Gateway communication method and system based on web server backend

Abstract

The present application discloses a gateway communication method and system based on a web server backend, wherein the method includes: (1) loading a first detection probe on a web container of a first web server, the first detection probe including a traffic forwarding module; (2) the web container obtains access address information of a client, and the first detection probe performs a security check on the access address information. If the access address information passes the security check, the process proceeds to step (3); (3) if the web application corresponding to the access address information does not exist in the first web server, the traffic forwarding module pushes the access address information to a gateway between the first web server and a second web server; (4) the second web server pulls the information from the gateway; and (5) the second web server performs an access operation on the web application based on the pulled access address information. The present application is conducive to improving communication efficiency and reducing the occurrence of access failures.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a gateway communication method and system based on a web server backend. Background Art

[0002] Current web application access typically involves forwarding traffic through a gateway on the server frontend. This forwarding process is typically forward-oriented: clients access the web application, and a gateway on the server frontend distributes the traffic, allowing backend services to be accessed. For applications that require proxy servers, communication typically occurs through a gateway between the proxy backend and the application server frontend. Access addresses must first pass through the application server frontend before entering the backend, which can reduce communication efficiency and easily lead to access failures. Summary of the Invention

[0003] The purpose of this application is to provide a gateway communication method and system based on a web server backend, which is conducive to improving communication efficiency and reducing the occurrence of access failures.

[0004] To achieve the above objectives, the present application provides a gateway communication method based on a web server backend, comprising the following steps:

[0005] (1) loading a first detection probe in a web container of a first web server, where the first detection probe includes a traffic forwarding module;

[0006] (2) The web container obtains the access address information of the client, and the first detection probe performs a security check on the access address information. If the access address information passes the security check, the process proceeds to step (3);

[0007] (3) If the web application corresponding to the access address information does not exist in the first web server, the traffic forwarding module pushes the access address information to a gateway between the first web server and the second web server;

[0008] (4) The second web server pulls the information from the gateway;

[0009] (5) The second web server performs an access operation on the web application according to the access address information obtained.

[0010] Optionally, in step (1), the first detection probe is loaded in the web container based on RASP technology.

[0011] Optionally, the access address information includes a URL.

[0012] Optionally, in step (4), the second web server periodically pulls information from the gateway through a scheduled task tool of its operating system.

[0013] Optionally, a second detection probe is deployed on the web container of the second web server, and a long link is formed between the first detection probe and the second detection probe;

[0014] In step (3), when the access address information is pushed to the gateway, the second detection probe receives the notification information sent by the first detection probe in real time;

[0015] In step (4), the second web server pulls the information at the gateway in real time according to the notification information to obtain the access address information.

[0016] Optionally, step (3) includes:

[0017] The first web server matches a corresponding web application according to the access address information;

[0018] If no corresponding web application is matched, the traffic forwarding module pushes the access address information to a gateway between the first web server and the second web server according to the matching result.

[0019] To achieve the above purpose, the present application also provides a gateway communication system based on a web server backend, comprising a first web server and a second web server, wherein:

[0020] The first web server is configured to execute:

[0021] (1) loading a first detection probe in a web container of the first web server, where the first detection probe includes a traffic forwarding module;

[0022] (2) The web container obtains the access address information of the client, and the first detection probe performs a security check on the access address information. If the access address information passes the security check, the process proceeds to step (3);

[0023] (3) If the web application corresponding to the access address information does not exist in the first web server, the traffic forwarding module pushes the access address information to a gateway between the first web server and the second web server;

[0024] The second web server is configured to execute:

[0025] (4) Pulling information from the gateway;

[0026] (5) Performing an access operation on the web application according to the access address information obtained.

[0027] Optionally, the second web server periodically pulls information from the gateway through a scheduled task tool of its operating system.

[0028] Optionally, a second detection probe is deployed on the web container of the second web server, and a long link is formed between the first detection probe and the second detection probe;

[0029] When the access address information is pushed to the gateway, the second detection probe receives the notification information sent by the first detection probe in real time;

[0030] The second web server pulls the information at the gateway in real time according to the notification information to obtain the access address information.

[0031] Optionally, step (3) includes:

[0032] The first web server matches a corresponding web application according to the access address information;

[0033] If no corresponding web application is matched, the traffic forwarding module pushes the access address information to a gateway between the first web server and the second web server according to the matching result.

[0034] In the present application, the first detection probe loaded by the web container of the first web server includes a traffic forwarding module, which can push the access address information that has passed the security detection to the gateway between the first web server and the second web server. The second web server pulls the information at the gateway and performs the access operation of the web application based on the access address information pulled. In other words, the gateway between the first web server and the second web server can be set up between the back end of the first web server and the back end of the second web server. When the first web server acts as a proxy server (forward proxy and / or reverse proxy) to forward the access address information, the access address information is pushed to the gateway and enters the back end of the second web server by the gateway. It will not pass through the front end of the second web server and then enter the back end of the second web server, which is conducive to improving communication efficiency and reducing the occurrence of access failures. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 This is a flow chart of a gateway communication method based on a web server backend according to an embodiment of the present application.

[0036] Figure 2 It is a schematic block diagram of a gateway communication system based on a web server backend according to an embodiment of the present application. DETAILED DESCRIPTION

[0037] In order to explain the technical content, structural features, achieved objectives and effects of this application in detail, the following is a detailed description in conjunction with the implementation methods and the accompanying drawings.

[0038] Example 1

[0039] See also Figure 1 and Figure 2 , this application discloses a gateway communication method based on a web server backend, comprising the following steps:

[0040] 101 . Load a first detection probe into the web container 11 of the first web server 10 . The first detection probe includes a traffic forwarding module.

[0041] In addition to realizing the security detection function, the traffic forwarding module of the first detection probe in this embodiment can push the access address information from the client to the gateway between the first web server 10 and the second web server.

[0042] Specifically, in step 101 , a first detection probe is loaded in the web container 11 based on the RASP technology.

[0043] 102 . The web container 11 obtains the access address information of the client 20 . The first detection probe performs a security check on the access address information. If the access address information passes the security check, the process proceeds to step 103 .

[0044] Specifically, the first detection probe performs traffic analysis on the access address information and intercepts the access address information that fails the security detection.

[0045] How the first detection probe performs security detection on the access address information is well known to those skilled in the art and will not be described in detail here.

[0046] Specifically, the access address information includes a URL.

[0047] 103. When the web application corresponding to the access address information does not exist in the first web server 10, the traffic forwarding module pushes the access address information to the gateway between the first web server 10 and the second web server.

[0048] After the access address information passes the security check, different operations can be performed according to different settings.

[0049] In some cases, step 103 includes:

[0050] The first web server 10 matches the corresponding web application according to the access address information;

[0051] If no corresponding web application is matched, the traffic forwarding module pushes the access address information to the gateway between the first web server 10 and the second web server according to the matching result.

[0052] If no corresponding web application is matched, there is no need to push the access address information to the gateway between the first web server 10 and the second web server.

[0053] In other cases, step 103 does not require matching web applications on the first web server 10. Instead, the traffic forwarding module can directly push the access address information to the gateway between the first web server 10 and the second web server, thereby matching web applications on the second web server 30. For example, during the testing phase, a proxy setting can be configured for the access address on the client 20. The access address information of the client 20 received by the web container 11 passes the security check of the first detection probe and is then pushed by the traffic forwarding module to the gateway between the first web server 10 and the second web server 30.

[0054] 104. The second web server 30 pulls information from the gateway.

[0055] In some implementations, in step 104, the second web server 30 periodically pulls information from the gateway through a scheduled task tool of its operating system and obtains access address information therefrom.

[0056] In other embodiments, the web container 31 of the second web server 30 is deployed with a second detection probe, and a long link is formed between the first detection probe and the second detection probe;

[0057] In step 103, when the access address information is pushed to the gateway, the second detection probe receives the notification information sent by the first detection probe in real time;

[0058] In step 104, the second web server 30 pulls information from the gateway in real time according to the notification information to obtain access address information.

[0059] 105. The second web server 30 performs an access operation on the web application according to the retrieved access address information.

[0060] If the corresponding web application exists in the second web server 30, the access will be successful and a response message will be returned. If the corresponding web application does not exist in the second web server 30, the access will fail and corresponding information will also be returned.

[0061] It is understood that, in the present application, corresponding to a first web server 10 that can be used as a proxy server, there can be multiple second web servers 30, and each second web server 30 is provided with a gateway between itself and the first web server 10. The first web server 10 can communicate with each second web server 30 in a round-robin manner, and stop the round-robin after receiving a response message indicating a successful access from one of the second web servers 30.

[0062] In the present application, the first detection probe loaded by the web container 11 of the first web server 10 includes a traffic forwarding module, which can push the access address information that has passed the security detection to the gateway between the first web server 10 and the second web server 30. The second web server 30 pulls the information at the gateway and performs the access operation of the web application based on the access address information pulled. In other words, the gateway between the first web server 10 and the second web server 30 can be set up between the back end of the first web server 10 and the back end of the second web server 30. When the first web server 10 acts as a proxy server (forward proxy and / or reverse proxy) to forward the access address information, the access address information is pushed to the gateway and enters the back end of the second web server 30 by the gateway, and does not pass through the front end of the second web server 30 and then enter the back end of the second web server 30, thereby helping to improve communication efficiency and reduce the occurrence of access failures. Furthermore, thanks to the installation of the first detection probe, this application can provide early warning and corresponding protection against security attacks that users cannot fix during the testing or development phase. It supports customizable detection rules, can promptly and accurately discover multiple security vulnerabilities, and proactively block and protect against them, as well as report them. Furthermore, it can be linked to the authoritative vulnerability databases of CVE and CNNVD to provide timely protection against security vulnerabilities. Furthermore, the first detection probe can display the status of attack events in detail to the portal (data display server) in real time, facilitating tracking and decision-making.

[0063] Example 2

[0064] See also Figure 1 and Figure 2 The present application discloses a gateway communication system based on a web server backend, comprising a first web server 10 and a second web server 30, wherein:

[0065] The first web server 10 is configured to execute:

[0066] 101. Load a first detection probe into the web container 11 of the first web server 10. The first detection probe includes a traffic forwarding module.

[0067] 102. The web container 11 obtains the access address information of the client 20. The first detection probe performs a security check on the access address information. If the access address information passes the security check, the process proceeds to step 103.

[0068] 103 . When the web application corresponding to the access address information does not exist in the first web server 10 , the traffic forwarding module pushes the access address information to the gateway between the first web server 10 and the second web server 30 .

[0069] The second web server 30 is configured to execute:

[0070] 104. Pull information from the gateway;

[0071] 105. Perform access operations on the web application based on the access address information obtained.

[0072] In the present application, the first detection probe loaded by the web container 11 of the first web server 10 includes a traffic forwarding module, which can push the access address information that has passed the security detection to the gateway between the first web server 10 and the second web server 30. The second web server 30 pulls the information at the gateway and performs the access operation of the web application based on the access address information pulled. In other words, the gateway between the first web server 10 and the second web server 30 can be set up between the back end of the first web server 10 and the back end of the second web server 30. When the first web server 10 acts as a proxy server (forward proxy and / or reverse proxy) to forward the access address information, the access address information is pushed to the gateway and enters the back end of the second web server 30 by the gateway, and does not pass through the front end of the second web server 30 and then enter the back end of the second web server 30, thereby helping to improve communication efficiency and reduce the occurrence of access failures. Furthermore, thanks to the installation of the first detection probe, this application can provide early warning and corresponding protection against security attacks that users cannot fix during the testing or development phase. It supports customizable detection rules, can promptly and accurately discover multiple security vulnerabilities, and proactively block and protect against them, as well as report them. Furthermore, it can be linked to the authoritative vulnerability databases of CVE and CNNVD to provide timely protection against security vulnerabilities. Furthermore, the first detection probe can display the status of attack events in detail to the portal (data display server) in real time, facilitating tracking and decision-making.

[0073] In some embodiments, step 103 includes:

[0074] The first web server 10 matches the corresponding web application according to the access address information;

[0075] If no corresponding web application is matched, the traffic forwarding module pushes the access address information to the gateway between the first web server 10 and the second web server 30 according to the matching result.

[0076] In some implementations, the second web server 30 periodically pulls information from the gateway through a scheduled task tool of its operating system and obtains the access address information therefrom.

[0077] In other embodiments, the web container 31 of the second web server 30 is deployed with a second detection probe, and a long link is formed between the first detection probe and the second detection probe;

[0078] When the access address information is pushed to the gateway, the second detection probe receives the notification information sent by the first detection probe in real time;

[0079] The second web server 30 pulls information from the gateway in real time according to the notification information to obtain access address information.

[0080] It should be noted that the description of the second embodiment has some emphases, and for the parts not described in detail, please refer to the relevant description of the first embodiment.

[0081] The above disclosure is only a preferred example of the present application and cannot be used to limit the scope of rights of the present application. Therefore, equivalent changes made according to the claims of the present application are all within the scope covered by the present application.

Claims

1. A gateway communication method based on a web server backend, characterized in that: The steps include: (1) loading a first detection probe in a web container of a first web server, where the first detection probe includes a traffic forwarding module; (2) The web container obtains the access address information of the client, and the first detection probe performs a security check on the access address information. If the access address information passes the security check, the process proceeds to step (3); (3) If the web application corresponding to the access address information does not exist in the first web server, the traffic forwarding module pushes the access address information to a gateway between the first web server and the second web server; (4) The second web server pulls the information from the gateway; (5) The second web server performs an access operation on the web application according to the access address information obtained; The gateway between the first web server and the second web server is set up between the back end of the first web server and the back end of the second web server. When the first web server acts as a proxy server to forward the access address information, the access address information is pushed to the gateway and enters the back end of the second web server through the gateway.

2. The gateway communication method according to claim 1, wherein: In step (1), the first detection probe is loaded into the web container based on the RASP technology.

3. The gateway communication method according to claim 1, wherein: The access address information includes a URL.

4. The gateway communication method according to claim 1, wherein: In step (4), the second web server periodically pulls the information from the gateway through the scheduled task tool of its operating system.

5. The gateway communication method according to claim 1, wherein: A second detection probe is deployed on the web container of the second web server, and a long link is formed between the first detection probe and the second detection probe; In step (3), when the access address information is pushed to the gateway, the second detection probe receives the notification information sent by the first detection probe in real time; In step (4), the second web server pulls the information at the gateway in real time according to the notification information to obtain the access address information.

6. The gateway communication method according to claim 1, wherein: Step (3) includes: The first web server matches a corresponding web application according to the access address information; If no corresponding web application is matched, the traffic forwarding module pushes the access address information to a gateway between the first web server and the second web server according to the matching result.

7. A gateway communication system based on a web server backend, characterized in that: including a first web server and a second web server, wherein, The first web server is configured to execute: (1) loading a first detection probe in a web container of the first web server, where the first detection probe includes a traffic forwarding module; (2) The web container obtains the access address information of the client, and the first detection probe performs a security check on the access address information. If the access address information passes the security check, the process proceeds to step (3); (3) If the web application corresponding to the access address information does not exist in the first web server, the traffic forwarding module pushes the access address information to a gateway between the first web server and the second web server; The second web server is configured to execute: (4) Pulling information from the gateway; (5) performing an access operation on the web application according to the access address information obtained; The gateway between the first web server and the second web server is set up between the back end of the first web server and the back end of the second web server. When the first web server acts as a proxy server to forward the access address information, the access address information is pushed to the gateway and enters the back end of the second web server through the gateway.

8. The gateway communication system according to claim 7, wherein: The second web server periodically pulls the information from the gateway through a scheduled task tool of its operating system.

9. The gateway communication system according to claim 7, wherein: A second detection probe is deployed on the web container of the second web server, and a long link is formed between the first detection probe and the second detection probe; When the access address information is pushed to the gateway, the second detection probe receives the notification information sent by the first detection probe in real time; The second web server pulls the information at the gateway in real time according to the notification information to obtain the access address information.

10. The gateway communication system according to claim 7, wherein: Step (3) includes: The first web server matches a corresponding web application according to the access address information; If no corresponding web application is matched, the traffic forwarding module pushes the access address information to a gateway between the first web server and the second web server according to the matching result.

Images