication method and device based on swagger

Technical Field

The present invention relates to the technical field of data processing, and in particular to a call request authentication method and device based on swagger (an interface parsing framework).

Background Art

With the development of network technology, various online business platforms provide various services to users through their callable interfaces. However, the various services provided to users through various interfaces may involve sensitive data or sensitive operations. Therefore, after receiving the interface call request, the online business platform needs to authenticate the call request.

In the prior art, the interface call request sent by the user using the client to the online business platform generally carries the route of the interface to be called, and the online business platform performs interface authentication based on the route of the interface recorded in the local code and the route carried in the above interface call request. As can be seen from the above, in order to successfully perform interface authentication, the online business platform needs to record the route of the interface to be authenticated at the code layer. In this way, interface authentication can only be achieved by relying on hard coding. Once the scope of the interface to be authenticated changes, the local code of the online business platform needs to be adjusted, which is inconvenient.

Summary of the invention

The purpose of the embodiment of the present invention is to provide a swagger-based call request authentication method and device, which is used to improve the convenience of configuring an authentication scheme for a call request of an interface when the interface to be authenticated changes. The specific technical solution is as follows:

According to one aspect of an embodiment of the present invention, a swagger-based call request authentication method is provided, which is applied to an online business platform built based on swagger, and the method includes:

Receive a call request for an interface carrying a channel identifier and request verification information;

Determine a first authentication channel corresponding to the channel identifier among the existing authentication channels, wherein the authentication channel corresponds to a service provided by the online service platform, and the authentication channel is bound with an interface for accessing the service corresponding to the authentication channel;

Determining whether the first verification information corresponding to the first authentication channel matches the requested verification information;

If there is a match, it is determined that the interface bound to the first authentication channel is the interface that the call request is authorized to call.

In one embodiment of the present invention, the online business platform binds an interface to the authentication channel in the following manner:

Obtaining interface description information recorded in the local code of the online business platform;

Based on the obtained interface description information, determine the interface information of the external access interface of the service provided by the online service platform;

Displaying the determined interface information on the user interface;

Creating the authentication channel, and displaying information of the authentication channel on the user interface;

Determining a target interface for the service corresponding to the authentication channel selected by the user based on the displayed interface information;

A binding relationship is established between the authentication channel and the target interface, and the binding relationship is stored.

In one embodiment of the present invention, after creating the authentication channel, the method further includes:

Issuing a secret key for the authentication channel;

The determining whether the first verification information corresponding to the first authentication channel matches the request verification information includes:

Generate first verification information based on the secret key corresponding to the first authentication channel;

Determine whether the first verification information matches the request verification information.

In one embodiment of the present invention, the interface information includes at least one of the following information:

The full name of the interface class, the interface class access path, the interface class description information, the interface method name, the interface method access path, the interface method description information, the interface request type, and the interface service type.

In one embodiment of the present invention, the information of the authentication channel includes at least one of the following information:

Channel identification, channel name, channel key, channel description information and interface information of the interface bound to the authentication channel.

In one embodiment of the present invention, after obtaining the interface description information recorded in the local code of the online service platform, the method further includes:

Determine the interface service type of the interface corresponding to each interface description information according to the obtained interface description information;

A second authentication channel that matches the determined interface service type among the existing authentication channels is determined, and an interface binding reminder is sent to a client used by an administrator of the second authentication channel.

In one embodiment of the present invention, the method further comprises:

If an interface change occurs on the online business platform, obtain the interface status of the changed interface;

If the interface status indicates that the changed interface is not a deprecated interface, an interface change reminder is sent to a client used by the administrator of the authentication channel.

In one embodiment of the present invention, after determining the target interface of the corresponding service selected by the user for the authentication channel based on the displayed interface information, the method further includes:

Triggering a binding review process for the target interface;

If the verification is passed, the step of establishing a binding relationship between the authentication channel and the target interface is executed.

According to another aspect of an embodiment of the present invention, a swagger-based call request authentication device is provided, which is applied to an online business platform built based on swagger, and the device includes:

A call request receiving module, used to receive a call request for an interface carrying a channel identifier and request verification information;

An authentication channel determination module, used to determine a first authentication channel corresponding to the channel identifier among existing authentication channels, wherein the authentication channel corresponds to a service provided by the online service platform, and the authentication channel is bound with an interface for accessing the service corresponding to the authentication channel;

A verification information matching module, used to determine whether the first verification information corresponding to the first authentication channel matches the request verification information; if they match, triggering the interface determination module;

The interface determination module is used to determine that the interface bound to the first authentication channel is the interface that the call request is authorized to call.

In one embodiment of the present invention, the online business platform binds an interface to the authentication channel in the following manner:

Obtaining interface description information recorded in the local code of the online business platform;

Based on the obtained interface description information, determine the interface information of the external access interface of the service provided by the online service platform;

Displaying the determined interface information on the user interface;

Creating the authentication channel, and displaying information of the authentication channel on the user interface;

Determining a target interface for the service corresponding to the authentication channel selected by the user based on the displayed interface information;

A binding relationship is established between the authentication channel and the target interface, and the binding relationship is stored.

In one embodiment of the present invention, after creating the authentication channel, the method further includes:

Issuing a secret key for the authentication channel;

The determining whether the first verification information corresponding to the first authentication channel matches the request verification information includes:

Generate first verification information based on the secret key corresponding to the first authentication channel;

Determine whether the first verification information matches the request verification information.

In one embodiment of the present invention, the interface information includes at least one of the following information:

The full name of the interface class, the interface class access path, the interface class description information, the interface device name, the interface device access path, the interface device description information, the interface request type, and the interface service type.

In one embodiment of the present invention, the information of the authentication channel includes at least one of the following information:

Channel identification, channel name, channel key, channel description information and interface information of the interface bound to the authentication channel.

In one embodiment of the present invention, after obtaining the interface description information recorded in the local code of the online service platform, the method further includes:

Determine the interface service type of the interface corresponding to each interface description information according to the obtained interface description information;

A second authentication channel that matches the determined interface service type among the existing authentication channels is determined, and an interface binding reminder is sent to a client used by an administrator of the second authentication channel.

In one embodiment of the present invention, the online business platform further comprises:

If an interface change occurs on the online business platform, obtain the interface status of the changed interface;

If the interface status indicates that the changed interface is not a deprecated interface, an interface change reminder is sent to a client used by the administrator of the authentication channel.

In one embodiment of the present invention, after determining the target interface of the corresponding service selected by the user for the authentication channel based on the displayed interface information, the method further includes:

Triggering a binding review process for the target interface;

If the verification is passed, the step of establishing a binding relationship between the authentication channel and the target interface is executed.

According to another aspect of an embodiment of the present invention, there is provided an electronic device, comprising a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus;

Memory, used to store computer programs;

The processor is used to implement any of the above-mentioned swagger-based call request authentication methods when executing the program stored in the memory.

According to another aspect of an embodiment of the present invention, a computer-readable storage medium is provided, in which a computer program is stored. When the computer program is executed by a processor, any of the above-mentioned swagger-based call request authentication methods is implemented.

According to another aspect of an embodiment of the present invention, a computer program product comprising instructions is provided, which, when executed on a computer, enables the computer to execute any of the above-mentioned swagger-based call request authentication methods.

Beneficial effects of the embodiments of the present invention:

As can be seen from the above, in the scheme provided by the embodiment of the present invention, the first authentication channel corresponding to the channel identifier is determined based on the channel identifier carried by the call request, and whether the call request can access the interface bound to the first authentication channel is determined by whether the verification information of the first authentication channel matches the request verification information. In the case that the interface that needs to be authenticated changes, the online business platform can modify and adjust the interface during operation based on swagger, so that the interface bound to the authentication channel can be changed. Because the interface is authenticated by the verification information corresponding to the authentication channel, the binding relationship between the changed interface and the authentication channel is modified, that is, the authentication method of the changed interface that needs to be authenticated can be modified, and there is no need to use hard coding to modify the route with each changed interface, nor to modify the interception rules in the code layer of the online business platform. It only needs to bind the changed interface that needs to be authenticated to the authentication channel of the business to which the interface belongs. It can be seen that the scheme provided by the embodiment of the present invention can improve the convenience of configuring the authentication scheme for the call request of the interface.

Of course, it is not necessary to achieve all of the advantages described above at the same time to implement any product or method of the present invention.

BRIEF DESCRIPTION OF THE DRAWINGS

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present invention. For ordinary technicians in this field, other embodiments can also be obtained based on these drawings.

FIG1 is a schematic diagram of a flow chart of a method for invoking a request authentication method provided by an embodiment of the present invention;

FIG2 is a schematic diagram of a flow chart of an interface binding method provided by an embodiment of the present invention;

FIG3 is a schematic diagram of an interface for displaying interface information provided by an embodiment of the present invention;

FIG4 is a schematic diagram of an interface for displaying information of authentication channels provided by an embodiment of the present invention;

FIG5 is a schematic diagram of the structure of a call request authentication device provided by an embodiment of the present invention;

FIG6 is a schematic diagram of the structure of an electronic device provided by an embodiment of the present invention.

DETAILED DESCRIPTION

The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field based on the present invention belong to the scope of protection of the present invention.

The prior art of the embodiments of the present invention is described below.

In the prior art, the interface call request sent by the user using its client to the online business platform generally carries the route of the interface to be called, and the online business platform performs interface authentication based on the route of the interface recorded in the local code and the route carried in the above interface call request. The online business platform can record the route of the interface that needs to be authenticated in the code layer. Then, when the range of interfaces that need to be authenticated changes, the user needs to adjust the route of the recorded interface in the code layer of the online business platform. Alternatively, interception rules can also be written for each interface that needs to be authenticated in the code layer of the online business platform. Then, when the range of interfaces that need to be authenticated changes, the user needs to adjust the interception rules and code logic in the above code layer. In addition, the user also needs to modify the interception rules and adjust the code logic one by one for each changed code, which will increase the complexity and workload of maintenance. Especially in large online business platforms, when the interfaces that need to be authenticated change frequently or the number of interfaces that need to be authenticated is large, this manual modification process for the code layer will be very cumbersome and error-prone, and very inconvenient.

In order to improve the convenience of configuring an authentication scheme for a call request of an interface when an interface requiring authentication changes, an embodiment of the present invention provides a call request authentication method and device based on swagger.

The concepts involved in the embodiments of the present invention are described below.

1. Authentication Channel

The authentication channel is a channel for performing call request authentication corresponding to the services provided by the online business platform. For example, if the services provided by the online business platform include equipment operation and maintenance management services, then the online business platform can be provided with an authentication channel corresponding to the equipment operation and maintenance management services. If the services provided by the online business platform include online transaction services, then the online business platform can be provided with an authentication channel corresponding to the online transaction services.

The authentication channel is bound with an interface for accessing the service corresponding to the authentication channel. Taking the authentication channel corresponding to the equipment operation and maintenance management service as an example, the interface that should be bound to the authentication channel is: the interface for accessing the equipment operation and maintenance management service. For example, the interface for querying equipment attribute information, the interface for obtaining equipment operation control information, and the interface for modifying equipment configuration information, etc.

Similarly, for the authentication channel corresponding to the online transaction business, the interface for accessing the online transaction business should be bound.

2. Channel Identification

The channel identifier is a unique identifier corresponding to an existing authentication channel in the online business platform. Specifically, the channel identifier of each authentication channel can be set by the user when creating the channel, or the online business platform can generate a unique identifier for the authentication channel.

3. Swagger

Swagger is an interface parsing framework that can be used to develop, manage, and document interfaces. Based on swagger, the online business platform can parse interfaces during the operation of the online business platform. For example, the online business platform can detect changes in interfaces in the online business platform by parsing documents generated based on swagger.

The following describes in detail the call request authentication method provided by an embodiment of the present invention in conjunction with FIG. 1 .

In one embodiment of the present invention, referring to FIG. 1 , a flow chart of a method for calling a request authentication method is provided. The method is applied to an online business platform built based on swagger, and the method includes the following steps S101-S104.

Step S101: receiving a call request for an interface carrying a channel identifier and request verification information.

In one implementation, a channel identifier and request verification information may be added to a preset field in the call request. After receiving the call request, the online business platform reads the data in the preset field to obtain the channel identifier and request verification information.

For example, the call request may be a call request sent based on the HyperText Transfer Protocol (HTTP), and the request header of the call request may include a channel identifier and request verification information. The online business platform can read the data in the request header after receiving the call request, and then obtain the channel identifier and request verification information.

Step S102: Determine a first authentication channel corresponding to the channel identifier among the existing authentication channels.

The authentication channel corresponds to the services provided by the online service platform, and the authentication channel is bound with an interface for accessing the services corresponding to the authentication channel.

In one implementation, after obtaining the channel identifier, the online business platform determines, from the existing authentication channels, an authentication channel whose channel identifier is the same as the channel identifier carried in the call request as the first authentication channel. In addition, if the call request carries two or more channel identifiers, the online business platform can respectively determine multiple authentication channels corresponding to the multiple channel identifiers as the first authentication channels. Then the online business platform can perform steps S103-S104 for each first authentication channel.

Step S103: Determine whether the first verification information corresponding to the first authentication channel matches the requested verification information.

Among them, for each authentication channel, verification information corresponding to the authentication channel can be set, and the online business platform records the correspondence between each authentication channel and its corresponding verification information. The verification information corresponding to each authentication channel is also different. The verification information of the authentication channel is used to match the request verification information, and then verify that the call request received by the online business platform is able to call the interface bound to the authentication channel. For example, the verification information of the authentication channel can be a combination of a string of preset numbers and/or letters, and the called party can communicate with the requester who needs to access the interface of the business corresponding to the authentication channel, and inform the requester of the verification information corresponding to the authentication channel. In this way, the requester can set the request verification information that can match the verification information corresponding to the authentication channel in the request information of the sent call request.

In one implementation, after the online business platform determines the first authentication channel, it can determine the first verification information corresponding to the first authentication channel from the correspondence between the recorded authentication channel and its corresponding verification information, and then determine whether the first verification information is the same as the requested verification information. If they are the same, it is determined that the first verification information matches the requested verification information; otherwise, it is determined that the first verification information does not match the requested verification information.

In another implementation, the verification information corresponding to the authentication channel can be generated based on the secret key corresponding to the authentication channel. Specifically, the online business platform can generate the first verification information based on the secret key corresponding to the first verification information. In addition, the called party can communicate with the requesting party who needs to access the interface of the business corresponding to the first authentication channel, and inform the requesting party of the secret key corresponding to the first verification information and the method of generating the first verification information based on the secret key. In this way, the requesting party can generate the request verification information in the same way as the first verification information is generated and add it to the call request. Then, the online business platform determines whether the generated first verification information is the same as the request verification information carried by the call request. If they are the same, it is determined that the first verification information matches the request verification information, otherwise it is determined that the first verification information does not match the request verification information.

In addition, the method of generating the first verification information and the secret key can be determined by negotiation between the requesting party and the called party. The specific implementation method of generating the first verification information is described in the following embodiments and will not be described in detail here.

Step S104: If there is a match, it is determined that the interface bound to the first authentication channel is the interface that the call request is authorized to call.

Specifically, when the first verification information matches the request verification information, the online business platform allows the call request to call the interface bound to the first authentication channel.

As can be seen from the above, in the scheme provided by the embodiment of the present invention, the first authentication channel corresponding to the channel identifier is determined based on the channel identifier carried by the call request, and whether the call request can access the interface bound to the first authentication channel is determined by whether the verification information of the first authentication channel matches the request verification information. In the case that the interface that needs to be authenticated changes, the online business platform can modify and adjust the interface during operation based on swagger, so that the interface bound to the authentication channel can be changed. Because the interface is authenticated by the verification information corresponding to the authentication channel, the binding relationship between the changed interface and the authentication channel is modified, that is, the authentication method of the changed interface that needs to be authenticated can be modified, and there is no need to use hard coding to modify the route with each changed interface, nor to modify the interception rules in the code layer of the online business platform. It only needs to bind the changed interface that needs to be authenticated to the authentication channel of the business to which the interface belongs. It can be seen that the scheme provided by the embodiment of the present invention can improve the convenience of configuring the authentication scheme for the call request of the interface.

In addition, since each authentication channel can be configured with corresponding verification information, or a verification information generation method corresponding to the authentication channel can be configured, different encryption and decryption methods and different authentication schemes can be used to generate verification information. The solution provided by the embodiment of the present invention can support a variety of different encryption and decryption methods, different authentication schemes, etc. In this way, the operation and maintenance complexity of the online business platform can also be reduced.

In one embodiment of the present invention, a schematic flow diagram of an interface binding method is provided in Figure 2. The online business platform binds the interface to the authentication channel according to the following steps S201-S206.

Step S201: Obtain interface description information recorded in the local code of the online business platform.

Specifically, when developers write local codes corresponding to each interface, they can add annotations to the interface methods. In this way, the online business platform can obtain the interface description information of each interface based on the annotations of the interface methods. For example, the online business platform can traverse the local code, read the annotations of the interface methods, and obtain the interface description information of each interface.

For example, you can add annotations to the methods of the interfaces in the local code of the business platform based on swagger. Then, when the online business platform obtains the interface description information, you can determine the interface description information by scanning the annotations "@Api (interface annotation), @ApiOperation (interface method annotation) and @ApiImplicitParams (interface parameter annotation)" in the local code.

Furthermore, after determining the interface description information, the interface description information can be parsed and an interface document can be generated based on Springfox (an open source framework for generating interface documents). The interface document is more intuitive, allowing users to view the description information of each interface more directly.

Step S202: Based on the obtained interface description information, determine the interface information of the external access interface of the service provided by the online service platform.

Specifically, the online business platform can determine the interface information of the external interface marked as the external access interface in the interface description information annotation based on the obtained interface description information. For example, the annotation of the external access interface of the service provided by the online business platform can indicate that the interface is an external access interface. The online business platform can traverse the local code of the interface to determine the external access interface, and determine the interface information of the external access interface from the interface description information obtained in the above step S201.

Step S203: Displaying the determined interface information on the user interface.

The interface information includes at least one of the following information: the full name of the interface class, the interface class access path, the interface class description information, the interface method name, the interface method access path, the interface method description information, the interface request type, and the interface service type. For example, see FIG3 for a schematic diagram of an interface for displaying interface information. FIG3 is only an example of a user interface for displaying interface information, and the text in the figure does not limit the embodiments of the present invention and need not be paid attention to.

Among them, the full name of the interface class is used to uniquely identify an interface class. The interface class access path is used to specify the specific location of the interface class. The interface class description information is used to describe the function, purpose, parameters, etc. of the interface class for the convenience of user understanding. The interface method name is used to uniquely identify an interface method. The interface method access path is used to indicate the specific location of the interface method. The interface method access path is used to describe the function, purpose, parameters, etc. of the interface method for the convenience of user understanding. The interface request type indicates the request type of the interface method, such as GET (get resources), POST (submit data), PUT (update resources), and DELETE (delete resources). The interface business type is used to indicate the business field to which the interface method belongs, such as operation and maintenance management business, transaction management business, user management business, and order management business.

It can be seen that displaying interface information to users in as much detail as possible can improve user experience, allowing users to more intuitively understand the detailed information of each interface. Clearly displaying interface information can also reduce user errors.

Step S204: Create an authentication channel and display the authentication channel information on the user interface.

In one implementation, after receiving an authentication channel creation instruction sent by a user using a client, the online business platform creates an authentication channel, and based on the channel name and channel description information carried in the authentication channel creation instruction, the created authentication channel can be displayed on the user interface. In addition, the online business platform can also obtain information about existing authentication channels recorded in the online business platform, and display the authentication channel information on the user interface.

Furthermore, after receiving the authentication channel creation instruction sent by the user using the client, the online business platform can trigger the authentication channel creation review process and send an authentication channel creation review reminder to the reviewer preset for the authentication channel creation review process. If the authentication channel creation review passes, the authentication channel is determined to be created and the information of the created authentication channel is recorded.

The authentication channel information includes at least one of the following information:

Channel identification, channel name, channel key, channel description information, and interface information of the interface bound to the authentication channel. For example, see FIG4 for a schematic diagram of an interface for displaying information of an authentication channel. FIG4 is only an example of a user interface for displaying information of an authentication channel, and the text in the figure does not limit the embodiments of the present invention and need not be paid attention to.

The channel identifier is used to uniquely identify an authentication channel. The channel name is used to represent the name of the authentication channel. The channel description information is used to describe the channel's business, purpose, parameters, and attributes to facilitate user understanding. The interface information of the interface bound to the authentication channel can represent the number of interfaces bound to the authentication channel and the interface information of the bound interfaces.

It can be seen that displaying authentication channel information to users in as much detail as possible can improve the user experience, allowing users to more intuitively understand the detailed information of each authentication channel. Clearly displaying authentication channel information can reduce user errors. It allows users to more intuitively configure authentication schemes for interface call requests, improving convenience.

Step S205: Determine the target interface of the service corresponding to the authentication channel selected by the user based on the displayed interface information.

Specifically, for the displayed interface information, a binding button may be provided in the user interface, and the user may select the target interface of the corresponding service for the authentication channel by clicking the binding button. After the online service platform receives the binding instruction for the target interface and the authentication channel sent by the client used by the user, it determines the target interface of the corresponding service selected by the user for the authentication channel based on the displayed interface information.

Step S206: Establish a binding relationship between the authentication channel and the target interface, and store the binding relationship.

Specifically, the online business platform may store the binding relationship between the authentication channel and the target interface in a database.

As can be seen from the above, the online business platform displays the interface information of the determined external access interface in the user interface according to the obtained interface description information, so that the user can intuitively view the interface information and improve the user experience. The user can intuitively understand the detailed information of each interface, and the clear display of interface information can also reduce the user's erroneous operation. After the online business platform creates the authentication channel, it displays the information of the authentication channel in the user interface, so that the user can view the information of the authentication channel and the interface information, so that the user can visually view and determine the binding relationship between the interface and the authentication channel, so that the user can intuitively determine the target interface selected for the authentication channel. After determining that the user selects the target interface for the authentication channel based on the displayed interface information, the online business platform establishes a binding relationship between the authentication channel and the target interface, and stores the binding relationship, so that the user can configure the authentication scheme for the target interface by binding the authentication channel and the target interface, without relying on hard coding and configuration files, further improving the convenience of configuring the authentication scheme for the call request of the interface.

In one embodiment of the present invention, in the above step S204, after the authentication channel is created, it also includes: issuing a key for the authentication channel.

In one implementation, the online business platform can randomly generate a secret key and record the corresponding relationship between the secret key and the authentication channel. The secret key can be a 16-character letter.

In another implementation, the secret key may be a preset value.

In this case, the method of judging whether the first verification information matches the requested verification information in the above step S103 can be implemented according to the following steps: generating the first verification information based on the secret key corresponding to the first authentication channel; judging whether the first verification information matches the requested verification information.

For example, the first verification information may be generated in the following manner:

If the call request does not carry other parameters, the online business platform can assemble the secret key and the current date into a string and encrypt the string. The encryption method can be md5 (an encryption method), and the current date can be an 8-digit number, such as 20231023. The string can be: secret = <secret key corresponding to the first authentication channel> & date = <current date>.

If the call request carries a request body parameter, the online business platform can assemble the secret key, request body parameter and current date into a string and encrypt the string. The request body parameter can be a data string formatted in json (a lightweight data exchange format) with null values removed. The string can be: secret = <secret key corresponding to the first authentication channel> & param = <request body parameter> & date = <current date>.

If the call request carries resource location parameters, the online business platform can assemble the secret key, resource location parameters and current date into a string and encrypt the string. The resource location parameter can be the URL (Uniform Resource Locator) parameter carried in the call request, or the resource location parameter can be a string that is formatted in json and removes null values. The string can be: secret = <secret key corresponding to the first authentication channel> & param = <params parameters> & date = <current date>

If the call request carries request body parameters and resource location parameters, the online business platform can assemble the secret key, request body parameters and current date into a string and encrypt the string. The string can be: secret = <secret key corresponding to the first authentication channel> & param = <request body parameters> & date = <current date>.

The above-mentioned generation of the first verification information is only an example, and the embodiment of the present invention does not limit the specific method of generating the first verification information.

Then, the online business platform can determine whether the first verification information is the same as the request verification information, if so, the first verification information matches the request verification information, and if not, the first verification information does not match the request verification information.

As can be seen from the above, since each authentication channel can be configured with a verification information generation method corresponding to the authentication channel, different encryption and decryption methods and different authentication schemes can be used to generate verification information. The solution provided by the embodiment of the present invention can support a variety of different encryption and decryption methods, different authentication schemes, etc. In this way, users can bind interfaces with authentication channels according to different authentication requirements of interfaces, different encryption and decryption requirements, and different authentication schemes, further improving the convenience of configuring authentication schemes for interface call requests.

In one embodiment of the present invention, after step S201, the following steps A and B are also included. Steps A and B can remind the administrator to bind the interface that matches the business of the authentication channel that the administrator is responsible for.

Step A: According to the obtained interface description information, the interface service type of the interface corresponding to each interface description information is determined.

Among them, as in the above embodiment, the interface business type is used to indicate the business field to which the interface method belongs, such as operation and maintenance management business, transaction management business, user management business, and order management business.

In one case, after the online service platform is started, the interface description information can be obtained, and the interface service type recorded in the description information of each interface can be determined.

In another case, after the online business platform determines that an interface change occurs on the business platform, the online business platform obtains description information of the changed interface for the changed interface, and determines the interface business type recorded in the description information of each changed interface.

Step B: Determine a second authentication channel in the existing authentication channels that matches the determined interface service type, and send an interface binding reminder to a client used by the administrator of the second authentication channel.

Specifically, since the authentication channel corresponds to the services provided by the online business platform, the online business platform can record the services corresponding to each authentication channel. Furthermore, the online business platform uses the authentication channel corresponding to the service and the authentication channel with the same interface service type as the second authentication channel. Then, in the information of the second authentication channel recorded in the online business platform, the information of the manager of the second authentication channel is determined, and an interface binding reminder is sent to the client used by the above manager. In this way, the manager can be notified in time to perform binding operations on the interface that may be related to the authentication channel that the manager is responsible for, reducing the possibility of users forgetting to bind the interface and reducing user errors or untimely operations.

In one embodiment of the present invention, based on the embodiment provided in Figure 2 above, the method further includes: if an interface change occurs on the online business platform, obtaining the interface status of the changed interface; if the interface status indicates that the changed interface is not an abandoned interface, sending an interface change reminder to the client used by the administrator of the authentication channel.

The following describes a method for determining the changed interface.

When the interface of the online business platform changes, the online business platform built based on the swagger framework can read the annotations of the interface methods to obtain the interface description information. Then the online business platform can parse the interface description information and generate an interface document. Among them, the interface document can be a swagger document generated based on the swagger framework. After the interface changes, the online business platform can read the corresponding interface document before the interface change and the corresponding interface document after the interface change, compare the interfaces with differences in the two interface documents, and then determine the changed interface.

The following describes a method for obtaining the interface status of the changed interface.

Specifically, after the online business platform determines that an interface change has occurred on the business platform, the online business platform traverses the local code for the method of the changed interface, reads the annotation of the method of the changed interface, obtains the interface description information of the changed interface, and then obtains the interface status of the changed interface based on the obtained interface description information. When developers write the local code corresponding to each interface, they can add annotations to the interface methods and mark the interface status of the interface in the annotations.

If the interface status indicates that the changed interface is a deprecated interface, the requester will no longer call the interface. If the interface status indicates that the changed interface is not a deprecated interface, for example, the interface status is a newly added interface or a changed interface, the online business platform sends an interface change reminder to the client used by the authentication channel manager. In this way, the authentication channel manager can be reminded in a timely manner to perform operations such as binding or unbinding the interface bound to the authentication channel, reducing errors caused by untimely user operations.

In one embodiment of the present invention, based on the embodiment provided in FIG. 2 , after step S205 , the interface binding method further includes: triggering a binding review process for the target interface; if the review is passed, executing step S206 .

After receiving the interface binding instruction for the authentication channel and the target interface sent by the user using the client, the online business platform can trigger the binding review process of the target interface, and send a binding review reminder to the reviewer preset for the target interface binding review process, and can also show the reviewer the information of the authentication channel involved in the interface binding instruction and the interface information of the target interface. If the binding review process is reviewed and passed, step S206 is executed.

In this way, the authentication and authorization processes can be combined in the online business platform, and the security of calling the interface bound to the authentication channel can be improved through the review process.

Corresponding to the above-mentioned swagger-based call request authentication method, an embodiment of the present invention also provides a swagger-based call request authentication device.

Referring to FIG. 5 , a schematic diagram of a structure of a call request authentication device is provided. The device is applied to an online business platform built based on swagger. The device includes:

A call request receiving module 501 is used to receive a call request for an interface carrying a channel identifier and request verification information;

An authentication channel determination module 502 is used to determine a first authentication channel corresponding to the channel identifier among the existing authentication channels, wherein the authentication channel corresponds to a service provided by the online service platform, and the authentication channel is bound with an interface for accessing the service corresponding to the authentication channel;

The verification information matching module 503 is used to determine whether the first verification information corresponding to the first authentication channel matches the requested verification information; if they match, the interface determination module 504 is triggered;

The interface determination module 504 is used to determine that the interface bound to the first authentication channel is the interface that the call request is authorized to call.

As can be seen from the above, in the scheme provided by the embodiment of the present invention, the first authentication channel corresponding to the channel identifier is determined based on the channel identifier carried by the call request, and whether the call request can access the interface bound to the first authentication channel is determined by whether the verification information of the first authentication channel matches the request verification information. In the case that the interface that needs to be authenticated changes, the online business platform can modify and adjust the interface during operation based on swagger, so that the interface bound to the authentication channel can be changed. Because the interface is authenticated by the verification information corresponding to the authentication channel, the binding relationship between the changed interface and the authentication channel is modified, that is, the authentication method of the changed interface that needs to be authenticated can be modified, and there is no need to use hard coding to modify the route with each changed interface, nor to modify the interception rules in the code layer of the online business platform. It only needs to bind the changed interface that needs to be authenticated to the authentication channel of the business to which the interface belongs. It can be seen that the scheme provided by the embodiment of the present invention can improve the convenience of configuring the authentication scheme for the call request of the interface.

In one embodiment of the present invention, the online business platform binds the interface to the authentication channel in the following manner:

Obtain the interface description information recorded in the local code of the online business platform;

Based on the obtained interface description information, determine the interface information of the external access interface of the service provided by the online service platform;

Displaying the determined interface information on the user interface;

Create an authentication channel and display the authentication channel information on the user interface;

Determine the target interface of the service corresponding to the authentication channel selected by the user based on the displayed interface information;

Establish a binding relationship between the authentication channel and the target interface, and store the binding relationship.

As can be seen from the above, the online business platform displays the interface information of the determined external access interface in the user interface according to the obtained interface description information, so that the user can intuitively view the interface information and improve the user experience. The user can intuitively understand the detailed information of each interface, and the clear display of interface information can also reduce the user's erroneous operation. After the online business platform creates the authentication channel, it displays the information of the authentication channel in the user interface, so that the user can view the information of the authentication channel and the interface information, so that the user can visually view and determine the binding relationship between the interface and the authentication channel, so that the user can intuitively determine the target interface selected for the authentication channel. After determining that the user selects the target interface for the authentication channel based on the displayed interface information, the online business platform establishes a binding relationship between the authentication channel and the target interface, and stores the binding relationship, so that the user can configure the authentication scheme for the target interface by binding the authentication channel and the target interface, without relying on hard coding and configuration files, further improving the convenience of configuring the authentication scheme for the call request of the interface.

In one embodiment of the present invention, after the authentication channel is created, the method further includes:

Issue keys for authentication channels;

Determining whether the first verification information corresponding to the first authentication channel matches the requested verification information includes:

Generate first verification information based on the secret key corresponding to the first authentication channel;

Determine whether the first verification information matches the request verification information.

As can be seen from the above, since each authentication channel can be configured with a verification information generation method corresponding to the authentication channel, different encryption and decryption methods and different authentication schemes can be used to generate verification information. The solution provided by the embodiment of the present invention can support a variety of different encryption and decryption methods, different authentication schemes, etc. In this way, users can bind interfaces with authentication channels according to different authentication requirements of interfaces, different encryption and decryption requirements, and different authentication schemes, further improving the convenience of configuring authentication schemes for interface call requests.

In one embodiment of the present invention, the interface information includes at least one of the following information:

The full name of the interface class, the interface class access path, the interface class description information, the interface device name, the interface device access path, the interface device description information, the interface request type, and the interface service type.

It can be seen that displaying interface information to users in as much detail as possible can improve user experience, allowing users to more intuitively understand the detailed information of each interface. Clearly displaying interface information can also reduce user errors.

In one embodiment of the present invention, the information of the authentication channel includes at least one of the following information:

Channel ID, channel name, channel key, channel description information, and interface information of the interface bound to the authentication channel.

It can be seen that displaying authentication channel information to users in as much detail as possible can improve the user experience, allowing users to more intuitively understand the detailed information of each authentication channel. Clearly displaying authentication channel information can reduce user errors. It allows users to more intuitively configure authentication schemes for interface call requests, improving convenience.

In one embodiment of the present invention, after obtaining the interface description information recorded in the local code of the online service platform, the method further includes:

Determine the interface service type of the interface corresponding to each interface description information according to the obtained interface description information;

A second authentication channel that matches the determined interface service type among the existing authentication channels is determined, and an interface binding reminder is sent to a client used by a manager of the second authentication channel.

In this way, the administrator can be notified in time to perform binding operations on the interfaces that may be related to the authentication channels that the administrator is responsible for, thereby reducing the possibility of users forgetting to bind the interfaces and reducing user errors or untimely operations.

In one embodiment of the present invention, the online business platform further includes:

If an interface change occurs on the online business platform, obtain the interface status of the changed interface;

If the interface status indicates that the changed interface is not a deprecated interface, an interface change reminder is sent to a client used by the administrator of the authentication channel.

In this way, the administrator of the authentication channel can be reminded in time to perform operations such as binding or unbinding the interface bound to the authentication channel, thereby reducing errors caused by untimely user operations.

In one embodiment of the present invention, after determining the target interface of the service corresponding to the authentication channel selected by the user based on the displayed interface information, the method further includes:

Trigger the binding review process for the target interface;

If the verification is passed, the steps to establish a binding relationship between the authentication channel and the target interface are executed.

In this way, the authentication and authorization processes can be combined in the online business platform, and the security of calling the interface bound to the authentication channel can be improved through the review process.

The embodiment of the present invention further provides an electronic device, as shown in FIG6 , including a processor 601, a communication interface 602, a memory 603 and a communication bus 604, wherein the processor 601, the communication interface 602, and the memory 603 communicate with each other through the communication bus 604.

Memory 603, used for storing computer programs;

The processor 601 is used to implement any of the above-mentioned swagger-based call request authentication methods when executing the program stored in the memory 603.

The communication bus mentioned in the above electronic device can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

The communication interface is used for communication between the above electronic device and other devices.

The memory may include a random access memory (RAM) or a non-volatile memory (NVM), such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

In another embodiment provided by the present invention, a computer-readable storage medium is also provided, in which a computer program is stored. When the computer program is executed by a processor, any of the above-mentioned swagger-based call request authentication methods is implemented.

In another embodiment provided by the present invention, a computer program product comprising instructions is also provided, which, when executed on a computer, enables the computer to execute any of the above-mentioned swagger-based call request authentication methods.

In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented by software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present invention is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state hard disk Solid State Disk (SSD)), etc.

It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

Each embodiment in this specification is described in a related manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device, electronic device, computer storage medium, and computer program product embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiments.

The above description is only a preferred embodiment of the present invention and is not intended to limit the protection scope of the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention are included in the protection scope of the present invention.

Claims (10)

1. A call request authentication method based on swagger, characterized in that it is applied to an online business platform built based on swagger, and the method includes: Receive a call request for an interface carrying a channel identifier and request verification information; Determine a first authentication channel corresponding to the channel identifier among the existing authentication channels, wherein the authentication channel corresponds to a service provided by the online service platform, and the authentication channel is bound with an interface for accessing the service corresponding to the authentication channel; Determining whether the first verification information corresponding to the first authentication channel matches the requested verification information; If they match, determining that the interface bound to the first authentication channel is the interface that the call request is authorized to call; The online business platform binds an interface to the authentication channel in the following manner: Obtaining interface description information recorded in the local code of the online business platform; Based on the obtained interface description information, determine the interface information of the external access interface of the service provided by the online service platform; Displaying the determined interface information on the user interface; Creating the authentication channel, and displaying information of the authentication channel on the user interface; Determining a target interface for the service corresponding to the authentication channel selected by the user based on the displayed interface information; A binding relationship is established between the authentication channel and the target interface, and the binding relationship is stored. 2. The method according to claim 1, characterized in that after the creation of the authentication channel, it also includes: Issuing a secret key for the authentication channel; The determining whether the first verification information corresponding to the first authentication channel matches the request verification information includes: Generate first verification information based on the secret key corresponding to the first authentication channel; Determine whether the first verification information matches the request verification information. 3. The method according to claim 1 or 2, characterized in that the interface information includes at least one of the following information: The full name of the interface class, the interface class access path, the interface class description information, the interface method name, the interface method access path, the interface method description information, the interface request type, and the interface service type. 4. The method according to claim 1 or 2, characterized in that the information of the authentication channel includes at least one of the following information: Channel identification, channel name, channel key, channel description information and interface information of the interface bound to the authentication channel. 5. The method according to claim 1 or 2, characterized in that after obtaining the interface description information recorded in the local code of the online business platform, it also includes: Determine the interface service type of the interface corresponding to each interface description information according to the obtained interface description information; A second authentication channel that matches the determined interface service type among the existing authentication channels is determined, and an interface binding reminder is sent to a client used by an administrator of the second authentication channel. 6. The method according to claim 1 or 2, characterized in that the method further comprises: If an interface change occurs on the online business platform, obtain the interface status of the changed interface; If the interface status indicates that the changed interface is not a deprecated interface, an interface change reminder is sent to a client used by the administrator of the authentication channel. 7. The method according to claim 1 or 2, characterized in that after determining the target interface of the corresponding service selected by the user for the authentication channel based on the displayed interface information, it also includes: Triggering a binding review process for the target interface; If the verification is passed, the step of establishing a binding relationship between the authentication channel and the target interface is executed. 8. A swagger-based call request authentication device, characterized in that it is applied to an online business platform built based on swagger, and the device includes: A call request receiving module, used to receive a call request for an interface carrying a channel identifier and request verification information; An authentication channel determination module, used to determine a first authentication channel corresponding to the channel identifier among existing authentication channels, wherein the authentication channel corresponds to a service provided by the online service platform, and the authentication channel is bound with an interface for accessing the service corresponding to the authentication channel; A verification information matching module, used to determine whether the first verification information corresponding to the first authentication channel matches the request verification information; if they match, triggering the interface determination module; The interface determination module is used to determine that the interface bound to the first authentication channel is the interface that the call request is authorized to call; The online business platform binds an interface to the authentication channel in the following manner: Obtaining interface description information recorded in the local code of the online business platform; Based on the obtained interface description information, determine the interface information of the external access interface of the service provided by the online service platform; Displaying the determined interface information on the user interface; Creating the authentication channel, and displaying information of the authentication channel on the user interface; Determining a target interface for the service corresponding to the authentication channel selected by the user based on the displayed interface information; A binding relationship is established between the authentication channel and the target interface, and the binding relationship is stored. 9. An electronic device, characterized in that it comprises a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus; Memory, used to store computer programs; A processor, for implementing the method steps described in any one of claims 1 to 7 when executing a program stored in a memory. 10. A computer-readable storage medium, characterized in that a computer program is stored in the computer-readable storage medium, and when the computer program is executed by a processor, the method steps described in any one of claims 1 to 7 are implemented.