A method and system for preventing illegal access to server

Abstract

The invention discloses a method and system for preventing illegal access to a server, wherein the prevention method includes: the client generates a session ID and sends it to the server; the server receives the session ID and encrypts it to obtain a session key, and synchronizes the session key to the client end; the client generates the original resource URL to be requested, uses the session key to encrypt the session identifier and the original resource URL, and appends the session identifier to obtain a new URL; the client sends an access request to the server based on the new URL; the server obtains the URL from the new URL session ID and obtain the session key; use the session key to decrypt the new URL to obtain the decrypted session ID and the decrypted URL; judge whether the decrypted session ID is consistent with the directly obtained session ID, otherwise reject the request visit; if yes, allow the visit. The invention increases the difficulty of deciphering the session key, can easily update the session key, and can effectively prevent illegal access to the server from occurring.

Description

technical field [0001] The invention belongs to the communication field, in particular to a method and system for preventing illegal access to a server. Background technique [0002] At present, most of the interactive interfaces between the client and the server are implemented through http, wherein the server provides external access interfaces, and these interfaces provide standard http services. [0003] In the prior art, the process of interaction between the client and the server is as follows: [0004] First, the client generates a resource URL (Uniform Resource Locator, Uniform Resource Locator) to be requested, and sends an http request to the server. [0005] Then, the server receives the request and returns the access result to the client. [0006] Finally, the client parses the access result returned by the server and processes the corresponding business logic. [0007] During the above interaction process, if a malicious client modifies the URL or its paramet...

AI Technical Summary

Problems solved by technology

This fixed session key is easy to crack and difficult to modify. If a third-party client knows the session key, it can forge a request and access the back-end interface of the server, resulting in information leakage and the server being unable to serve normal users.