A server proxy access method based on simulated browser

Abstract

The present invention discloses a server-side proxy access method based on a simulated browser. By running a syntax tree parsing technology on a proxy server, the sub-requests in Html and CSS are accurately replaced, the JS script execution process on the browser is simulated, and a JS operating environment container is constructed to avoid the influence of operating environment changes caused by the introduction of a proxy, and fundamentally solve the problem of business access introduced after the Web proxy. By simultaneously saving the client access side cookie and the application access side cookie on the Web proxy, by establishing a mapping relationship, the proxy side screens the cookie according to the application and modifies each request to ensure the correct response of the application.

Description

Technical Field

[0001] The invention relates to a network service access technology, and in particular to a server-side proxy access method based on a simulated browser. Background Art

[0002] In the information age, enterprises have an unprecedented demand for mobile and remote office.

[0003] To meet the needs of remote office, one way is to directly expose the application to the public network, but this increases the exposure and increases the risk of attack on corporate information assets. Another way is to publish the application uniformly through proxy technology, generally a seven-layer web proxy technology, which uses regular expressions to find and replace the attribute values ​​of sub-links in HTML (such as href, src, action, etc.) for rewriting. After the user accesses the rewritten website entrance, the sub-requests in the page are also directed to the proxy to achieve remote access. Security components such as authorization, authentication, and WAF policies are integrated in the proxy to achieve security.

[0004] The web site in the existing web proxy technology is composed of HTML+CSS+Javacript, where HTML is the carrier of web page content, which can contain text, pictures, videos, etc. CSS is the outer appearance of the website, such as fonts, color changes, borders, etc. Javacript can be used to realize website interaction, such as form submission, mouse clicks, etc. This structure easily leads to the following two types of problems:

[0005] First, the url rewriting proxy technology implements web proxy by rewriting the connection starting with http: / / or https: / / in the response content. However, many html5 applications now have increasingly complex js execution logic, which will lead to the following two defects: 1) The domain name spliced ​​by the js function cannot be rewritten, such as domain = "https: / / " + "cnki.net".replace("net", "com"), resulting in the request triggered in js unable to reach the web proxy and the application cannot be used normally; 2) Because cookies are strongly associated with domain names, url rewriting technology will modify the domain name of the web application on the browser, resulting in the browser being unable to correctly process cookies when users visit multiple websites of the proxy, resulting in the web application being unable to be used correctly.

[0006] To solve these two problems, specific analysis is required, which consumes a lot of manpower and cannot quickly release applications.

[0007] Second, since HTML is a hypertext language that defines flexible encoding and escape characters, in order to ensure that all URLs are correctly rewritten, it is necessary to define a large number of regular matches to retrieve and replace the content, which greatly affects the response speed of the website. Summary of the invention

[0008] Purpose of the invention: The purpose of the present invention is to solve the deficiencies in the prior art and provide a server-side proxy access method based on a simulated browser. By running the syntax tree parsing technology on the proxy server, the sub-requests in Html and CSS can be accurately replaced, the JS script execution process on the browser can be simulated, and a JS runtime environment container can be built to avoid the impact of changes in the runtime environment caused by the introduction of the proxy, and fundamentally solve the problem of business access introduced after the Web proxy. By simultaneously saving the client access side cookies and the application access side cookies on the Web proxy, by establishing a mapping relationship, the proxy side filters the cookies according to the application and modifies each request to ensure that the application responds correctly.

[0009] Technical solution: The present invention discloses a server-side proxy access method based on a simulated browser, comprising a Web proxy (corresponding to a security gateway), a browser (corresponding to an access client) and a source Web application server; the Web proxy is resident with an Html processing engine, a CSS processing engine and a JS simulation executor engine, and the Html processing engine, the CSS processing engine and the JS simulation executor engine are used to process the parsing and replacement of all URL address-related parts in the Web application; the browser is resident with a JS execution container corresponding to the JS simulation executor engine, and the JS execution container is an execution unit of the operating environment constructed by the JS simulation executor engine on the Web proxy; the steps for a user to access an application published by the Web proxy are as follows:

[0010] Step (1), after the Web proxy makes a request to the source application server, it determines the content of the source site response (determines the response body type based on the content-type in the response header; if the type is text / html, the response body type is html; if the type is javascript, the response body type is js; if the type is text / css, the response body type is css):

[0011] 1) If the response body type is html, simulate the browser to perform syntax analysis (including lexical analysis and semantic analysis of the text), filter the tag attribute value of the URL type according to the html tag defined in www.w3school.com.cn / tags, and then trigger a subrequest on the browser side according to the filtered attributes, parse the URL according to the URL parsing state machine in html.spec.whatwg.org, and add the proxy server address to achieve content rewriting of the node URL, ensuring that the browser can request the proxy server again after triggering this request;

[0012] 2) If the response body type is CSS, since CSS can reference other CSS content through the URL function, lexical analysis is performed by simulating the browser to find all URL functions, and the input parameters are rewritten to add the proxy server address;

[0013] 3) If the response body type is js, js sends a subrequest through XMLHttpRequest, fetch, and websocket. The server simulates js execution, finds all methods for sending requests and points for obtaining window objects, builds a syntax tree with reference to ECMAScript6, finds location, fetch, and websocket nodes in the syntax tree, inserts hook function processing logic, and writes the syntax tree back to text before responding to the browser; when the browser executes the rewritten js, it first executes the inserted js hook function, and the jshook function ensures that the original js is executed in a consistent environment before and after the proxy, and then rewrites the request sent by the source js to the proxy server to ensure normal application;

[0014] Step (2): The Web proxy server intercepts the cookie setting operation of the application server and stores the cookie on the proxy server to form a mapping with the user cookie. When the browser accesses an application through the proxy, the browser only carries the user cookie. The web proxy finds the mapping table based on the user, selects the correct cookie based on the application, and then modifies it and forwards it to the application server, thus solving the problem of incorrect cookies introduced by the proxy.

[0015] Beneficial effects: Compared with the prior art, the present invention has the following advantages:

[0016] (1) The present invention only requires the backend to perform text parsing according to the HTML standard, simulating the parsing of HTML loaded by the browser, and can accurately replace all URLs that need to be rewritten. Compared with the general use of regular replacement, it has stronger performance and higher accuracy;

[0017] (2) The web proxy service in the present invention performs execution analysis and rewrites js to ensure that js running in the browser will not cause execution logic errors due to window context changes caused by the proxy;

[0018] (3) The backend proxy service fills in cookies based on the actual application accessed by the user. This can solve the access problems (such as authentication failure) caused by cross-domain cookies and domain name overlaps that cannot be distinguished due to the change of the domain name of the user's browser after the proxy. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 It is a structural block diagram of the present invention;

[0020] Figure 2 It is a schematic diagram of the overall process of the present invention;

[0021] Figure 3 This is a schematic diagram of Cookie operation in the present invention. DETAILED DESCRIPTION

[0022] The technical solution of the present invention is described in detail below, but the protection scope of the present invention is not limited to the embodiments.

[0023] To facilitate understanding of the technical solution of the present invention, the following technical terms are first explained.

[0024] web: applications based on hypertext and HTTP

[0025] js / javascript: a lightweight, interpreted or just-in-time compiled programming language with a function-first approach

[0026] html: Hypertext Markup Language

[0027] dom: Document Object Model

[0028] CSS: Cascading Style Sheets, a computer language used to express HTML file styles

[0029] Cookie: Data stored on the user's local terminal by some websites in order to identify the user and conduct session tracking.

[0030] ajax: asynchronous JavaScript event processing server-side data (txt, xml, html)

[0031] Existing web proxies implement server-side proxy access based on regular expression matching replacement of text. This access method requires the proxy server to refer to the browser for lexical analysis and semantic analysis of the three text languages ​​html, css, and javascript, find the requests that do not go through the proxy after the proxy and the grammatical context changes after the proxy, and rewrite them to comply with the grammatical definition standards. It requires the implementation of three parsers on the server side according to the w3c standard specifications, which is technically difficult.

[0032] like Figure 1 As shown, a server-side proxy access method based on a simulated browser of the present invention includes a Web proxy (corresponding to a security gateway), a browser (corresponding to an access client) and a source Web application server; an Html processing engine, a CSS processing engine and a JS simulation executor engine reside on the Web proxy, and all parsing and replacement of URL address-related parts in the Web application are processed by the Html processing engine, the CSS processing engine and the JS simulation executor engine; a JS execution container corresponding to the JS simulation executor engine resides on the browser, which is an execution unit of the operating environment constructed by the JS simulation executor engine on the Web proxy.

[0033] like Figure 2 As shown in the figure, the steps for users to access applications published by the Web proxy are as follows:

[0034] After the Web proxy makes a request to the source application server, it determines the content of the source server response:

[0035] 1) If the response body type is html, simulate the browser to perform syntax analysis (including lexical analysis and semantic analysis of the text), filter the attributes whose tag attribute values ​​are URL type according to the html tags defined in www.w3school.com.cn / tags, and then trigger a subrequest on the browser side according to the filtered attributes, parse the URL according to the URL parsing state machine in html.spec.whatwg.org, and add the proxy server address to achieve content rewriting of the node URL, ensuring that the browser can request the proxy server again when triggering this request;

[0036] 2) If the response body type is CSS, since CSS can reference other CSS content through the URL function, lexical analysis is performed by simulating the browser to find all URL functions, and the input parameters are rewritten to add the proxy server address;

[0037] 3) If the response body type is js, js sends a subrequest through XMLHttpRequest, fetch, and websocket. The server side simulates js execution, finds all methods for sending requests and points for obtaining window objects, builds a syntax tree with reference to ECMAScript6, finds location, fetch, and websocket nodes in the syntax tree, inserts hook function processing logic, and writes the syntax tree back to text before responding to the browser; when the browser executes the rewritten js, it first executes the inserted js hook function, and the jshook function ensures that the original js is executed in a consistent environment before and after the proxy, and then rewrites the request sent by the source js to the proxy server to ensure the normal application.

[0038] Finally, respond and rewrite the content.

[0039] like Figure 3 As shown in the figure, the Web proxy server intercepts the cookie setting operation of the application server, saves the cookie on the proxy server and maps it to the user cookie. When the browser accesses an application through the proxy, the browser only carries the user cookie. The web proxy finds the mapping table based on the user, selects the correct cookie based on the application, and then modifies it and forwards it to the application server, solving the problem of incorrect cookies introduced by the proxy.

[0040] In the remote mobile office scenario, the unified release of organizational applications through web proxy can meet the organization's needs for fast and secure remote office access without changing the application system. In the traditional web proxy method, in complex application system scenarios, it is impossible to exhaust all URLs that need to be proxied, which will result in the URL replacement process not having a unified, convenient, and once-and-for-all solution. Often, some sub-links cannot be replaced with proxy URLs due to format or splicing generation, resulting in browser-side request failures and application failures. In addition, because the proxy generally diverts traffic to the proxy server by replacing the original domain name, the user-side execution JS environment changes, which will cause the JS branch on the browser to fail to execute. Secondly, for security reasons, most websites introduce cookies to distinguish and track different terminal devices. The strong correlation between cookies and domain names leads to changes in cookies after passing through the proxy due to domain name changes. When the browser accesses multiple proxy websites, the browser cannot correctly filter website-related cookies and carry them in the request, and is denied access by the service application.

[0041] Embodiment 1:

[0042] Now take a certain school as an example. In order to facilitate remote work for teachers and students, the portal is published to the proxy server. After user authentication, the user accesses the proxy service and can normally access the portal and dozens of internal applications such as OA, online service hall, library, etc. in the portal.

[0043] When the response reaches the proxy server, the content-type is HTML, the response body is parsed, the DOM tree is generated, and the nodes with the value type of URL are filtered out. The URL is parsed and replaced with the proxy server address, and the original value is encoded as URI. Viewing the response content from the browser side, except for the URL in the comment, all other rewrites are successful. The browser initiates a request again based on the CSS and JS resources that the HTML page depends on. These links have been rewritten after the syntax tree is parsed, and are also requested to the proxy server first.

[0044] The CSS response reaches the proxy server, and other CSS resources and images referenced by the URL function are analyzed through lexical analysis. All URL function parameters are rewritten to ensure that the proxy server can be requested again. The browser checks the response content, and only the value in the URL function has changed compared to the source station response.

[0045] The Js response arrives at the proxy server, and dozens of context-related logics such as window.location, window.document, websocket, fetch, etc. are analyzed through syntax tree parsing and encapsulated.

[0046] Portal, OA, library and other applications all require cookies to distinguish user access. From the browser side, there is only the proxy server access_token, but each application can access normally.

[0047] Compared with existing proxy access, the website has stronger compatibility, faster access speed, and stronger concurrency capability under the same hardware configuration.

Claims

1. A server proxy access method based on simulated browser, characterized in that: The invention comprises a Web proxy, a browser and a source Web application server; the Web proxy is resident with an Html processing engine, a CSS processing engine and a JS simulation executor engine, and the Html processing engine, the CSS processing engine and the JS simulation executor engine are used to process the parsing and replacement of all URL address-related parts in the Web application; the browser is resident with a JS execution container corresponding to the JS simulation executor engine; the steps for a user to access a source application published by the Web proxy are as follows: Step (1), after the Web proxy makes a request to the source application server, the response body type is determined based on the content-type in the response header. If the type is text / html, the response body type is html; if the type is javascript, the response body type is js; if the type is text / css, the response body type is css: 1) If the response body type is html, simulate the browser to perform syntax parsing, filter the tag attribute values ​​that are URL type attributes (href, src, icon, action, background) according to the html tags defined in www.w3school.com.cn / tags, and then trigger a subrequest on the browser side according to the filtered attributes, parse the URL according to the URL parsing state machine in html.spec.whatwg.org, and add the proxy server address to ensure that the browser can request the proxy server again when triggering this request; 2) If the response body type is CSS, since CSS can reference other CSS content through the URL function, lexical analysis is performed by simulating the browser to find all URL functions, and the input parameters are rewritten to add the proxy server address; 3) If the response body type is js, js sends a subrequest through XMLHttpRequest, fetch, and websocket. The server simulates js execution, finds all methods for sending requests and points for obtaining window objects, builds a syntax tree with reference to ECMAScript6, finds location, fetch, and websocket nodes in the syntax tree, inserts hook function processing logic, and writes the syntax tree back to text before responding to the browser; when the browser executes the rewritten js, it first executes the inserted js hook function, which ensures that the original js is executed in a consistent environment before and after the proxy, and then rewrites the request sent by the source js to the proxy server to ensure normal application; Step (2): The Web proxy server intercepts the cookie setting operation of the application server and stores the cookie on the proxy server to form a mapping with the user cookie. When the browser accesses an application through the proxy, the browser only carries the user cookie. The web proxy finds the mapping table based on the user, selects the correct cookie based on the application, and then modifies it and forwards it to the application server.

Images