Method, device and electronic device for controlling interface authority

Abstract

The present disclosure discloses a method, device, electronic device and storage medium for controlling interface permissions. The method parses the interface request information after receiving the interface request information to obtain a token, a request method and an interface path; obtains a first interface permission list corresponding to the user number from a database according to the user number in the token; obtains a second interface permission list corresponding to the request method from a configuration file according to the interface path; obtains a third interface permission list by taking the intersection of the first interface permission list and the second interface permission list; and performs interface business operations according to the set state of the third interface permission list. The method achieves the effects of high security, low resource occupation, high concurrency and low code intrusion in the process of interface permission control.

Description

Technical Field

[0001] The present disclosure relates to the technical field of interface authority, and in particular to a method, device and electronic device for controlling interface authority. Background Art

[0002] In an enterprise information management system, different departments and user roles often have different system access permissions due to their different responsibilities. Currently, most enterprise information management systems adopt a front-end and back-end separation architecture. Users can obtain corresponding data information by calling the back-end service interface on the front end to perform related business operations.

[0003] Based on the architecture model with front-end and back-end separation, although the back-end no longer controls how the page is displayed and only needs to provide an interface to the outside world, the front-end cannot directly call the business logic code in the back-end system and can only obtain data by calling the interface to make authority judgments. In the prior art, the interfaces that need to be requested in each page of the front-end are listed to form an account-role-API interface association logic to implement the judgment of API interface permissions. However, this solution has the problem of occupying a large amount of resources when processing a single API interface request, thereby reducing the system's response speed, and the problem of low concurrency and difficult system maintenance. Summary of the invention

[0004] The main purpose of the present disclosure is to provide a method, device and electronic device for controlling interface permissions, so as to solve the problems of low security, low concurrency, high resource occupancy and serious code intrusion in the interface permission control process.

[0005] In order to achieve the above object, according to a first aspect of the present disclosure, a method for controlling interface permissions is provided, comprising:

[0006] After receiving the interface request information, parse the interface request information to obtain a token, a request method, and an interface path;

[0007] According to the user number in the token, obtaining a first interface permission list corresponding to the user number from a database;

[0008] According to the interface path, obtaining a second interface permission list corresponding to the request method from a configuration file;

[0009] Taking the intersection of the first interface permission list and the second interface permission list to obtain a third interface permission list;

[0010] The service operation of the interface is performed according to the collection state of the third interface permission list.

[0011] In a possible implementation manner, acquiring, according to the interface path, from a configuration file a second interface permission list corresponding to the request method includes:

[0012] According to the matching rule of the interface path, the configuration file is parsed to generate a priority dictionary and a common dictionary;

[0013] According to the interface path, query the corresponding permission sub-dictionary from the priority dictionary;

[0014] If there is no matching rule matching the interface path in the priority dictionary, query the permission sub-dictionary from the common dictionary;

[0015] According to the request mode, a corresponding second interface permission list is screened out from the permission sub-dictionary.

[0016] In a possible implementation, parsing the configuration file according to the matching rule of the interface path to generate a priority dictionary and a common dictionary includes:

[0017] Parsing the configuration file into a common dictionary according to a regular matching rule, and parsing the configuration file into a priority dictionary according to a full path matching rule;

[0018] The priority dictionary or the common dictionary contains at least one interface path, multiple request modes and at least one interface permission.

[0019] In a possible implementation manner, taking the intersection of the first interface permission list and the second interface permission list to obtain a third interface permission list includes:

[0020] Taking the interface permissions in the interface permission list as the unit element of the set, finding the intersection of all first interface permissions in the first interface permission list and all second interface permissions in the second interface permission list to obtain a third interface permission set;

[0021] According to the third interface permission set, the third interface permission list is obtained.

[0022] In a possible implementation, performing a service operation of the interface according to the set state of the third interface permission list includes:

[0023] If the third interface permission set is an empty set, an error message or access denial prompt message is returned to the client;

[0024] If the third interface permission set is not an empty set, corresponding operations are performed on the information in the database according to the third interface permission, and normal operation information is returned to the client.

[0025] In a possible implementation manner, parsing the configuration file according to the matching rule of the interface path to generate a priority dictionary and a common dictionary further includes:

[0026] The priority dictionary and the common dictionary are cached in the memory as global variables.

[0027] According to a second aspect of the present disclosure, there is provided a device for controlling interface permissions, comprising:

[0028] The parsing module is used to parse the interface request information after receiving the interface request information to obtain the token, request method and interface path.

[0029] The first acquisition module is used to acquire a first interface permission list corresponding to the user number from a database according to the user number in the token.

[0030] The second acquisition module is used to acquire a second interface permission list corresponding to the request method from a configuration file according to the interface path.

[0031] The logic operation module is used to obtain an intersection of the first interface permission list and the second interface permission list to obtain a third interface permission list.

[0032] An execution module is used to perform business operations of the interface according to the collection state of the third interface permission list.

[0033] According to a third aspect of the present disclosure, there is provided an electronic device, including:

[0034] at least one processor; and

[0035] a memory communicatively connected to the at least one processor; wherein,

[0036] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method described in the first aspect of the present disclosure.

[0037] According to a fourth aspect of the present disclosure, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to cause the computer to execute the method described in the first aspect of the present disclosure.

[0038] The interface authority control method, device, electronic device and storage medium provided by the present disclosure, after receiving the interface request information, parse the interface request information to obtain the token, request method and interface path; according to the user number in the token, obtain the first interface authority list corresponding to the user number from the database; according to the interface path, obtain the second interface authority list corresponding to the request method from the configuration file; take the intersection of the first interface authority list and the second interface authority list to obtain the third interface authority list; according to the collection state of the third interface authority list, perform the business operation of the interface. The effects of high security, low resource occupation, high concurrency and less code intrusion in the interface authority control process are achieved. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the implementation methods of the present disclosure or the technical solutions in the prior art, the drawings required for use in the implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0040] Figure 1 A flowchart of a method for controlling interface permissions provided by an embodiment of the present disclosure;

[0041] Figure 2 A flowchart of another method for controlling interface permissions provided by an embodiment of the present disclosure;

[0042] Figure 3 A configuration file provided for an embodiment of the present disclosure;

[0043] Figure 4 An exemplary common dictionary and an exemplary priority dictionary provided for embodiments of the present disclosure;

[0044] Figure 5 A permission sub-dictionary provided for an embodiment of the present disclosure;

[0045] Figure 6 A flow chart of an interface authority control method provided by an embodiment of the present disclosure;

[0046] Figure 7 A block diagram of a control device for interface permissions provided in an embodiment of the present disclosure;

[0047] Figure 8 A schematic diagram of an electronic device provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0048] In order to make the purpose, technical solution and advantages of the embodiments of the present disclosure clearer, the technical solution in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are only part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present disclosure.

[0049] It should be understood that in the various embodiments of the present disclosure, the size of the sequence number of each process does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present disclosure.

[0050] It should be understood that the terms "first", "second", etc. in the specification and claims of the present disclosure and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence, and the data used in this way can also be interchanged under appropriate circumstances. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or modules is not necessarily limited to those steps or modules clearly listed, but may include other steps or modules that are not clearly listed or inherent to these processes, methods, products or devices.

[0051] The following specific embodiments are used to describe the technical solution of the present disclosure in detail. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments.

[0052] like Figure 1 FIG. 1 is a flow chart of a method for controlling interface permissions provided by an embodiment of the present disclosure, the method comprising:

[0053] Step S101: After receiving the interface request information, parse the interface request information to obtain a token, a request method and an interface path.

[0054] In this step, after the user enters his account number and password on the web front-end login page, he enters the operation page of the service system to perform business operations on the data. In the disclosed embodiment, the user initiates a request message to access the database on the front-end page. After receiving the user's request message, the back-end service system will parse the user's request message to obtain the token, request method and interface path. Here, the user's request message is parsed in the middleware. The so-called "middleware" is an independent system software service program. Distributed application software uses this software to share resources between different technologies. The middleware is located on the operating system of the client server and manages computing resources and network communications.

[0055] It is worth noting that in the disclosed embodiment, after the user logs in to the system, the pages presented to different users by the system should be different, which is manifested in loading different pages according to the permissions the user has. For buttons or pages that are not within the user's access scope, the system will gray them out or hide them. Users can obtain normal system responses when operating content items for which they have permissions, so as to carry out subsequent business operations. For content items that are not within their permissions, if they operate incorrectly, they can only obtain system error responses or access denial.

[0056] In this embodiment, the token is a string of characters containing user identity information automatically generated by the system server after the user logs in to the system. It is used as a unique identifier of the user's identity, so that when the user frequently accesses the system, the authentication pressure of the server can be reduced. The request method means the purpose of the user's operation on the data, such as obtaining data, creating data, or updating data. The request path means the target of the user's operation, which is stored in the database in the form of an index address.

[0057] Step S102: According to the user number in the token, obtain a first interface permission list corresponding to the user number from a database.

[0058] In this step, after receiving the user token, the server parses the token to obtain the user ID userid, and then searches the database for the corresponding first interface permission list according to the userid. Here, the first interface permission is pre-assigned by the administrator according to the user's role and stored in the database.

[0059] Step S103: According to the interface path, obtain a second interface permission list corresponding to the request method from the configuration file.

[0060] In this step, the configuration file is pre-set and stored in the code base of the backend server, or stored in a separate code base, for easy version management and tracking. Here, the configuration file format is not limited, and can be any format such as json, yaml, xml, ini, etc., as long as the system can parse it.

[0061] In this embodiment, after the configuration file is defined, it is not used directly. Instead, the configuration file is parsed into two dictionaries according to the form of the request path in the configuration file, and the two dictionaries are stored in the memory as global variables. Subsequent acquisition of interface permissions is queried from these two dictionaries. Here, the interface path in one dictionary contains regular matching rules, and the interface path in the other dictionary does not contain regular matching rules. By using a pre-defined configuration file, the system can be made more convenient when obtaining permissions, and the resource occupancy of the system can be effectively reduced, thereby improving the response speed of the system.

[0062] In this embodiment, firstly, a matching dictionary is selected from two dictionaries according to the interface path, and then the corresponding interface permission list is obtained from the matching dictionary according to the request mode.

[0063] In this embodiment, the WEB backend server obtains the corresponding interface authority according to the interface path, thereby transferring the part that originally required network IO to interact with the database and the database to perform calculations to the CPU of the backend server, thereby effectively solving the problem of high network IO and database resource usage.

[0064] Step S104: Take the intersection of the first interface permission list and the second interface permission list to obtain a third interface permission list.

[0065] In this step, the intersection means selecting the same elements from the first interface permission list and the second interface permission list to form a third interface permission list. Since the first interface permission list is obtained based on the visitor's token, it is a collection of all permissions that the visitor has. The second interface permission list is obtained based on the request path and the corresponding request method, and is an interface permission with a specific direction. In the embodiment of the present disclosure, the intersection of the above-mentioned first and second interface permission lists is taken to ensure that when the visitor operates on the data in the database, that is, he must have the permission to access it, and at the same time, the target to be operated must have an interface to access it, so that the visitor can smoothly realize the business operation requirements of the target. In short, the interface permission control method provided in the embodiment of the present disclosure, in order to successfully realize the relevant business operations on the data in the database, requires a logical association structure based on account-role-permission-interface to be successfully executed.

[0066] Step S105: Perform interface business operations according to the collection state of the third interface permission list.

[0067] In this step, the set state is generally an empty set or a non-empty set. If the third interface permission list obtained in step S104 is a non-empty set, the relevant business operations of the permissions in the third interface permission list are performed. If the third interface permission list is an empty set, it means that the visitor either has no permission to access, or the target that the visitor needs to access does not have a corresponding access interface, that is, the access fails.

[0068] The interface authority control method provided by the embodiment of the present disclosure is as follows: after receiving the interface request information, the interface request information is parsed to obtain the token, the request method and the interface path; according to the user number in the token, the first interface authority list corresponding to the user number is obtained from the database; according to the interface path, the second interface authority list corresponding to the request method is obtained from the configuration file; the first interface authority list and the second interface authority list are intersected to obtain the third interface authority list; according to the collection state of the third interface authority list, the interface business operation is performed. Thus, accurate control of interface access is achieved and the resource occupancy rate of the system is effectively reduced, thereby improving the response speed of the system.

[0069] like Figure 2 FIG. 1 is a flow chart of another method for controlling interface permissions provided by an embodiment of the present disclosure, the method comprising:

[0070] Step S201: After receiving the interface request information, parse the interface request information to obtain a token, a request method, and an interface path.

[0071] In this step, the implementation method is the same as the principle of step S101 in the previous embodiment, and will not be repeated here.

[0072] Step S202: According to the user number in the token, obtain a first interface permission list corresponding to the user number from a database.

[0073] In this step, it should be noted that the user can access the system, either the user information has been stored in the system, or the user needs to register a new account, and then the system administrator assigns certain permissions. After the server parses the user number userid from the token, the corresponding permission list can be obtained from the database according to the userid. For example, as shown in Table 1.1, an exemplary role permission table is provided for an embodiment of the present disclosure. The role permission table contains the userid, role name and permission name of the user. Among them, the permission name USER.EDIT corresponding to the userid is a permission that user 001 has. The so-called first interface permission list may include at least one permission similar to USER.EDIT.

[0074] Table 1.1 Role permissions table

[0075]

[0076] In the above table, a user can have multiple permissions, and each permission can include multiple permission interfaces. As shown in Table 1.2, it is an exemplary permission interface list provided in the embodiment of the present disclosure. Here, the permission USER.EDIT is taken as an example.

[0077] Table 1.2 USER.EDIT permission API interface list

[0078] Interface Path Request method Interface Description / api / user / {user_id} HTTP / GET Get employee information / api / user / HTTP / POST Create employee information / api / user / {user_id} HTTP / PATCH Updater Information / api / user / {user_id} HTTP / DELETE Deleting employee information / api / department / {department_id} HTTP / GET Get company department information

[0079] It should be noted that {user_id} and {department_id} in Table 1.2 can be regarded as the user's operation target. For example, employee No. 001 needs to obtain the information of user 002. Then, when employee 001 logs into the system, according to the request information sent by employee 001 to the server, the request path / api / user / 002 and the request method HTTP / GET can be parsed.

[0080] Step S203: Parse the configuration file according to the matching rule of the interface path to generate a priority dictionary and a common dictionary.

[0081] In this step, the matching rule of the interface path is pre-defined in the configuration file. Here, the matching rule can be a regular matching rule. For example, the interface path / api / user / ([0-9]{3})? .*$, where ([0-9]{3})? .*$ is the regular matching rule. In the configuration file, the interface path also includes those without regular matching rules, for example, the interface path / api / user. In order to more comprehensively introduce the content of the embodiment of the present disclosure, the embodiment of the present disclosure also provides the file structure and content of the configuration file.

[0082] like Figure 3 As shown, a configuration file provided by the embodiment of the present disclosure is shown. Since the configuration file can be in multiple formats, here, a configuration file in json format is taken as an example. The configuration file is named setting.json and contains a two-layer architecture, in which the USER of the first layer is the user function module of the system, and the USER.EDIT of the second layer is the pre-defined permission. Among them, the content inside the permission is the same as the structure shown in Table 1.2, including the API interface path and the corresponding request method.

[0083] from Figure 3 It can be seen that the interface path url containing regular matching rules and the corresponding request method are: / api / user / ([0-9]{3})? .*$, corresponding to HTTP / GET, HTTP / PATCH, HTTP / DELETE, / api / department / ([0-9]{3})? .*$, corresponding to HTTP / GET. The interface path url that does not contain regular matching rules and the corresponding request method are: / api / user, HTTP / POST. In addition, the above interface paths and corresponding request methods have the permission USER.EDIT. Therefore, the configuration file can be split into two parts, and the content is parsed into the following parts based on the interface path-request method-permission: the interface path containing regular matching rules is a common dictionary, and the interface path does not contain a priority dictionary.

[0084] As a possible implementation, the parsed normal dictionary and priority dictionary are cached in memory as a global variable.

[0085] In this embodiment, the permission dictionary common dictionary and priority dictionary are used as global variables, which means that the main process or subprocess related to the interface and permission can call the common dictionary and priority dictionary. When the memory is relatively sufficient, each process in the relevant main process or subprocess can load the permission dictionary in the memory separately. When the memory is not sufficient, the processes can communicate to share the same permission dictionary. Normally, the size of the permission dictionary will not exceed 1M.

[0086] As a possible implementation, the priority dictionary or the common dictionary includes at least one interface path, multiple request modes, and at least one interface permission.

[0087] like Figure 4 As shown, an exemplary common dictionary and an exemplary priority dictionary provided by an embodiment of the present disclosure, wherein: Figure 4 (a) is an exemplary general dictionary, Figure 4 (b) is an exemplary priority dictionary. The so-called priority and normal are named according to the matching priority, starting from Figure 4 It can be seen that since the priority dictionary does not contain regular matching rules, it takes less time to query permissions. In addition, there are many request methods in the priority dictionary and the ordinary dictionary that do not have assigned permissions. In actual business, the same request path and request method can also correspond to multiple permissions, which is not limited here.

[0088] It should be noted that the above configuration file is only exemplary and only includes one permission USER.EDIT. In actual applications, other permissions may also be included, which are not limited here.

[0089] Step S204: According to the interface path, query the corresponding permission sub-dictionary from the priority dictionary. If there is no matching rule matching the interface path in the priority dictionary, query the permission sub-dictionary from the common dictionary.

[0090] In this step, the server will query the interface permissions from the dictionary according to the matching priority of priority dictionary > common dictionary based on the parsed interface path. For example,

[0091] When creating employee information, the request method parsed from the corresponding HTTP request information is: HTTP / POST; the interface path is: / api / user. Since / api / user does not have a regular matching rule, the permission sub-dictionary will be searched from the priority dictionary.

[0092] like Figure 5 As shown in FIG. 1 , a permission sub-dictionary is provided in an embodiment of the present disclosure. Figure 5 As can be seen, only the request method HTTP / POST has the permission USER.EDIT.

[0093] When obtaining employee information, the request method parsed from the corresponding HTTP request information is: HTTP / GET; the interface path is: / api / user / 002. Since 002 meets the format requirements of the regular matching rule, if no corresponding matching rule is found in the priority dictionary, the permission sub-dictionary needs to be queried from the common dictionary. In the common dictionary, the permission sub-dictionary is taken from the interface path / api / user / ([0-9]{3})?.*$. Figure 4 It can be seen that in the exemplary common dictionary, the request methods HTTP / GET, HTTP / PATCH, and HTTP / DELETE all have the permission USER.EDIT. Therefore, when obtaining employee information, through the interface path / api / user / 002, the permission sub-dictionary obtained contains multiple request methods with permissions.

[0094] Here, the permission sub-dictionary may include multiple, and in other permission sub-dictionaries, the request method may also have permissions. Therefore, when querying the permission sub-dictionary, multiple request methods and corresponding permissions may be obtained.

[0095] Step S205: Filter out a corresponding second interface permission list from the permission sub-dictionary according to the request mode.

[0096] In this step, according to the permission sub-dictionary obtained in the above step S204, it is also necessary to further determine the permission corresponding to the interface path according to the request method. Taking the acquisition of employee information in the previous step S204 as an example, in step S204, it can be known that the request method HTTP / GET corresponds to a permission USER.EDIT. Therefore, in this embodiment, it is only necessary to obtain the permission USER.EDIT corresponding to HTTP / GET to form the second interface permission list. It should be noted that in the process of setting the configuration file, the request method corresponding to the interface path can also set multiple permissions, which is not limited here.

[0097] Step S206: Take the intersection of the first interface permission list and the second interface permission list to obtain a third interface permission list, and perform interface business operations according to the collection state of the third interface permission list.

[0098] In this step, as a possible implementation method, the interface permission in the interface permission list is taken as the unit element of the set, and the intersection of all the first interface permissions in the first interface permission list and all the second interface permissions in the second interface permission list is obtained to obtain a third interface permission set; and the third interface permission list is obtained according to the third interface permission set. If the third interface permission set is an empty set, an error message or access denial prompt message is returned to the client; if the third interface permission set is not an empty set, a corresponding operation is performed on the information in the database according to the third interface permission, and normal operation information is returned to the client.

[0099] In this embodiment, the intersection of the first interface permission list obtained according to the user number userid and the second interface permission list obtained according to the interface path and request method is calculated. If the first interface permission list contains the same permission as the second interface permission list, it is considered that the intersection of the two is not empty. Take the acquisition of employee information as an example. For example, if the user with userid 002 wants to operate the user data numbered 001, then the API request path can be obtained as: / api / user / 001, the request method is: HTTP / GET, and the permissions of user 002 obtained from the database are USER.EDIT, DB.EDIT, and HOST.EDIT. According to the request path / api / user / 001 and the request method HTTP / GET, only the permission USER.EDIT is obtained. Therefore, the only part of the two that is the same is the permission USER.EDIT. This shows that even if user 002 has many permissions, when operating the data of user 001, only the permission USER.EDIT is available. And according to the request method and request path, user 002 can only obtain the information of user 001 according to the request information initiated. After obtaining the permission USER.EDIT by taking the intersection of the first interface permission list and the second interface permission list, user 002 can perform database business operations on user 001's data, such as updating, deleting, modifying, and checking data.

[0100] In summary, by applying the interface authority control method provided by the embodiment of the present disclosure, it is possible to ensure that the user, under the premise of having the operating authority, can accurately obtain the authority and access interface corresponding to the user's existing operating authority according to the request information, thereby ensuring that users will not unauthorized access to ensure the security of data in the system. In addition, according to the logical association structure of request information-user number-request method-interface path, the user can quickly obtain the system response according to the request information, which not only improves the data analysis efficiency of the database, but also reduces the number of requests for the data interface. Since the service architecture of the system is optimized, it is also convenient for system maintenance.

[0101] In order to more clearly illustrate the interface authority control method provided by the embodiment of the present disclosure, the interface authority control method of the present disclosure is described below by taking the process interaction process between the front end and the server as an example.

[0102] like Figure 6 As shown, it is a process interaction sequence diagram of a method for controlling interface permissions provided by an embodiment of the present disclosure. The service system used in the process interaction sequence diagram is a SaaS system, and the system has a database. The implementation process of the method for controlling interface permissions is as follows:

[0103] Step S601: Before the user sends a request to the SaaS system, the system will load the defined configuration file into the system after startup. Then, the configuration file is parsed in the middleware to generate permission dictionaries: priority dictionary and common dictionary. These two dictionaries are stored in the memory of the server host as global variables.

[0104] Step S602: The SaaS system receives a request message carrying a token initiated by a front-end user.

[0105] Step S603: After receiving the request information, the SaaS system parses the request information to obtain the token, request method and request path.

[0106] Step S604: The SaaS system parses the token to obtain the user ID, and queries the database for the corresponding permission list according to the user ID. After receiving the query instruction from the SaaS system, the database feeds back the query result, i.e., permission list 1, to the SaaS system.

[0107] Step S605: The SaaS system matches the permission list 2 required by the API interface from the permission dictionary cached in the memory according to the request path and the request method. Subsequently, the calculation module of the SaaS system takes the intersection of the permission list 1 and the permission list 2 to obtain the permission list 3.

[0108] Step S606: The SaaS system determines the status of permission list 3. If there is no permission in permission list 3, an error message is fed back to the front-end user or access is denied. If there is permission in permission list 3, the business logic of the relevant API interface permissions in permission list 3 is run, and corresponding operations (add / delete / modify / check) are performed on the data in the database.

[0109] Step S607: After the database completes the business operation, it feeds back the operation result to the SaaS system, and the SaaS system feeds back normal response information to the front-end user.

[0110] It should be noted that Figure 6 Since some execution steps are combined into one step, the above steps S601 to S607 do not completely correspond to the execution method in the sequence diagram. In the sequence diagram, the step numbers are omitted. Those skilled in the art can understand the contents of steps S601 to S607. Figure 6 Method implementation process of interaction sequence diagram.

[0111] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0112] According to an embodiment of the present disclosure, a control device for implementing the above interface permissions is also provided. Figure 7 As shown, it is a block diagram of a control device for interface permissions provided by an embodiment of the present disclosure, and the device includes:

[0113] The parsing module 701 is used to parse the interface request information after receiving the interface request information to obtain the token, request method and interface path;

[0114] A first acquisition module 702, configured to acquire, from a database, a first interface permission list corresponding to the user number according to the user number in the token;

[0115] A second acquisition module 703 is used to acquire a second interface permission list corresponding to the request method from a configuration file according to the interface path;

[0116] A logic operation module 704 is used to obtain an intersection of the first interface permission list and the second interface permission list to obtain a third interface permission list;

[0117] The execution module 705 is used to perform a business operation of the interface according to the collection state of the third interface permission list.

[0118] It should be noted that the interface authority control device provided in the embodiment of the present disclosure implements the functions described in the interface authority control method embodiment, and the specific implementation method is partially the same as the principle of the corresponding method, which will not be repeated here.

[0119] The present disclosure also provides an electronic device, such as Figure 8 As shown, the electronic device includes one or more processors 81 and a memory 82 .

[0120] The electronic device may further include: an input device 83 and an output device 84 .

[0121] The processor 81, the memory 82, the input device 83 and the output device 84 may be connected via a bus or other means. Figure 8 The example of connecting through bus is taken in the following.

[0122] The processor 81 may be a central processing unit (CPU). The processor 81 may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or a combination of the above chips. A general-purpose processor may be a microprocessor or the processor may be any conventional processor.

[0123] The memory 82 is a non-transitory computer-readable storage medium that can be used to store non-transitory software programs, non-transitory computer executable programs and modules, such as program instructions / modules corresponding to the digital signature and verification method in the embodiment of the present disclosure. The processor 81 executes various functional applications and data processing of the server by running the non-transitory software programs, instructions and modules stored in the memory 82, that is, the control method of the interface authority of the above method embodiment is implemented.

[0124] The memory 82 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of a processing device operated by the server, etc. In addition, the memory 82 may include a high-speed random access memory, and may also include a non-transitory memory, such as at least one disk storage device, a flash memory device, or other non-transitory solid-state storage device. In some embodiments, the memory 82 may optionally include a memory remotely arranged relative to the processor 81, and these remote memories may be connected to a network connection device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0125] The input device 83 can receive input digital or character information, and generate key signal input related to user settings and function control of the processing device of the server. The output device 84 can include display devices such as a display screen.

[0126] One or more modules are stored in the memory 82, and when executed by one or more processors 81, the execution is as follows: Figure 1 and Figure 2 The method shown.

[0127] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment method can be implemented by instructing the relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium. When the program is executed, it can include the process of the above-mentioned digital signature and verification method embodiment. Among them, the storage medium can be a disk, an optical disk, a read-only memory (ROM), a random access memory (RAM), a flash memory, a hard disk drive (HDD) or a solid-state drive (SSD), etc.; the storage medium can also include a combination of the above-mentioned types of memory.

[0128] Although the embodiments of the present disclosure have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present disclosure, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A method for controlling interface permissions, characterized in that: include: After receiving the interface request information, parse the interface request information to obtain a token, a request method, and an interface path; According to the user number in the token, obtaining a first interface permission list corresponding to the user number from a database; According to the interface path, obtaining a second interface permission list corresponding to the request method from a configuration file; Taking the intersection of the first interface permission list and the second interface permission list to obtain a third interface permission list; Performing a business operation of the interface according to the set state of the third interface permission list; The obtaining, according to the interface path, a second interface permission list corresponding to the request method from a configuration file includes: parsing the configuration file according to a matching rule of the interface path to generate a priority dictionary and a common dictionary; querying a corresponding permission sub-dictionary from the priority dictionary according to the interface path; if there is no matching rule matching the interface path in the priority dictionary, querying the permission sub-dictionary from the common dictionary; and filtering out a corresponding second interface permission list from the permission sub-dictionary according to the request method.

2. The method for controlling interface permissions according to claim 1, characterized in that: The step of parsing the configuration file according to the matching rule of the interface path and generating a priority dictionary and a common dictionary includes: Parsing the configuration file into a common dictionary according to a regular matching rule, and parsing the configuration file into a priority dictionary according to a full path matching rule; The priority dictionary or the common dictionary contains at least one interface path, multiple request modes and at least one interface permission.

3. The method for controlling interface permissions according to claim 1, characterized in that: The step of taking the intersection of the first interface permission list and the second interface permission list to obtain a third interface permission list includes: Taking the interface permissions in the interface permission list as the unit element of the set, finding the intersection of all first interface permissions in the first interface permission list and all second interface permissions in the second interface permission list to obtain a third interface permission set; According to the third interface permission set, the third interface permission list is obtained.

4. The method for controlling interface permissions according to claim 3, characterized in that: The performing of the service operation of the interface according to the set state of the third interface permission list includes: If the third interface permission set is an empty set, an error message or access denial prompt message is returned to the client; If the third interface permission set is not an empty set, corresponding operations are performed on the information in the database according to the third interface permission, and normal operation information is returned to the client.

5. The method for controlling interface permissions according to claim 2, characterized in that: The method of parsing the configuration file according to the matching rule of the interface path and generating a priority dictionary and a common dictionary further includes: The priority dictionary and the common dictionary are cached in the memory as global variables.

6. A device for controlling interface permissions, characterized in that: include: A parsing module, used for parsing the interface request information after receiving the interface request information to obtain a token, a request method and an interface path; A first acquisition module, configured to acquire, from a database, a first interface permission list corresponding to the user number according to the user number in the token; A second acquisition module, configured to acquire, from a configuration file, a second interface permission list corresponding to the request method according to the interface path; A logic operation module, used for taking the intersection of the first interface permission list and the second interface permission list to obtain a third interface permission list; an execution module, configured to perform a service operation of the interface according to the set state of the third interface permission list, Wherein, the second acquisition module is further used for: According to the matching rule of the interface path, the configuration file is parsed to generate a priority dictionary and a common dictionary; According to the interface path, query the corresponding permission sub-dictionary from the priority dictionary; If there is no matching rule matching the interface path in the priority dictionary, query the permission sub-dictionary from the common dictionary; According to the request mode, a corresponding second interface permission list is screened out from the permission sub-dictionary.

7. An electronic device comprising: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 5.

8. A non-transitory computer-readable storage medium storing computer instructions, wherein: The computer instructions are used to cause the computer to execute the method according to any one of claims 1-5.

Images