Token generation method and device, token verification method and device, equipment and storage medium

Abstract

The invention discloses a token generation method, a token signature verification method, a token signature verification device, equipment and a storage medium. The token generation method comprises the steps of generating a key pair based on current latest user information acquired through a client; constructing target information to be signed, and signing the target information based on a private key in the key pair to obtain a signature value corresponding to the current latest user information; and constructing a corresponding token based on the target information, the signature value and a public key in the key pair, and sending the token to the client, so that the client verifies the signature of the token. According to the method and the device, the key generation process is combined with the user information, so that the condition that the token is still effective when the server modifies the permission or role of a certain user after the user modifies the password is avoided, and the security of the token and the system is improved.

Description

technical field [0001] The present invention relates to the field of computer technology, in particular to a token generation method, a token verification method, a device, a device and a storage medium. Background technique [0002] JWT (Json web token, an open standard based on Json) format token (token) is often used in information systems to verify identity validity. JWT is a JSON-based token that is executed to transfer claims between network application environments An open standard, the token is designed to be compact and secure, especially suitable for single sign-on (SSO, Single Sign On) scenarios in distributed sites. The statement of JWT is generally used to pass the authenticated user identity information between the identity provider and the service provider, so as to obtain resources from the resource server, and can also add some additional statement information necessary for other business logic. The token is also Can be used directly for authentication or e...

AI Technical Summary

Problems solved by technology

[0003] The JWT token in the current system, when the user information is changed during use, the user's token is still valid, which brings a certain security risk to the system

Images