User identification security verification method and device based on shiro framework, and computer medium

Abstract

The invention provides a user identification security verification method based on a shiro framework, which relates to the field of network security, and the method comprises the following steps that: a user inputs a verification code and an account password in a browser, and the browser sends the verification code and the account password to a server in a post form; the server carries out verification after receiving the verification, and if the verification is passed, the server generates a JWT token and presets the expiration time of the token; the server returns the generated JWT to the browser; the browser comprises a JWT (JavaScript Weighted Table) in an augmentation header, and then sends a request to the server; the server extracts user information from the JWT fed back by the browser and configures the user information in a data structure server Redis; related configuration files in the shiro framework are rewritten, and enhanced security verification is carried out on the token; and if the verification is passed, the network interface needing to be accessed is called. The problem that illegal operation is carried out due to the fact that the item is not provided with the timeliness of the token, the security risk exists, the user identifier is likely to be intercepted and the user information is analyzed is solved.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a shiro framework-based user identification security verification method, device and computer medium. Background technique [0002] At present, most front-end and back-end separation projects on the market are based on tokens for security verification. Many projects do not set the timeliness of tokens, and tokens may be valid all the time or for a period of time. Therefore, the existing technology has the following security problems : Once other personnel obtain this token after the user logs in to the page, they can directly request various interfaces without operating the page, and the user ID may be intercepted and user information parsed, thereby being illegally used. Contents of the invention [0003] Aiming at the deficiencies of the prior art, the present invention provides a user identification security verification method, device and computer medium based on t...

AI Technical Summary

Problems solved by technology

[0002] At present, most front-end and back-end separation projects on the market are based on tokens for security verification. Many projects do not set the timeliness of tokens, and tokens may be valid all the time or for a period of time. Therefore, the existing technology has the following security problems : Once other personnel obtain the token after the user logs in to the page, they can directly request various interfaces without operating the page, the user ID may be intercepted, and the user information may be parsed, thereby being illegally used

Images