A login verification processing method, system and device

Abstract

The invention discloses a login verification processing method, system and device. The method includes: when receiving a login request carrying a first token sent by a first terminal, after decrypting the first token, reading the obtained After the version number of the first token, compare the read version number with the cached version number, and perform login state verification; when receiving the token update request carrying the second token sent by the first terminal , after decrypting the second token, read the version number in the second token, compare the read version number with the cached version number, and execute the corresponding token update process; wherein, the second token The valid period of the first token is longer than that of the first token, and the second token is used for the first terminal to refresh the first token. The method can ensure idempotent processing of request information for multiple concurrent requests to update tokens, ensure logical correctness of login state verification, improve user experience, and can be widely used in the information security industry.

Description

technical field [0001] The present invention relates to the technical field of information security, in particular to a login verification processing method, system and device. Background technique [0002] Explanation of terms: [0003] OAuth: An open protocol that provides a secure, open and simple standard for authorization of user resources. [0004] Token: Token, mark, computer term. [0005] In the current technology, the login mechanism of the login system based on the OAuth2.0 protocol is to allocate a bunch of login tokens, including the short-period token AccessToken and the long-period token RefreshToken. The general validity period of AccessToken is several hours, and the general validity period of RefreshToken is for several months. In the traditional technology, the system randomly assigns two random strings as AccessToken and RefreshToken, and then caches the pair of random strings in the cache server respectively. Consistent, if it is consistent, it is a ...

AI Technical Summary

Problems solved by technology

[0006] When refreshing the login state token concurrently according to the RefreshToken, if there are multiple concurrent refresh token requests, since the business server cannot guarantee the order of concurrent refresh token requests, the login server verifies the consistency of the random string correctly After that, a new random string will be generated immediately to overwrite the current cache, which will lead to concurrent refresh token requests. Only one request to update the token succeeds, while other requests will be caused by the inconsistency between the cached random string and the requested random string. Request failed

And the return packets of concurrent requests cannot guarantee the sequence, so it is possible that before the request for successful refresh is returned, the random string is inconsistent, resulting in the return packet of the request for refresh token failure being returned to the client, causing the client to respond to the user's status The user login state fails, and the user needs to log in again through the account password, which cannot guarantee the idempotency of the login state, and seriously affects the user experience

Images