Token-based client identity verification method and system

Abstract

The invention discloses a token-based client identity verification method and system, and relates to the field of information technology. The method comprises the following steps: waiting for to receive a user name and password information sent by a client; judging whether the user name and the password information match with the user name and the password information stored in a server, and if not, prompting re-input; if so, generating an authorization token corresponding to a user ID; storing the authorization token in a database and returning the authorization token to the client; waiting for to receive request information sent by the client, and judging whether the request information carries the authorization token: if the request information carries the authorization token, judging whether the authorization token is valid, and if the authorization token invalid, returning re-login information; if the authorization token is valid, judging whether the authorization token stored inthe database is consistent with the authorization token carried in the request information, and if so, indicating that the verification is passed; if not, indicating that the verification fails, and returning account remote login information; and if the request information does not carry the authorization token, returning the re-login information.

Description

technical field [0001] The present application relates to the field of information technology, in particular, to a method and system for token-based client authentication. Background technique [0002] Json web token (JWT) is a JSON-based development standard (RFC 7519) implemented for the transmission of claims between network application environments. The token is designed to be compact and secure, and is especially suitable for single sign-on on distributed sites ( SSO) scenario. The statement of JWT is generally used to pass the authenticated user identity information between the identity provider and the service provider, so as to obtain resources from the resource server, and can also add some additional statement information necessary for other business logic. The token is also Can be used directly for authentication or encrypted. [0003] In the traditional sessino-based authentication, after each user is authenticated by the application, a record must be made on t...

AI Technical Summary

Problems solved by technology

In this way, after the user password or token is leaked, changing the password cannot prevent others from logging in, and it is impossible to know in time that the account information has been leaked, which poses a security risk

Images