Token injection access method, device, electronic device and storage medium based on zero-trust gateway

Abstract

The present application provides a token injection access method, device, electronic device and storage medium based on a zero-trust gateway. Among them, the token injection access method based on the zero-trust gateway includes: receiving an access request sent by a client terminal; determining that the access request is the first page request for the target application, and extracting the token carried by the url of the access request; injecting the token carried by the url of the access request into the set cookie field in the response header, and setting the jump domain name to the url of the access request; constructing a response message based on the jump domain name and the response header, and returning the response message to the client terminal, so that the client terminal stores the token carried by the response message in a local cookie, and jumps to the zero-trust gateway based on the jump domain name in the response message, and so that the subsequent requests initiated by the client terminal for the target application carry local cookies. The present application can reduce the number of times the gateway unpacks and injects tokens, thereby improving the concurrency performance of the gateway.

Description

Technical Field

[0001] The present application relates to the field of computers, and in particular to a token injection access method, device, electronic device and storage medium based on a zero-trust gateway. Background Art

[0002] Typically, a client terminal can initiate an access request to an application server to obtain resources provided by the application server. However, in some scenarios, it is necessary to control the access request of the client terminal. For example, it is necessary to implement a function that only qualified client terminals can access the application server.

[0003] Furthermore, the existing technology implements the above functions through two security gateways in the network, wherein one of the two security gateways is used to generate an identity token and inject the identity token into the access request of the client terminal, and the second security gateway verifies the identity token in the access request, and after the identity token verification is passed, enables the client terminal to communicate with the application server, and ultimately enables the client terminal to access the resources provided by the application server.

[0004] In the above-mentioned prior art, the first security gateway needs to unpack and parse each access request to inject the identity token into the access request. For example, for six access requests initiated by the client terminal, the first security gateway needs to unpack and parse all six access requests and inject the identity token. In other words, the first security gateway needs to perform the unpacking, parsing, and injection process six times. This will reduce the concurrent processing capability of the first security gateway. Therefore, the prior art suffers from the disadvantage of low gateway concurrency performance. Summary of the Invention

[0005] The purpose of the embodiments of the present application is to provide a token injection access method, device, electronic device and storage medium based on a zero-trust gateway, so as to reduce the number of times the gateway unpacks and injects tokens, thereby improving the gateway concurrency performance.

[0006] In a first aspect, the present invention provides a token injection access method based on a zero-trust gateway, the method being applied to a zero-trust gateway, the method comprising:

[0007] receiving an access request sent by a client terminal;

[0008] Determine whether the URL of the access request carries a token and whether the cookie in the access request carries a token;

[0009] When the URL of the access request carries a token and the cookie in the access request does not carry a token, determining that the access request is the first page request for the target application, and extracting the token carried by the URL of the access request;

[0010] Inject the token carried by the access request URL into the set cookie field in the response header, and set the jump domain name to the access request URL;

[0011] A response message is constructed based on the jump domain name and the response header, and the response message is returned to the client terminal, so that the client terminal stores the token carried by the response message in a local cookie, and jumps to the zero-trust gateway based on the jump domain name in the response message, and so that subsequent requests initiated by the client terminal for the target application carry the local cookie.

[0012] In the first aspect of the present application, by receiving an access request sent by a client terminal, and judging whether the URL of the access request carries a token and judging whether the cookie in the access request carries a token, when the URL of the access request carries a token and the cookie in the access request does not carry a token, it is possible to determine that the access request is the first page request for the target application, and extract the token carried by the URL of the access request, and then inject the token carried by the URL of the access request into the set cookie field in the response header, and set the jump domain name to the URL of the access request, it is possible to construct a response message based on the jump domain name and the response header, and return the response message to the client terminal, so that the client terminal stores the token carried by the response message into the local cookie, and jumps to the zero trust gateway based on the jump domain name in the response message, and enables the client terminal to carry the local cookie in subsequent requests initiated for the target application.

[0013] Compared with the existing technology, this application can inject the token into the set cookie field of the response header after the client terminal initiates the first page request, so that the client terminal can save the token to the local cookie, and then carry the token in subsequent requests to the target application. In this way, the gateway needs to inject the token in subsequent requests to the target application, thereby reducing the number of times the gateway unpacks and injects the token, thereby improving the gateway's concurrent processing performance.

[0014] In an optional embodiment, the method further comprises:

[0015] When the client terminal jumps to the zero-trust gateway based on the jump domain name in the response information, the token carried by the URL of the access request is verified, and after the token verification is passed, the communication connection between the client terminal and the application server is allowed.

[0016] In the above optional implementation, when the client terminal jumps to the zero-trust gateway based on the jump domain name in the response information, by verifying the token carried by the URL of the access request, the communication connection between the client terminal and the application server can be allowed after the token verification is passed.

[0017] In an optional embodiment, the method further comprises:

[0018] When receiving a subsequent request sent by the client terminal to the target application, extracting the local cookie carried in the subsequent request;

[0019] Extracting the token based on the local cookie;

[0020] The token is verified, and after the token verification is passed, the communication connection between the client terminal and the application server is allowed.

[0021] In the above optional embodiment, when a subsequent request sent by the client terminal to the target application is received, the token can be extracted based on the local cookie by extracting the local cookie carried by the subsequent request, and the token can be verified. After the token verification is passed, the communication connection between the client terminal and the application server is allowed.

[0022] In an optional embodiment, the method further comprises:

[0023] Using the token extracted based on the local cookie as a first token;

[0024] Extracting a second token based on the URL of the subsequent request;

[0025] The first token is compared with the second token. If the first token is different from the second token, the second token is injected into the set cookie field in the response header, and the jump domain name is set to the URL of the subsequent request, so that the client terminal updates the local cookie based on the second token, and jumps to the zero trust gateway based on the URL of the subsequent request, and the client terminal initiates a request based on the updated local cookie.

[0026] In the above optional implementation, by using the token extracted based on the local cookie as the first token and extracting the second token based on the URL of the subsequent request, the first token and the second token can be compared. If the first token is different from the second token, the second token can be injected into the set cookie field in the response header, and the jump domain name can be set to the URL of the subsequent request, so that the client terminal updates the local cookie based on the second token, and jumps to the zero trust gateway based on the URL of the subsequent request, and the client terminal initiates a request based on the updated local cookie.

[0027] In an optional embodiment, the method further comprises:

[0028] Receiving response data returned by the application server;

[0029] Filtering the response data to filter out sensitive information in the response data;

[0030] The filtered response data is sent to the client terminal.

[0031] In the above optional implementation manner, by receiving the response data returned by the application server, the response data can be filtered to filter out sensitive information in the response data, so that the filtered response data can be sent to the client terminal.

[0032] In an optional implementation manner, the token carried in the URL of the access request is generated by an authentication service after the client terminal passes authentication.

[0033] In the above optional implementation, the token carried by the URL of the access request is generated by the authentication service after the client terminal is authenticated, so there is no need for the gateway to generate a token, which can further improve the concurrent processing capability of the gateway.

[0034] In an optional implementation manner, the subsequent request includes a static resource acquisition request for the target application and an interface request for the target application.

[0035] In the above optional implementation manner, the gateway does not need to inject a token into a static resource acquisition request for a target application, and does not need to inject a token into an interface request for the target application.

[0036] In a second aspect, the present invention provides a token injection access device based on a zero-trust gateway, the device being applied to a zero-trust gateway, the device comprising:

[0037] A receiving module, configured to receive an access request sent by a client terminal;

[0038] A judgment module, used to judge whether the URL of the access request carries a token and whether the cookie in the access request carries a token;

[0039] a determination module, configured to, when the URL of the access request carries a token and the cookie in the access request does not carry a token, determine that the access request is the first page request for the target application and extract the token carried by the URL of the access request;

[0040] An injection module is used to inject the token carried by the URL of the access request into the set cookie field in the response header, and set the jump domain name to the URL of the access request;

[0041] A response module is used to construct a response message based on the jump domain name and the response header, and return the response message to the client terminal, so that the client terminal stores the token carried by the response message in a local cookie, and jumps to the zero-trust gateway based on the jump domain name in the response message, and enables the client terminal to carry the local cookie in subsequent requests initiated for the target application.

[0042] The present application receives an access request sent by a client terminal, and determines whether the URL of the access request carries a token and whether the cookie in the access request carries a token. When the URL of the access request carries a token and the cookie in the access request does not carry a token, it can determine that the access request is the first page request for the target application, and extract the token carried by the URL of the access request. Then, by injecting the token carried by the URL of the access request into the set cookie field in the response header and setting the jump domain name to the URL of the access request, it can construct a response message based on the jump domain name and the response header, and return the response message to the client terminal, so that the client terminal stores the token carried by the response message into the local cookie, and jumps to the zero-trust gateway based on the jump domain name in the response message, and enables the client terminal to carry the local cookie in subsequent requests initiated for the target application.

[0043] Compared with the existing technology, this application can inject the token into the set cookie field of the response header after the client terminal initiates the first page request, so that the client terminal can save the token to the local cookie, and then carry the token in subsequent requests to the target application. In this way, the gateway needs to inject the token in subsequent requests to the target application, thereby reducing the number of times the gateway unpacks and injects the token, thereby improving the gateway's concurrent processing performance.

[0044] In a third aspect, the present invention provides an electronic device, comprising:

[0045] processor; and

[0046] A memory is configured to store machine-readable instructions, which, when executed by the processor, execute the token injection access method based on the zero-trust gateway as described in any of the aforementioned embodiments.

[0047] The electronic device of the present application executes a token injection access method based on a zero-trust gateway, thereby being able to receive an access request sent by a client terminal, and determine whether the URL of the access request carries a token and whether the cookie in the access request carries a token. When the URL of the access request carries a token and the cookie in the access request does not carry a token, it is possible to determine that the access request is the first page request for the target application, and extract the token carried by the URL of the access request. By injecting the token carried by the URL of the access request into the set cookie field in the response header and setting the jump domain name to the URL of the access request, a response message can be constructed based on the jump domain name and the response header, and the response message can be returned to the client terminal, so that the client terminal stores the token carried by the response message into a local cookie, and jumps to the zero-trust gateway based on the jump domain name in the response message, and enables the client terminal to carry the local cookie in subsequent requests initiated for the target application.

[0048] Compared with the existing technology, this application can inject the token into the set cookie field of the response header after the client terminal initiates the first page request, so that the client terminal can save the token to the local cookie, and then carry the token in subsequent requests to the target application. In this way, the gateway needs to inject the token in subsequent requests to the target application, thereby reducing the number of times the gateway unpacks and injects the token, thereby improving the gateway's concurrent processing performance.

[0049] In a fourth aspect, the present invention provides a storage medium storing a computer program, wherein the computer program is executed by a processor as the token injection access method based on the zero-trust gateway as described in any one of the aforementioned embodiments.

[0050] The storage medium of the present application executes a token injection access method based on a zero-trust gateway, thereby being able to receive an access request sent by a client terminal, and determine whether the URL of the access request carries a token and whether the cookie in the access request carries a token. When the URL of the access request carries a token and the cookie in the access request does not carry a token, it is possible to determine that the access request is the first page request for the target application, and extract the token carried by the URL of the access request. By injecting the token carried by the URL of the access request into the set cookie field in the response header and setting the jump domain name to the URL of the access request, a response message can be constructed based on the jump domain name and the response header, and the response message can be returned to the client terminal, so that the client terminal stores the token carried by the response message in a local cookie, and jumps to the zero-trust gateway based on the jump domain name in the response message, and enables the client terminal to carry the local cookie in subsequent requests initiated for the target application.

[0051] Compared with the existing technology, this application can inject the token into the set cookie field of the response header after the client terminal initiates the first page request, so that the client terminal can save the token to the local cookie, and then carry the token in subsequent requests to the target application. In this way, the gateway needs to inject the token in subsequent requests to the target application, thereby reducing the number of times the gateway unpacks and injects the token, thereby improving the gateway's concurrent processing performance. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments of the present application. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other relevant drawings can be obtained based on these drawings without creative work.

[0053] Figure 1 This is a flowchart of a token injection access method for a zero-trust gateway disclosed in an embodiment of the present application;

[0054] Figure 2 This is a structural diagram of a token injection access device for a zero-trust gateway disclosed in an embodiment of the present application;

[0055] Figure 3 This is a structural diagram of an electronic device disclosed in an embodiment of the present application. DETAILED DESCRIPTION

[0056] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0057] Example 1

[0058] See also Figure 1 , Figure 1 This is a flow chart of a token injection access method for a zero-trust gateway disclosed in an embodiment of the present application, wherein the token injection access method for a zero-trust gateway is applied to a zero-trust gateway. Figure 1 As shown, the method of the embodiment of the present application includes the following steps:

[0059] 101. Receive an access request sent by a client terminal;

[0060] 102. Determine whether the URL of the access request carries a token and whether the cookie in the access request carries a token;

[0061] 103. When the URL of the access request carries the token, and the cookie in the access request does not carry the token, determine that the access request is the first page request for the target application, and extract the token carried by the URL of the access request;

[0062] 104. Inject the token carried by the access request URL into the set cookie field in the response header, and set the redirect domain name to the access request URL;

[0063] 105. Construct a response message based on the jump domain name and the response header, and return the response message to the client terminal, so that the client terminal stores the token carried in the response message into a local cookie, and jumps to the zero-trust gateway based on the jump domain name in the response message, and enables the client terminal to carry the local cookie in subsequent requests initiated for the target application.

[0064] In an embodiment of the present application, by receiving an access request sent by a client terminal, and determining whether the URL of the access request carries a token and whether the cookie in the access request carries a token, when the URL of the access request carries a token and the cookie in the access request does not carry a token, it is possible to determine that the access request is the first page request for the target application, and extract the token carried by the URL of the access request, and then inject the token carried by the URL of the access request into the set cookie field in the response header, and set the jump domain name to the URL of the access request, it is possible to construct a response message based on the jump domain name and the response header, and return the response message to the client terminal, so that the client terminal stores the token carried by the response message in the local cookie, and jumps to the zero-trust gateway based on the jump domain name in the response message, and enables the client terminal to carry local cookies in subsequent requests initiated for the target application.

[0065] Compared with the existing technology, the embodiment of the present application can inject the token into the set cookie field of the response header after the client terminal initiates the first page request, so that the client terminal can save the token to the local cookie, and then carry the token in subsequent requests to the target application. In this way, the gateway needs to inject the token in subsequent requests to the target application, thereby reducing the number of times the gateway unpacks and injects the token, thereby improving the gateway's concurrent processing performance.

[0066] In an embodiment of the present application, for example, assuming that the client terminal needs to access page A of the application server and the data required by page A, the client terminal initiates an access request to the zero-trust gateway. When the gateway determines that the access request is for page A, it returns a token to the client terminal through the response header, so that after the client terminal obtains page A, the subsequent requests such as static resource access requests for page A carry the token. In this way, the gateway does not need to inject the token in subsequent requests.

[0067] In the embodiment of the present application, with respect to step 101, the client terminal may refer to a browser, which is not limited in the embodiment of the present application.

[0068] In the embodiment of the present application, for steps 102 and 103, the URL of the access request refers to the Uniform Resource Locator (URL). Furthermore, if the access request is the first page request for the target application, it means that the client terminal has not accessed the target application before. Therefore, the gateway does not return the token to the client terminal, and the local cookie of the client terminal does not carry the token. Therefore, the access request generated based on the local cookie does not carry the token.

[0069] In an embodiment of the present application, for step 104, after the client terminal stores the token in a local cookie, it can jump to the zero-trust gateway based on the jump domain name, and re-access the zero-trust gateway based on the jump domain name.

[0070] In an embodiment of the present application, a zero-trust gateway refers to a gateway in a zero-trust network, wherein the zero-trust gateway in an embodiment of the present application may refer to one gateway of the zero-trust network or two gateways. For example, when the zero-trust gateway refers to one gateway of the zero-trust network, one gateway may be dedicated to detecting whether a token is carried in an access request, and the other gateway may be dedicated to verifying the token.

[0071] In an embodiment of the present application, the token may include an application token and a user token.

[0072] In an optional embodiment, the method of the embodiment of the present application further includes the following steps:

[0073] When the client terminal jumps to the zero-trust gateway based on the jump domain name in the response information, the token carried by the URL of the access request is verified, and after the token verification is passed, the communication connection between the client terminal and the application server is allowed.

[0074] In the above optional implementation, when the client terminal jumps to the zero-trust gateway based on the jump domain name in the response information, by verifying the token carried by the URL of the access request, the communication connection between the client terminal and the application server can be allowed after the token verification is passed.

[0075] In an optional embodiment, the method in the embodiment of the present application further includes the following steps:

[0076] When receiving a subsequent request sent by the client terminal to the target application, extract the local cookie carried in the subsequent request;

[0077] Extract token based on local cookie;

[0078] The token is verified, and after the token verification is passed, the communication connection between the client terminal and the application server is allowed.

[0079] In the above optional implementation, when a subsequent request sent by the client terminal to the target application is received, the token can be extracted based on the local cookie by extracting the local cookie carried in the subsequent request, and the token can be verified. After the token verification is passed, the communication connection between the client terminal and the application server is allowed.

[0080] In an optional embodiment, the method of the embodiment of the present application further includes the following steps:

[0081] Use the token extracted based on the local cookie as the first token;

[0082] Extract the second token based on the URL of the subsequent request;

[0083] The first token is compared with the second token. If the first token is different from the second token, the second token is injected into the set cookie field in the response header, and the jump domain name is set to the URL of the subsequent request, so that the client terminal updates the local cookie based on the second token, and jumps to the zero trust gateway based on the URL of the subsequent request, and the client terminal initiates a request based on the updated local cookie.

[0084] In the above optional implementation, by using the token extracted based on the local cookie as the first token and extracting the second token based on the URL of the subsequent request, the first token and the second token can be compared. If the first token and the second token are different, the second token can be injected into the set cookie field in the response header, and the jump domain name can be set to the URL of the subsequent request, so that the client terminal updates the local cookie based on the second token, and jumps to the zero trust gateway based on the URL of the subsequent request, and the client terminal initiates a request based on the updated local cookie.

[0085] In an optional embodiment, the method of the embodiment of the present application further includes the following steps:

[0086] Receive response data returned by the application server;

[0087] Filter the response data to filter out sensitive information in the response data;

[0088] Send the filtered response data to the client terminal.

[0089] In the above optional implementation, by receiving the response data returned by the application server, the response data can be filtered to filter out sensitive information in the response data, so that the filtered response data can be sent to the client terminal.

[0090] In the above optional implementation, authentication

[0091] In an optional implementation, the token carried in the URL of the access request is generated by the authentication service after the client terminal passes the authentication.

[0092] In the above optional implementation, the token carried by the URL of the access request is generated by the authentication service after the client terminal is authenticated, so there is no need for the gateway to generate a token, which can further improve the concurrent processing capability of the gateway.

[0093] In an optional implementation manner, the subsequent request includes a static resource acquisition request for the target application and an interface request for the target application.

[0094] In the above optional implementation manner, the gateway does not need to inject a token into a static resource acquisition request for the target application, or inject a token into an interface request for the target application.

[0095] Example 2

[0096] See also Figure 2 , Figure 2 This is a schematic diagram of a token injection access device based on a zero-trust gateway disclosed in an embodiment of the present application. The device is applied to a zero-trust gateway, such as Figure 2 As shown, the device of the embodiment of the present application includes the following functional modules:

[0097] Receiving module 201, used to receive an access request sent by a client terminal;

[0098] A determination module 202 is used to determine whether the URL of the access request carries a token and whether the cookie in the access request carries a token;

[0099] Determination module 203, configured to determine that the access request is the first page request for the target application when the URL of the access request carries the token and the cookie in the access request does not carry the token, and extract the token carried by the URL of the access request;

[0100] The injection module 204 is used to inject the token carried by the access request URL into the set cookie field in the response header, and set the jump domain name to the access request URL;

[0101] Response module 205 is used to construct a response message based on the jump domain name and the response header, and return the response message to the client terminal, so that the client terminal stores the token carried by the response message in a local cookie, and jumps to the zero-trust gateway based on the jump domain name in the response message, and enables the client terminal to carry the local cookie in subsequent requests initiated by the target application.

[0102] The embodiment of the present application receives an access request sent by a client terminal, and determines whether the URL of the access request carries a token and whether the cookie in the access request carries a token. When the URL of the access request carries a token and the cookie in the access request does not carry a token, it can determine that the access request is the first page request for the target application, and extract the token carried by the URL of the access request. Then, by injecting the token carried by the URL of the access request into the set cookie field in the response header and setting the jump domain name to the URL of the access request, it can construct a response message based on the jump domain name and the response header, and return the response message to the client terminal, so that the client terminal stores the token carried by the response message into the local cookie, and jumps to the zero-trust gateway based on the jump domain name in the response message, and enables the client terminal to carry the local cookie in subsequent requests initiated for the target application.

[0103] Compared with the existing technology, the embodiment of the present application can inject the token into the set cookie field of the response header after the client terminal initiates the first page request, so that the client terminal can save the token to the local cookie, and then carry the token in subsequent requests to the target application. In this way, the gateway needs to inject the token in subsequent requests to the target application, thereby reducing the number of times the gateway unpacks and injects the token, thereby improving the gateway's concurrent processing performance.

[0104] It should be noted that for other detailed descriptions of the device in the embodiment of the present application, please refer to the relevant description of the first embodiment of the present application, and the embodiment of the present application will not go into details thereon.

[0105] Example 3

[0106] See also Figure 3 , Figure 3 is a structural diagram of an electronic device disclosed in an embodiment of the present application, such as Figure 3 As shown, the electronic device of the embodiment of the present application includes:

[0107] Processor 301; and

[0108] The memory 302 is configured to store machine-readable instructions. When the instructions are executed by the processor 301, the token injection access method based on the zero-trust gateway is executed as described in any of the aforementioned embodiments.

[0109] The electronic device of the embodiment of the present application can receive the access request sent by the client terminal, and judge whether the URL of the access request carries the token and whether the cookie in the access request carries the token by executing the token injection access method based on the zero-trust gateway. When the URL of the access request carries the token and the cookie in the access request does not carry the token, it can determine that the access request is the first page request for the target application, and extract the token carried by the URL of the access request. Then, by injecting the token carried by the URL of the access request into the set cookie field in the response header and setting the jump domain name to the URL of the access request, it can construct a response message based on the jump domain name and the response header, and return the response message to the client terminal, so that the client terminal stores the token carried by the response message in the local cookie, and jumps to the zero-trust gateway based on the jump domain name in the response message, and enables the client terminal to carry the local cookie in subsequent requests initiated for the target application.

[0110] Compared with the existing technology, the embodiment of the present application can inject the token into the set cookie field of the response header after the client terminal initiates the first page request, so that the client terminal can save the token to the local cookie, and then carry the token in subsequent requests to the target application. In this way, the gateway needs to inject the token in subsequent requests to the target application, thereby reducing the number of times the gateway unpacks and injects the token, thereby improving the gateway's concurrent processing performance.

[0111] Example 4

[0112] An embodiment of the present application provides a storage medium storing a computer program, and the computer program is executed by a processor to implement a token injection access method based on a zero-trust gateway as described in any of the aforementioned implementations.

[0113] The storage medium of the embodiment of the present application executes a token injection access method based on a zero-trust gateway, thereby being able to receive an access request sent by a client terminal, and determine whether the URL of the access request carries a token and whether the cookie in the access request carries a token. When the URL of the access request carries a token and the cookie in the access request does not carry a token, it is possible to determine that the access request is the first page request for the target application, and extract the token carried by the URL of the access request. By injecting the token carried by the URL of the access request into the set cookie field in the response header and setting the jump domain name to the URL of the access request, a response message can be constructed based on the jump domain name and the response header, and the response message can be returned to the client terminal, so that the client terminal stores the token carried by the response message in the local cookie, and jumps to the zero-trust gateway based on the jump domain name in the response message, and enables the client terminal to carry the local cookie in subsequent requests initiated for the target application.

[0114] Compared with the existing technology, the embodiment of the present application can inject the token into the set cookie field of the response header after the client terminal initiates the first page request, so that the client terminal can save the token to the local cookie, and then carry the token in subsequent requests to the target application. In this way, the gateway needs to inject the token in subsequent requests to the target application, thereby reducing the number of times the gateway unpacks and injects the token, thereby improving the gateway's concurrent processing performance.

[0115] In the embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interface, the indirect coupling or communication connection of the device or unit can be electrical, mechanical or other forms.

[0116] In addition, the units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0117] Furthermore, the functional modules in each embodiment of the present application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0118] It should be noted that if the function is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the various embodiments of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0119] In this document, relational terms such as first and second, etc. are used merely to distinguish one entity or operation from another entity or operation, but do not necessarily require or imply any actual relationship or order between these entities or operations.

[0120] The above are merely examples of the present application and are not intended to limit the scope of protection of the present application. Those skilled in the art will appreciate that various modifications and variations are possible. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present application shall be included within the scope of protection of the present application.

Claims

1. A token injection access method based on zero trust gateway, characterized in that: The method is applied to a zero-trust gateway, and the method includes: receiving an access request sent by a client terminal; Determine whether the URL of the access request carries a token and whether the cookie in the access request carries a token; When the URL of the access request carries a token and the cookie in the access request does not carry a token, determining that the access request is the first page request for the target application, and extracting the token carried by the URL of the access request; Inject the token carried by the access request URL into the set cookie field in the response header, and set the jump domain name to the access request URL; A response message is constructed based on the jump domain name and the response header, and the response message is returned to the client terminal, so that the client terminal stores the token carried by the response message in a local cookie, and jumps to the zero-trust gateway based on the jump domain name in the response message, and so that subsequent requests initiated by the client terminal for the target application carry the local cookie.

2. The method according to claim 1, wherein The method further comprises: When the client terminal jumps to the zero-trust gateway based on the jump domain name in the response information, the token carried by the URL of the access request is verified, and after the token verification is passed, the communication connection between the client terminal and the application server is allowed.

3. The method according to claim 1, wherein The method further comprises: When receiving a subsequent request sent by the client terminal to the target application, extracting the local cookie carried in the subsequent request; Extracting the token based on the local cookie; The token is verified, and after the token verification is passed, the communication connection between the client terminal and the application server is allowed.

4. The method according to claim 1, wherein The method further comprises: Using the token extracted based on the local cookie as a first token; Extracting a second token based on the URL of the subsequent request; The first token is compared with the second token. If the first token is different from the second token, the second token is injected into the set cookie field in the response header, and the jump domain name is set to the URL of the subsequent request, so that the client terminal updates the local cookie based on the second token, and jumps to the zero trust gateway based on the URL of the subsequent request, and the client terminal initiates a request based on the updated local cookie.

5. The method according to claim 1, wherein The method further comprises: Receive response data returned by the application server; Filtering the response data to filter out sensitive information in the response data; The filtered response data is sent to the client terminal.

6. The method according to claim 1, wherein The token carried in the URL of the access request is generated by the authentication service after the client terminal passes the authentication.

7. The method according to claim 1, wherein The subsequent request includes a static resource acquisition request for the target application and an interface request for the target application.

8. A token injection access device based on a zero-trust gateway, characterized in that: The device is applied to a zero-trust gateway, and the device includes: A receiving module, configured to receive an access request sent by a client terminal; A judgment module, used to judge whether the URL of the access request carries a token and whether the cookie in the access request carries a token; a determination module, configured to, when the URL of the access request carries a token and the cookie in the access request does not carry a token, determine that the access request is the first page request for the target application and extract the token carried by the URL of the access request; An injection module is used to inject the token carried by the URL of the access request into the set cookie field in the response header, and set the jump domain name to the URL of the access request; A response module is used to construct a response message based on the jump domain name and the response header, and return the response message to the client terminal, so that the client terminal stores the token carried by the response message in a local cookie, and jumps to the zero-trust gateway based on the jump domain name in the response message, and enables the client terminal to carry the local cookie in subsequent requests initiated for the target application.

9. An electronic device, characterized in that: include: processor; as well as A memory configured to store machine-readable instructions, which, when executed by the processor, execute the token injection access method based on the zero-trust gateway as described in any one of claims 1-7.

10. A storage medium, characterized in that: The storage medium stores a computer program, and the computer program is executed by a processor to implement the token injection access method based on the zero-trust gateway as described in any one of claims 1 to 7.

Images