JWT-based authorization method capable of being manually revoked

Abstract

The invention relates to application of a network authorization technology, in particular to a JWT-based authorization method capable of being manually revoked, which is an efficient, recyclable and instantly-updated authorization mechanism based on an access token. The method comprises a program used for providing login certificate verification and a server access token verification process; theprogram for providing the login certificate verification comprises the following steps: 1a, querying user information according to the login certificate; 2a, judging whether the user information can be obtained or not, and generating token ID assembly token data if the user information can be obtained; 3a, performing digital signature on the token data in the 2a; 4a, storing the token informationin a persistent database, and creating an access token record; 5a, setting the token to an X-Access-Token response header, and ending the authentication; 6a, judging whether the user information can be obtained or not in the 2a, and if the user information cannot be obtained, directly ending the authentication.

Description

technical field [0001] The invention relates to the application of network authorization technology, in particular to a JWT-based authorization method that can be manually revoked. Background technique [0002] Granting and authentication of client user rights is an essential function of an Internet application. The mainstream authentication methods include cookie and session-based authentication methods and access token-based authentication methods. [0003] Traditional web applications use Session to store user authorization information on the server side. This method is easy to implement, and the client hardly needs to do additional processing. It is only necessary for the server to set the Session ID that needs to be saved in the client's Cookie in the response header, and only need to destroy the Session on the server side to realize the authority. recycling. However, the cookie-based authentication method has web security problems, and it is easy to steal the client...

AI Technical Summary

Problems solved by technology

However, the cookie-based authentication method has web security problems, and it is easy to steal the client's authority through client redirection.

In addition, using Session to store user authorization information will consume the memory space of the server, making it difficult to cope with high concurrent requests

Images