Enterprise-level gateway authentication methods and systems

Abstract

This invention provides an enterprise-level gateway authentication method and system, comprising: Step S1: managing and authorizing published APIs; Step S2: the gateway uniformly calls the APIs to determine whether authentication is required for each API access request; if authentication is required for each API access request, proceed to Step S3; if authentication is not required for each API access request, proceed to Step S4; Step S3: if authentication is required for each API access request, perform pass-through authentication or TOKEN authentication; Step S4: if authentication is not required for each API access request, perform WEB authentication, and the gateway forwards the request to the backend microservice, where the microservice performs authentication. This invention, by designing three authentication modes, satisfies the needs of different scenarios, solves the problem of unified authentication and authorization at the gateway, and effectively protects backend service resources.

Description

Technical Field

[0001] This invention relates to the field of gateway design technology, and more specifically, to an enterprise-level gateway authentication method and system. Background Technology

[0002] Traditional API gateways are not particularly robust in their unified authentication and authorization modules, lacking gateway, service, and API-level authentication and authorization management capabilities. In different scenarios, there are issues with unified authentication and authorization at the gateway level, resulting in insufficient protection of backend service resources.

[0003] Patent document CN111010339B (application number: CN201911351580.8) discloses a design method for an enterprise-level high-performance API service gateway. The method includes: starting, inbound request, calculating the rate limiting counter key, current rate, whether the rate limit has been exceeded, allowing the request, incrementing the counter, synchronizing the counter increment, rejecting the request, returning an HTTP 429 status code, and ending. This design method includes a synchronized counter increment. By configuring the counter synchronization interval to be less than the rate limiting window time, the overall rate limiting rate of the API gateway cluster cycles through a "convergence-divergence-convergence" state within the rate limiting window time, striving to closely approximate the required rate limiting rate. However, this invention lacks pattern authentication based on different scenarios, thus failing to address the problem of insufficient protection of backend service resources. Summary of the Invention

[0004] In view of the deficiencies in the prior art, the purpose of this invention is to provide an enterprise-level gateway authentication method and system.

[0005] According to the present invention, an enterprise-level gateway authentication method is characterized by comprising:

[0006] Step S1: Manage and authorize the published APIs;

[0007] Step S2: The gateway makes a unified call to the API to determine whether authentication is required for each API access request;

[0008] If authentication is required for each API access request, proceed to step S3; if authentication is not required for each API access request, proceed to step S4.

[0009] Step S3: When authentication is required for each API access request, pass-through authentication or TOKEN authentication should be performed.

[0010] Step S4: When it is not necessary to authenticate every API access request, web authentication is performed. The gateway forwards the request to the backend microservice, and the microservice performs the authentication.

[0011] Preferably, in step S3:

[0012] Pass-through authentication includes:

[0013] Use the subscriber and subscription credentials issued by the gateway to initiate a request to the gateway;

[0014] The gateway verifies whether the subscriber and subscription credential information are correct;

[0015] The gateway verifies whether the subscriber has an API request for subscription.

[0016] The gateway forwards requests to the backend service.

[0017] Preferably, token authentication includes:

[0018] Use the subscriber and subscription credentials issued by the gateway to request the gateway's get token interface;

[0019] The gateway verifies the correctness of the subscriber and subscription credentials, and generates a token to return to the requester if the verification is successful.

[0020] The requester uses the tokens returned by the subscriber and the gateway to request the business API from the gateway;

[0021] The gateway verifies whether the token sent by the requester is valid;

[0022] The gateway verifies whether the subscriber has an API request for subscription;

[0023] The gateway forwards requests to the backend service;

[0024] If the token verified at the gateway has exceeded the preset expiration time, the requester will use the refresh token request to request the gateway's refresh token interface, and subsequent requests to the business API will use the new token.

[0025] Preferably, in step S4:

[0026] Web certification includes:

[0027] Using the subscriber, subscription credentials, username, and password issued by the gateway, request the general service login interface through the gateway.

[0028] The gateway verifies whether the subscriber and subscription credential information are correct.

[0029] The gateway forwards the username and password to the general service login interface;

[0030] The general service verifies whether the username and password are correct. If correct, it generates a token and refreshes the token, returning the result.

[0031] The requester uses the tokens returned by the subscriber and the general service to request the business API;

[0032] The gateway checks whether the subscriber sent by the requester is of web authentication type. If so, it calls the authentication interface of the general service and passes the token to the general service.

[0033] The general service parses the token, extracts the username from it, adds the requested application and its API, and checks whether the user has subscribed to the API.

[0034] The general service returns a message to the gateway indicating that the current requester has permission to request the API, and the gateway then forwards the request to the backend application.

[0035] If the general service finds that the token meets the preset requirements but has exceeded the preset period, it will notify the requester. The requester will then use the refresh token to request the refresh token interface of the general service. The general service will generate a new token and a refresh token and return them to the requester. Subsequent requests will use the new token.

[0036] Preferably, the JUP front-end framework automatically refreshes the token functionality;

[0037] Non-JUP front-end frameworks can implement their own token refresh functionality: when rendering a page or making an AJAX request, if the page is already within the refreshable time, a refresh will be initiated; if the page is already within the deferred time, a refresh will be initiated.

[0038] An enterprise-level gateway authentication system provided by the present invention includes:

[0039] Module M1: Manages and authorizes published APIs;

[0040] Module M2: The gateway makes unified calls to the API to determine whether authentication is required for each API access request;

[0041] If authentication is required for each API access request, proceed to module M3; otherwise, proceed to module M4.

[0042] Module M3: When authentication is required for each API access request, pass-through authentication or token authentication is required.

[0043] Module M4: When it is not necessary to authenticate every API access request, web authentication is performed. The gateway forwards the request to the backend microservice, and the microservice performs the authentication.

[0044] Preferably, in module M3:

[0045] Pass-through authentication includes:

[0046] Use the subscriber and subscription credentials issued by the gateway to initiate a request to the gateway;

[0047] The gateway verifies whether the subscriber and subscription credential information are correct;

[0048] The gateway verifies whether the subscriber has an API request for subscription.

[0049] The gateway forwards requests to the backend service.

[0050] Preferably, token authentication includes:

[0051] Use the subscriber and subscription credentials issued by the gateway to request the gateway's get token interface;

[0052] The gateway verifies the correctness of the subscriber and subscription credentials, and generates a token to return to the requester if the verification is successful.

[0053] The requester uses the tokens returned by the subscriber and the gateway to request the business API from the gateway;

[0054] The gateway verifies whether the token sent by the requester is valid;

[0055] The gateway verifies whether the subscriber has an API request for subscription;

[0056] The gateway forwards requests to the backend service;

[0057] If the token verified at the gateway has exceeded the preset expiration time, the requester will use the refresh token request to request the gateway's refresh token interface, and subsequent requests to the business API will use the new token.

[0058] Preferably, in module M4:

[0059] Web certification includes:

[0060] Using the subscriber, subscription credentials, username, and password issued by the gateway, request the general service login interface through the gateway.

[0061] The gateway verifies whether the subscriber and subscription credential information are correct.

[0062] The gateway forwards the username and password to the general service login interface;

[0063] The general service verifies whether the username and password are correct. If correct, it generates a token and refreshes the token, returning the result.

[0064] The requester uses the tokens returned by the subscriber and the general service to request the business API;

[0065] The gateway checks whether the subscriber sent by the requester is of web authentication type. If so, it calls the authentication interface of the general service and passes the token to the general service.

[0066] The general service parses the token, extracts the username from it, adds the requested application and its API, and checks whether the user has subscribed to the API.

[0067] The general service returns a message to the gateway indicating that the current requester has permission to request the API, and the gateway then forwards the request to the backend application.

[0068] If the general service finds that the token meets the preset requirements but has exceeded the preset period, it will notify the requester. The requester will then use the refresh token to request the refresh token interface of the general service. The general service will generate a new token and a refresh token and return them to the requester. Subsequent requests will use the new token.

[0069] Preferably, the JUP front-end framework automatically refreshes the token functionality;

[0070] Non-JUP front-end frameworks can implement their own token refresh functionality: when rendering a page or making an AJAX request, if the page is already within the refreshable time, a refresh will be initiated; if the page is already within the deferred time, a refresh will be initiated.

[0071] Compared with the prior art, the present invention has the following beneficial effects:

[0072] 1. This invention is an enhanced development based on Spring Cloud Gateway. By designing three authentication methods, namely pass-through, TOKEN, and WEB authentication, it realizes unified authentication and authorization at the gateway and supports dynamic authorization and revocation.

[0073] 2. This invention designs three authentication modes to meet the authentication needs of different scenarios, solves the problem of unified authentication and authorization at the gateway, and effectively protects backend service resources. Attached Figure Description

[0074] Other features, objects, and advantages of the present invention will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings:

[0075] Figure 1 This is a schematic diagram of the pass-through authentication method;

[0076] Figure 2 This is a diagram illustrating the Token authentication method.

[0077] Figure 3 This is a diagram illustrating the web authentication method. Detailed Implementation

[0078] The present invention will now be described in detail with reference to specific embodiments. These embodiments will help those skilled in the art to further understand the present invention, but do not limit the invention in any way. It should be noted that those skilled in the art can make several changes and improvements without departing from the concept of the present invention. These all fall within the protection scope of the present invention.

[0079] Example 1:

[0080] According to the present invention, an enterprise-level gateway authentication method is characterized in that, as follows: Figures 1-3 As shown, it includes:

[0081] Step S1: Manage and authorize the published APIs;

[0082] Step S2: The gateway makes a unified call to the API to determine whether authentication is required for each API access request;

[0083] If authentication is required for each API access request, proceed to step S3; if authentication is not required for each API access request, proceed to step S4.

[0084] Step S3: When authentication is required for each API access request, pass-through authentication or TOKEN authentication should be performed.

[0085] Specifically, in step S3:

[0086] Pass-through authentication includes:

[0087] Use the subscriber and subscription credentials issued by the gateway to initiate a request to the gateway;

[0088] The gateway verifies whether the subscriber and subscription credential information are correct;

[0089] The gateway verifies whether the subscriber has an API request for subscription.

[0090] The gateway forwards requests to the backend service.

[0091] Specifically, token authentication includes:

[0092] Use the subscriber and subscription credentials issued by the gateway to request the gateway's get token interface;

[0093] The gateway verifies the correctness of the subscriber and subscription credentials, and generates a token to return to the requester if the verification is successful.

[0094] The requester uses the tokens returned by the subscriber and the gateway to request the business API from the gateway;

[0095] The gateway verifies whether the token sent by the requester is valid;

[0096] The gateway verifies whether the subscriber has an API request for subscription;

[0097] The gateway forwards requests to the backend service;

[0098] If the token verified at the gateway has exceeded the preset expiration time, the requester will use the refresh token request to request the gateway's refresh token interface, and subsequent requests to the business API will use the new token.

[0099] Step S4: When it is not necessary to authenticate every API access request, web authentication is performed. The gateway forwards the request to the backend microservice, and the microservice performs the authentication.

[0100] Specifically, in step S4:

[0101] Web certification includes:

[0102] Using the subscriber, subscription credentials, username, and password issued by the gateway, request the general service login interface through the gateway.

[0103] The gateway verifies whether the subscriber and subscription credential information are correct.

[0104] The gateway forwards the username and password to the general service login interface;

[0105] The general service verifies whether the username and password are correct. If correct, it generates a token and refreshes the token, returning the result.

[0106] The requester uses the tokens returned by the subscriber and the general service to request the business API;

[0107] The gateway checks whether the subscriber sent by the requester is of web authentication type. If so, it calls the authentication interface of the general service and passes the token to the general service.

[0108] The general service parses the token, extracts the username from it, adds the requested application and its API, and checks whether the user has subscribed to the API.

[0109] The general service returns a message to the gateway indicating that the current requester has permission to request the API, and the gateway then forwards the request to the backend application.

[0110] If the general service finds that the token meets the preset requirements but has exceeded the preset period, it will notify the requester. The requester will then use the refresh token to request the refresh token interface of the general service. The general service will generate a new token and a refresh token and return them to the requester. Subsequent requests will use the new token.

[0111] Specifically, the JUP front-end framework will automatically refresh the token business logic;

[0112] Non-JUP front-end frameworks can implement their own token refresh functionality: when rendering a page or making an AJAX request, if the page is already within the refreshable time, a refresh will be initiated; if the page is already within the deferred time, a refresh will be initiated.

[0113] Example 2:

[0114] Example 2 is a preferred embodiment of Example 1, and is used to illustrate the present invention in more detail.

[0115] Those skilled in the art can understand the enterprise-level gateway authentication method provided by the present invention as a specific implementation of an enterprise-level gateway authentication system, that is, the enterprise-level gateway authentication system can be implemented by executing the steps of the enterprise-level gateway authentication method.

[0116] An enterprise-level gateway authentication system provided by the present invention includes:

[0117] Module M1: Manages and authorizes published APIs;

[0118] Module M2: The gateway makes unified calls to the API to determine whether authentication is required for each API access request;

[0119] If authentication is required for each API access request, proceed to module M3; otherwise, proceed to module M4.

[0120] Module M3: When authentication is required for each API access request, pass-through authentication or token authentication is required.

[0121] Specifically, in module M3:

[0122] Pass-through authentication includes:

[0123] Use the subscriber and subscription credentials issued by the gateway to initiate a request to the gateway;

[0124] The gateway verifies whether the subscriber and subscription credential information are correct;

[0125] The gateway verifies whether the subscriber has an API request for subscription.

[0126] The gateway forwards requests to the backend service.

[0127] Specifically, token authentication includes:

[0128] Use the subscriber and subscription credentials issued by the gateway to request the gateway's get token interface;

[0129] The gateway verifies the correctness of the subscriber and subscription credentials, and generates a token to return to the requester if the verification is successful.

[0130] The requester uses the tokens returned by the subscriber and the gateway to request the business API from the gateway;

[0131] The gateway verifies whether the token sent by the requester is valid;

[0132] The gateway verifies whether the subscriber has an API request for subscription;

[0133] The gateway forwards requests to the backend service;

[0134] If the token verified at the gateway has exceeded the preset expiration time, the requester will use the refresh token request to request the gateway's refresh token interface, and subsequent requests to the business API will use the new token.

[0135] Module M4: When it is not necessary to authenticate every API access request, web authentication is performed. The gateway forwards the request to the backend microservice, and the microservice performs the authentication.

[0136] Specifically, in module M4:

[0137] Web certification includes:

[0138] Using the subscriber, subscription credentials, username, and password issued by the gateway, request the general service login interface through the gateway.

[0139] The gateway verifies whether the subscriber and subscription credential information are correct.

[0140] The gateway forwards the username and password to the general service login interface;

[0141] The general service verifies whether the username and password are correct. If correct, it generates a token and refreshes the token, returning the result.

[0142] The requester uses the tokens returned by the subscriber and the general service to request the business API;

[0143] The gateway checks whether the subscriber sent by the requester is of web authentication type. If so, it calls the authentication interface of the general service and passes the token to the general service.

[0144] The general service parses the token, extracts the username from it, adds the requested application and its API, and checks whether the user has subscribed to the API.

[0145] The general service returns a message to the gateway indicating that the current requester has permission to request the API, and the gateway then forwards the request to the backend application.

[0146] If the general service finds that the token meets the preset requirements but has exceeded the preset period, it will notify the requester. The requester will then use the refresh token to request the refresh token interface of the general service. The general service will generate a new token and a refresh token and return them to the requester. Subsequent requests will use the new token.

[0147] Specifically, the JUP front-end framework will automatically refresh the token business logic;

[0148] Non-JUP front-end frameworks can implement their own token refresh functionality: when rendering a page or making an AJAX request, if the page is already within the refreshable time, a refresh will be initiated; if the page is already within the deferred time, a refresh will be initiated.

[0149] Example 3:

[0150] Example 3 is a preferred example of Example 1, and is used to illustrate the present invention in more detail.

[0151] JUP Gateway can meet the authentication modes of different scenarios. It uses a technology platform to manage and authorize published APIs. When the gateway calls APIs uniformly, it determines whether authentication is required for each API access request based on the different types, effectively protecting backend service resources.

[0152] JUP gateway provides three authentication methods: pass-through, TOKEN, and WEB authentication. For pass-through and TOKEN types, the gateway needs to authenticate each API access request. In WEB authentication mode, the gateway forwards the request to the backend microservice, and the microservice performs its own authentication.

[0153] Method A: Pass-through Authentication

[0154] Step 1: Use the subscriber and subscription credentials issued by the gateway to initiate a request to the gateway.

[0155] Step 2: The gateway verifies whether the subscriber and subscription credential information are correct.

[0156] Step 3: The gateway verifies whether the subscriber has an API request for subscription.

[0157] Step 4: The gateway forwards the request to the backend service.

[0158] Method B: Token Authentication

[0159] Step 1: Use the subscriber and subscription credentials issued by the gateway to request the gateway's token acquisition interface / api / auth / token / generate.

[0160] Step 2: The gateway verifies the correctness of the subscriber and subscription credentials. If successful, it generates a token and returns it to the requester.

[0161] Step 3: The requester uses the tokens returned by the subscriber and the gateway to request the business API from the gateway.

[0162] Step 4: The gateway verifies whether the token sent by the requester is valid.

[0163] Step 5: The gateway verifies whether the subscriber has an API request for subscription.

[0164] Step 6: The gateway forwards the request to the backend service.

[0165] Step 7: If the token verification at the gateway has expired, the requester uses the refresh token to request the gateway's refresh token interface / api / auth / token / refresh, and subsequent requests to the business API will use the new token.

[0166] Method C: Web Authentication

[0167] Step 1: Using the subscriber, subscription credentials, username, and password issued by the gateway, request the general service login interface through the gateway.

[0168] Step 2: The gateway verifies whether the subscriber and subscription credential information are correct.

[0169] Step 3: The gateway forwards the username and password to the general service login interface.

[0170] Step 4: The general service verifies whether the username and password are correct. If correct, it generates a token and refreshes the token and returns it.

[0171] Step 5: The requester uses the token returned by the subscriber and the general service to request the business API;

[0172] Step 6: The gateway checks whether the subscriber sent by the requester is of web authentication type. If so, it calls the authentication interface of the general service and passes the token to the general service.

[0173] Step 7: The general service parses the token, retrieves the username from it, adds the requested application and its API, and checks whether the user has subscribed to the API;

[0174] Step 8: The general service returns to the gateway that the current requester has permission to request the API, and the gateway then forwards the request to the backend application;

[0175] Step 9: If the general service finds that the token is valid but has expired, it will notify the requester. The requester will then use the refresh token to request the refresh token interface of the general service. The general service will generate a new token and a refresh token and return them to the requester. Subsequent requests will use the new token.

[0176] The JUP front-end framework automatically refreshes the token, so business logic doesn't require your attention. For non-JUP front-end frameworks, you'll need to implement your own token refresh functionality: during page rendering and AJAX requests: 1. If the page is already within the refreshable timeframe, initiate a refresh; 2. If the page is already within the grace period, initiate a refresh.

[0177] Without a gateway, the front-end and back-end are developed separately, and the server-side application is not affected. The front-end application does not need to send subscribers.

[0178] Those skilled in the art will understand that, in addition to implementing the system, apparatus, and their modules provided by this invention in purely computer-readable program code, the same program can be implemented in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers by logically programming the method steps. Therefore, the system, apparatus, and their modules provided by this invention can be considered a hardware component, and the modules included therein for implementing various programs can also be considered structures within the hardware component; alternatively, modules for implementing various functions can be considered both software programs implementing the method and structures within the hardware component.

[0179] Specific embodiments of the present invention have been described above. It should be understood that the present invention is not limited to the specific embodiments described above, and those skilled in the art can make various changes or modifications within the scope of the claims, which do not affect the essence of the present invention. Unless otherwise specified, the embodiments and features described in this application can be arbitrarily combined with each other.

Claims

1. An enterprise-level gateway authentication method, characterized in that, include: Step S1: Manage and authorize the published APIs; Step S2: The gateway makes a unified call to the API to determine whether authentication is required for each API access request; If authentication is required for each API access request, proceed to step S3; If authentication is not required for every API access request, proceed to step S4; Step S3: When authentication is required for each API access request, pass-through authentication or TOKEN authentication should be performed. Step S4: When it is not necessary to authenticate every API access request, web authentication is performed. The gateway forwards the request to the backend microservice, and the microservice performs the authentication. In step S3: Pass-through authentication includes: Use the subscriber and subscription credentials issued by the gateway to initiate a request to the gateway; The gateway verifies whether the subscriber and subscription credential information are correct; The gateway verifies whether the subscriber has an API request for subscription. The gateway forwards requests to the backend service; In step S4: Web certification includes: Using the subscriber, subscription credentials, username, and password issued by the gateway, request the general service login interface through the gateway. The gateway verifies whether the subscriber and subscription credential information are correct; The gateway forwards the username and password to the general service login interface; The general service verifies whether the username and password are correct. If correct, it generates a token and refreshes the token, returning the result. The requester uses the tokens returned by the subscriber and the general service to request the business API; The gateway checks whether the subscriber sent by the requester is of web authentication type. If so, it calls the authentication interface of the general service and passes the token to the general service. The general service parses the token, extracts the username from it, adds the requested application and its API, and checks whether the user has subscribed to the API. The general service returns a message to the gateway indicating that the current requester has permission to request the API, and the gateway then forwards the request to the backend application. If the general service finds that the token meets the preset requirements but has exceeded the preset period, it will notify the requester. The requester will then use the refresh token to request the refresh token interface of the general service. The general service will generate a new token and a refresh token and return them to the requester. Subsequent requests will use the new token.

2. The enterprise-level gateway authentication method according to claim 1, characterized in that: Token authentication includes: Use the subscriber and subscription credentials issued by the gateway to request the gateway's get token interface; The gateway verifies the correctness of the subscriber and subscription credentials, and generates a token to return to the requester if the verification is successful. The requester uses the tokens returned by the subscriber and the gateway to request the business API from the gateway; The gateway verifies whether the token sent by the requester is valid; The gateway verifies whether the subscriber has an API request for subscription; The gateway forwards requests to the backend service; If the token verified at the gateway has exceeded the preset expiration time, the requester will use the refresh token request to request the gateway's refresh token interface, and subsequent requests to the business API will use the new token.

3. The enterprise-level gateway authentication method according to claim 1, characterized in that: The JUP front-end framework will automatically refresh the token business logic. Non-JUP front-end frameworks can implement their own token refresh functionality: when rendering a page or making an AJAX request, if the page is already within the refreshable time, a refresh will be initiated; if the page is already within the deferred time, a refresh will be initiated.

4. An enterprise-level gateway authentication system, characterized in that, include: Module M1: Manages and authorizes published APIs; Module M2: The gateway makes unified calls to the API to determine whether authentication is required for each API access request; If authentication is required for each API access request, redirect to module M3; If authentication is not required for every API access request, proceed to module M4; Module M3: When authentication is required for each API access request, pass-through authentication or token authentication is required. Module M4: When it is not necessary to authenticate every API access request, web authentication is performed. The gateway forwards the request to the backend microservice, and the microservice performs the authentication. In module M3: Pass-through authentication includes: Use the subscriber and subscription credentials issued by the gateway to initiate a request to the gateway; The gateway verifies whether the subscriber and subscription credential information are correct; The gateway verifies whether the subscriber has an API request for subscription. The gateway forwards requests to the backend service; In module M4: Web certification includes: Using the subscriber, subscription credentials, username, and password issued by the gateway, request the general service login interface through the gateway. The gateway verifies whether the subscriber and subscription credential information are correct; The gateway forwards the username and password to the general service login interface; The general service verifies whether the username and password are correct. If correct, it generates a token and refreshes the token, returning the result. The requester uses the tokens returned by the subscriber and the general service to request the business API; The gateway checks whether the subscriber sent by the requester is of web authentication type. If so, it calls the authentication interface of the general service and passes the token to the general service. The general service parses the token, extracts the username from it, adds the requested application and its API, and checks whether the user has subscribed to the API. The general service returns a message to the gateway indicating that the current requester has permission to request the API, and the gateway then forwards the request to the backend application. If the general service finds that the token meets the preset requirements but has exceeded the preset period, it will notify the requester. The requester will then use the refresh token to request the refresh token interface of the general service. The general service will generate a new token and a refresh token and return them to the requester. Subsequent requests will use the new token.

5. The enterprise-level gateway authentication system according to claim 4, characterized in that: Token authentication includes: Use the subscriber and subscription credentials issued by the gateway to request the gateway's get token interface; The gateway verifies the correctness of the subscriber and subscription credentials, and generates a token to return to the requester if the verification is successful. The requester uses the tokens returned by the subscriber and the gateway to request the business API from the gateway; The gateway verifies whether the token sent by the requester is valid; The gateway verifies whether the subscriber has an API request for subscription; The gateway forwards requests to the backend service; If the token verified at the gateway has exceeded the preset expiration time, the requester will use the refresh token request to request the gateway's refresh token interface, and subsequent requests to the business API will use the new token.

6. The enterprise-level gateway authentication system according to claim 4, characterized in that: The JUP front-end framework will automatically refresh the token business logic. Non-JUP front-end frameworks can implement their own token refresh functionality: when rendering a page or making an AJAX request, if the page is already within the refreshable time, a refresh will be initiated; if the page is already within the deferred time, a refresh will be initiated.

Images