A method and device for securely accessing a service interface

Abstract

The invention discloses a secure access method and device for a service interface, and relates to the technical field of computers. A specific implementation of the method includes: the server side generates a token according to the token acquisition request sent by the client requesting the token, and sends the token to the client requesting the token, and saves the The corresponding relationship between the token and the client requesting the token; when the server receives an access request from a client to be accessed, it verifies the Whether the incoming client is the client of the request token, if the verification is passed, the client to be accessed is allowed to access the service interface, otherwise, the client to be accessed is refused to access the service interface service interface. This embodiment enhances the identity verification capability, data integrity and anti-swiping capability of the backend server if the cost permits.

Description

technical field [0001] The invention relates to the field of computer technology, in particular to a method and device for securely accessing a service interface. Background technique [0002] With the advent of the Internet era, more and more services are transferred from offline to online, and the volume of applications continues to grow. Due to the needs of some special scenarios, the traditional network request technology (short connection) has been difficult to meet, so the long connection technology that is more suitable for these specific scenarios has gradually developed. Due to the specific properties of persistent connection technology, when designing such services, it is necessary to carefully design strategies to ensure that background service resources can be used to maximize effective services, otherwise some simple malicious attacks will have a great impact Availability and robustness of services. [0003] Currently, the most commonly used attack modes for p...

AI Technical Summary

Problems solved by technology

There are many defects in the above scheme: First, the information in the cookie is very easy to be obtained by a third party. Once the third party obtains the information, it is fully capable of forging the identity by modifying the cookie, so as to pass the identity verification; Tampering, in some cases, is also easy to cause purposeful damage to the server; third, the information in the cookie can be used repeatedly before it becomes invalid, and the third party can request the server to attack the server after obtaining the information, thus overwhelming the server make the service unavailable

[0006] Existing solutions cannot effectively verify the identity of the requester, cannot prevent the information in the cookie from being stolen or tampered with, cannot meet the anti-swiping requirements of the server, and thus cannot effectively resist illegal attacks on the server

Images