Secure access method and device for a service interface

Abstract

The invention discloses a secure access method and device for a service interface, and relates to the technical field of computers. A specific embodiment of the method comprises the following steps: aserver generates a token according to a token acquisition request sent by a client requesting the token, sends the token to the client requesting the token, and stores a corresponding relationship between the token and the client requesting the token; When the server side receives an access request sent by a client side to be accessed, the server side sends the access request to the client side;and verifying whether the to-be-accessed client is the client of the request token according to the stored corresponding relationship, if the verification is passed, allowing the to-be-accessed clientto access the service interface, and otherwise, refusing the to-be-accessed client to access the service interface. According to the embodiment, the identity verification capability, the data integrity and the anti-brushing capability of the background server side are enhanced under the condition that the cost is allowed.

Description

technical field [0001] The invention relates to the field of computer technology, in particular to a method and device for securely accessing a service interface. Background technique [0002] With the advent of the Internet era, more and more services are transferred from offline to online, and the volume of applications continues to grow. Due to the needs of some special scenarios, the traditional network request technology (short connection) has been difficult to meet, so the long connection technology that is more suitable for these specific scenarios has gradually developed. Due to the specific properties of persistent connection technology, when designing such services, it is necessary to carefully design strategies to ensure that background service resources can be used to maximize effective services, otherwise some simple malicious attacks will have a great impact Availability and robustness of services. [0003] Currently, the most commonly used attack modes for p...

AI Technical Summary

Problems solved by technology

There are many defects in the above scheme: First, the information in the cookie is very easy to be obtained by a third party. Once the third party obtains the information, it is fully capable of forging the identity by modifying the cookie, so as to pass the identity verification; Tampering, in some cases, is also easy to cause purposeful damage to the server; third, the information in the cookie can be used repeatedly before it becomes invalid, and the third party can request the server to attack the server after obtaining the information, thus overwhelming the server make the service unavailable

[0006] Existing solutions cannot effectively verify the identity of the requester, cannot prevent the information in the cookie from being stolen or tampered with, cannot meet the anti-swiping requirements of the server, and thus cannot effectively resist illegal attacks on the server

Images