Microservice gateway authentication method and system
By cleaning and adding authentication identifiers to request messages at the microservice gateway layer, the problems of system redundancy and coupling in the microservice architecture are solved, and the maintainability and security of the system are improved.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- HANGZHOU DBAPPSECURITY CO LTD
- Filing Date
- 2023-04-28
- Publication Date
- 2026-05-19
AI Technical Summary
In a microservice architecture, users seeking data beyond business authentication can lead to system redundancy and coupling between systems, making later maintenance difficult.
The request message is obtained through the microservice gateway layer, and the internal authentication identifier is cleaned. The target request is constructed and the internal authentication identifier is added. It is determined whether the target interface supports internal authentication. When the verification is successful, the business logic is executed, avoiding the direct implementation of the called service's functions within the caller service.
This achieves loose coupling between microservices, simplifies the request transmission chain, and improves the maintainability and internal authentication security of the system.
Smart Images
Figure CN116545684B_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of computer application technology, and in particular to microservice gateway authentication methods and systems. Background Technology
[0002] In a microservice architecture, there are usually at least one microservice. Interactions between services are inevitable. For example, a customer service provides an interface for querying email addresses. If this interface is completely open to any user, security issues such as data loss and unauthorized access will occur. Therefore, business authentication is required, that is, querying email addresses based on the user's role and permission scope to prevent unauthorized access.
[0003] The current solution to obtain data beyond user business authentication is to re-implement the callee service's functionality within the caller service to obtain data beyond that required for user business authentication (which is performed based on the user's permission scope for the current request). This solution leads to system redundancy, coupling between systems, and is detrimental to later maintenance.
[0004] There is currently no effective solution to the problems in related technologies, such as system redundancy and coupling between systems caused by users obtaining data other than business authentication, which makes later maintenance difficult. Summary of the Invention
[0005] This embodiment provides a microservice gateway authentication method and system to solve the problems in related technologies where users obtain data other than business authentication, leading to system redundancy, coupling between systems, and difficulties in later maintenance.
[0006] Firstly, this embodiment provides a microservice gateway authentication method, including:
[0007] The gateway layer obtains the first request message from the client and cleans the first request message with internal authentication identifiers to obtain the second request message; based on the second request message, the first microservice application is invoked.
[0008] When the first microservice application calls the second microservice application, a target request is constructed, an internal authentication identifier is added to the third request message of the target request, and the target request is sent to the target interface of the second microservice application.
[0009] Determine whether the target interface supports internal authentication; if the target interface supports internal authentication, perform internal authentication verification on the target request based on the target internal authentication identifier; if the internal authentication verification passes, execute the business logic of the target interface.
[0010] In some embodiments, the step of obtaining the first request message of the client-initiated request through the gateway layer and performing internal authentication identifier cleaning on the first request message includes:
[0011] A global interceptor is constructed at the gateway layer to intercept the first request message;
[0012] The request header of the first request message is cleaned with internal authentication flags.
[0013] In some embodiments, adding a target internal authentication identifier to the third request message of the target request includes:
[0014] Add the randomly generated internal authentication identifier of the target to the request header of the third request message.
[0015] In some embodiments, after adding the target internal authentication identifier to the third request message of the target request, the method further includes:
[0016] The first microservice application stores the target's internal authentication identifier in a message queue.
[0017] In some embodiments, the step of performing internal authentication verification on the target request based on the target's internal authentication identifier includes:
[0018] The target internal authentication identifier is obtained from the third request message. When the target internal authentication identifier exists in the message queue, the internal authentication verification is successful.
[0019] In some embodiments, after invoking the first microservice application according to the second request message, the method further includes:
[0020] When the first microservice application does not call the second microservice application, the business logic of the first microservice application is executed, a response result is obtained, and the response result is returned to the client.
[0021] In some embodiments, determining whether the target interface supports internal authentication includes:
[0022] The internal authentication annotation on the target interface is used to determine whether the target interface supports internal authentication.
[0023] Secondly, this embodiment provides a microservice gateway authentication system, including:
[0024] The cleaning module is used to obtain the first request message of the request initiated by the client through the gateway layer, and to clean the first request message by internal authentication identifier to obtain the second request message; and to call the first microservice application according to the second request message.
[0025] An add module is used to construct a target request when the first microservice application calls the second microservice application, add a target internal authentication identifier to the third request message of the target request, and send the target request to the target interface of the second microservice application.
[0026] The verification module is used to determine whether the target interface supports internal authentication; when the target interface supports internal authentication, it performs internal authentication verification on the target request according to the target internal authentication identifier; and when the internal authentication verification passes, it executes the business logic of the target interface.
[0027] Thirdly, this embodiment provides an electronic device including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the microservice gateway authentication method described in the first aspect above.
[0028] Fourthly, this embodiment provides a storage medium storing a computer program that, when executed by a processor, implements the microservice gateway authentication method described in the first aspect above.
[0029] Compared with related technologies, the service gateway authentication method and system provided in this embodiment obtain a first request message from a client through the gateway layer, and clean the first request message with an internal authentication identifier to obtain a second request message; based on the second request message, a first microservice application is invoked; when the first microservice application invokes the second microservice application, a target request is constructed, a target internal authentication identifier is added to the third request message of the target request, and the target request is sent to the target interface of the second microservice application; it is determined whether the target interface supports internal authentication; when the target interface supports internal authentication, the target request is internally authenticated based on the target internal authentication identifier; when the internal authentication verification is successful, the business logic of the target interface is executed. This solves the problems of system redundancy and difficult maintenance caused by users obtaining data other than business authentication in the prior art, and improves the maintainability of the system while obtaining data other than user business authentication.
[0030] Details of one or more embodiments of this application are set forth in the following drawings and description to make other features, objects and advantages of this application more readily apparent. Attached Figure Description
[0031] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:
[0032] Figure 1 This is a hardware structure block diagram of the terminal of the microservice gateway authentication method in this embodiment;
[0033] Figure 2 This is a flowchart of the microservice gateway authentication method in this embodiment;
[0034] Figure 3 This is a flowchart of the microservice gateway authentication method in this embodiment;
[0035] Figure 4 This is a flowchart of the microservice gateway authentication method of this preferred embodiment;
[0036] Figure 5 This is a structural block diagram of the microservice gateway authentication system in this embodiment.
[0037] In the diagram: 102, Processor; 104, Memory; 106, Transmission Device; 108, Input / Output Device; 10, Cleaning Module; 20, Addition Module; 30, Verification Module. Detailed Implementation
[0038] To better understand the purpose, technical solution, and advantages of this application, the application is described and explained below in conjunction with the accompanying drawings and embodiments.
[0039] Unless otherwise defined, the technical or scientific terms used in this application shall have the general meaning as understood by one of ordinary skill in the art to which this application pertains. Words such as “a,” “an,” “an,” “the,” “the,” and “these,” used in this application, do not indicate quantitative limitation and may be singular or plural. The terms “comprising,” “including,” “having,” and any variations thereof used in this application are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or device that comprises a series of steps or modules (units) is not limited to the listed steps or modules (units) but may include steps or modules (units) not listed, or may include other steps or modules (units) inherent to such processes, methods, products, or devices. The terms “connected,” “linked,” and “coupled,” used in this application, are not limited to physical or mechanical connections but may include electrical connections, whether direct or indirect. The term “multiple” used in this application refers to two or more. The "and / or" operator describes the relationship between related objects, indicating that three relationships can exist. For example, "A and / or B" can represent three cases: A alone, A and B simultaneously, and B alone. Typically, the character " / " indicates that the objects before and after it are in an "or" relationship. The terms "first," "second," and "third," etc., used in this application are merely for distinguishing similar objects and do not represent a specific ordering of the objects.
[0040] The method embodiments provided in this example can be executed on a terminal, computer, or similar computing device. For example, it can run on a terminal. Figure 1 This is a hardware structure block diagram of the terminal for a microservice gateway authentication method according to this embodiment. For example... Figure 1 As shown, a terminal may include one or more ( Figure 1 Only one is shown in the diagram. A processor 102 and a memory 104 for storing data are also included. The processor 102 may be, but is not limited to, a microprocessor (MCU) or a programmable logic device (FPGA). The terminal may also include a transmission device 106 for communication functions and an input / output device 108. Those skilled in the art will understand that… Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the terminal described above. For example, the terminal may also include components that are larger than... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown are illustrated.
[0041] The memory 104 can be used to store computer programs, such as application software programs and modules, like the computer program corresponding to a microservice gateway authentication method in this embodiment. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, thereby implementing the above-described method. The memory 104 may include high-speed random access memory and non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.
[0042] The transmission device 106 is used to receive or send data via a network. This network includes a wireless network provided by the terminal's communication provider. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 can be a Radio Frequency (RF) module used for wireless communication with the Internet.
[0043] This embodiment provides a microservice gateway authentication method. Figure 2 This is a flowchart of the microservice gateway authentication method in this embodiment, as follows: Figure 2 As shown, the process includes the following steps:
[0044] Step S201: Obtain the first request message of the request initiated by the client through the gateway layer, and clean the first request message with internal authentication identifier to obtain the second request message; call the first microservice application according to the second request message.
[0045] Step S202: When the first microservice application calls the second microservice application, a target request is constructed, an internal authentication identifier of the target is added to the third request message of the target request, and the target request is sent to the target interface of the second microservice application.
[0046] Step S203: Determine whether the target interface supports internal authentication; if the target interface supports internal authentication, perform internal authentication verification on the target request based on the target internal authentication identifier; if the internal authentication verification passes, execute the business logic of the target interface.
[0047] Specifically, the gateway layer is used to intercept and process all external traffic through its provided global interceptors, forwarding client requests to different servers or microservices. Developers can construct these global interceptors by implementing existing interfaces or inheriting related interceptor utility classes. The internal authentication identifier mainly reflects the request header of the HTTP request message. Developers can customize the name of the internal authentication identifier field and the corresponding specific value of the internal authentication identifier according to their needs. In this embodiment, when the first microservice application calls the second microservice application, the target request is constructed through a declarative web client. This target request is an internal call between services and does not need to go through the gateway layer. In other embodiments, the target request can also be constructed through HTTP requests, etc. In this embodiment, the internal authentication is supported by determining whether the target interface has an internal authentication annotation. When the target interface has an internal authentication annotation and the annotation is enabled, it means that the target interface supports internal authentication; otherwise, it means that the target interface does not support internal authentication.
[0048] In this embodiment, the gateway layer obtains the first request message of the client's request and cleans the first request message with internal authentication identifiers to prevent external requests from forging internal authentication identifiers to perform unauthorized operations. When the first microservice application calls the second microservice application, a target request is constructed. This target request does not need to go through the gateway layer, simplifying the request transmission link. When the target interface supports internal authentication, the target request is internally authenticated and verified according to the target internal authentication identifier, improving the security of internal authentication.
[0049] Through the above steps, the first request message is cleaned with an internal authentication identifier at the gateway layer to obtain the second request message. The first microservice application is then called based on the second request message. When the first microservice application needs to call the second microservice application, a target request is constructed, and the target internal authentication identifier is added to the third request message. This message is then sent to the target interface of the second microservice application. If the target interface supports internal authentication, the target request is internally authenticated. If the internal authentication verification is successful, the business logic of the target interface is executed, thereby enabling the acquisition of data beyond user business authentication. Compared to the existing technology that implements the functions of the callee service within the caller service, the microservices are loosely coupled, which is beneficial for later system iteration and maintenance. This solves the problem of system redundancy and difficult maintenance caused by users acquiring data beyond business authentication in the existing technology. While acquiring data beyond user business authentication, the maintainability of the system is improved.
[0050] In some embodiments, the gateway layer obtains the first request message of the request initiated by the client and performs internal authentication identifier cleanup on the first request message. Figure 3This is a flowchart of the microservice gateway authentication method in this embodiment, as follows: Figure 3 As shown, it includes the following steps:
[0051] Step S301: Construct a global interceptor at the gateway layer to intercept the first request message;
[0052] Step S302: Clean the internal authentication identifier of the request header of the first request message.
[0053] Specifically, in the gateway layer, a global interceptor is constructed by implementing the Spring Gateway's GlobalFilter interface to intercept the first request message sent by all clients and clean the content corresponding to the internal authentication identifier field in the request header of the first request message. This prevents external clients from forging the internal authentication identifier to perform unauthorized operations, thereby improving the security of microservice gateway authentication.
[0054] In addition to the steps described above, this embodiment also includes the following steps:
[0055] Step S303: After cleaning the internal authentication identifier, a second request message is obtained; based on the second request message, the first microservice application is invoked.
[0056] Step S304: When the first microservice application calls the second microservice application, a target request is constructed, an internal authentication identifier of the target is added to the third request message of the target request, and the target request is sent to the target interface of the second microservice application.
[0057] Step S305: Determine whether the target interface supports internal authentication; if the target interface supports internal authentication, perform internal authentication verification on the target request based on the target internal authentication identifier; if the internal authentication verification passes, execute the business logic of the target interface.
[0058] In some embodiments, adding a target internal authentication identifier to the third request message of the target request includes the following steps:
[0059] Step S401: Add the randomly generated target internal authentication identifier to the request header of the third request message.
[0060] Specifically, in this embodiment, the internal authentication identifier field is named from-source, and the corresponding internal authentication identifier value is a randomly generated 32-bit character used for subsequent internal authentication identifier verification. In addition, the target internal authentication identifier is added to the request header of the request message, separating the business request parameters from the target internal authentication identifier, which is more in line with development specifications.
[0061] In some embodiments, after adding the target internal authentication identifier to the third request message of the target request, the following steps are also included:
[0062] Step S501: The target's internal authentication identifier is stored in the message queue through the first microservice application.
[0063] Specifically, the target internal authentication identifier is stored in a message queue by the first microservice application for subsequent internal authentication verification. In other embodiments, the target internal authentication identifier can also be stored in a cache database. In this embodiment, the target internal authentication identifier is stored by using a message queue middleware. Other microservice applications can obtain the target internal authentication identifier asynchronously, thereby solving the coupling problem between microservice applications and improving the high availability of microservice applications.
[0064] In some embodiments, the target request is internally authenticated and verified based on the target's internal authentication identifier, including the following steps:
[0065] Step S601: Obtain the target internal authentication identifier from the third request message. If the target internal authentication identifier exists in the message queue, the internal authentication verification is successful.
[0066] Specifically, the target interface of the second microservice application obtains the target internal authentication identifier from the request header of the third request message through aspect-oriented programming, and searches for it in the aforementioned message queue. It determines whether the target internal authentication identifier exists in the message queue. If the target internal authentication identifier does not exist, the internal authentication verification fails. If the target internal authentication identifier exists, the internal authentication verification passes, the target interface does not need to perform business authentication, directly executes the business logic, and removes the target internal authentication identifier from the message queue. Through the above-mentioned internal authentication verification method, internal authentication will only pass if the target internal authentication identifier exists in the message queue, ensuring the accuracy of internal authentication.
[0067] In some embodiments, after invoking the first microservice application based on the second request message, the following steps are further included:
[0068] Step S701: When the first microservice application does not call the second microservice application, execute the business logic of the first microservice application, obtain the response result, and return the response result to the client.
[0069] Specifically, when developers are developing a program, they determine whether the first microservice application has called other microservice applications and mark it accordingly. If the first microservice application has not called the second microservice application, the response result is returned after the business logic of the first microservice application is executed without internal authentication. Through the above steps, the determination of whether internal authentication is required is made, ensuring the correctness of program execution.
[0070] In some embodiments, determining whether the target interface supports internal authentication includes the following steps:
[0071] Step S801: Determine whether the target interface supports internal authentication by using the internal authentication annotation on the target interface.
[0072] Specifically, when the corresponding value of the internal authentication annotation on the target interface indicates that it is enabled, the subsequent operations of obtaining the target internal authentication identifier from the request header of the third request message and performing internal authentication verification are performed; when the corresponding value of the internal authentication identifier annotation on the target interface is disabled, internal authentication ends. This annotation-based approach to indicate whether the target interface supports internal authentication allows the corresponding value of the internal authentication annotation to be obtained during program compilation, thereby improving program execution efficiency.
[0073] The present embodiment will now be described and illustrated through preferred embodiments.
[0074] Figure 4 This is a flowchart of the microservice gateway authentication method of this preferred embodiment, as shown below. Figure 4 As shown, the microservice gateway authentication method includes the following steps:
[0075] In step S901, the client request enters the gateway layer. A global interceptor is constructed by implementing the GlobalFilter interface of SpringGateway in the gateway to intercept all external requests.
[0076] Step S902: Clean the request header of the first request message from the client by performing internal authentication flag cleaning to obtain the second request message.
[0077] Step S903: Invoke the first microservice application according to the second request message.
[0078] Step S904: Determine whether the first microservice application calls the second microservice application.
[0079] Step S905: Internal authentication and verification ends when the first microservice application does not call the second microservice application.
[0080] Step S906: When the first microservice application calls the second microservice application, a target request is constructed using OpenFeign. An internal authentication identifier is added to the third request message of the target request, and the target request is sent to the target interface of the second microservice application.
[0081] Step S907: Store the target's internal authentication identifier into the message queue.
[0082] Step S908: The target interface obtains the third request message through aspect-oriented programming.
[0083] Step S909: Determine whether the target interface supports internal authentication.
[0084] Step S910: When the target interface does not support internal authentication, the internal authentication process ends.
[0085] Step S911: When the target interface supports internal authentication, determine whether the target's internal authentication identifier exists in the message queue.
[0086] In step S912, if the target's internal authentication identifier does not exist in the message queue, the internal authentication verification fails and the internal authentication ends.
[0087] In step S913, if the target's internal authentication identifier exists in the message queue, the internal authentication verification is successful, the target interface business logic is executed, the target's internal authentication identifier is removed from the message queue, and finally the response result is returned to the first microservice application.
[0088] Through the above preferred embodiment, a global interceptor is constructed in the gateway layer to obtain the first request message of the client request, and the first request message is cleaned with an internal authentication identifier to obtain a second request message. The first microservice application is then called based on the second request message. The first microservice application constructs a declarative request, adds a target internal authentication identifier to the request, sends the request to the target interface of the second microservice application, and adds the target internal authentication identifier to the message queue. It is determined whether the target interface supports internal authentication. If the target interface supports internal authentication, the target request is internally authenticated based on the target internal authentication identifier and the message queue. When the internal authentication verification is successful, data beyond the user's business authentication is obtained. This solves the problem of system redundancy and difficult maintenance caused by users obtaining data beyond business authentication in the prior art. While obtaining data beyond the user's business authentication, the maintainability of the system is improved.
[0089] It should be noted that the steps shown in the above process or the flowchart in the accompanying figures can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here. For example, steps S805 and S806 are implementation steps corresponding to two scenarios of determining whether the first microservice application calls the second microservice application; therefore, the execution order of steps S805 and S806 can be interchanged. Similarly, the execution order of steps S810 and S811 can also be interchanged.
[0090] This embodiment also provides a microservice gateway authentication system, which is used to implement the above embodiments and preferred embodiments. Details already described will not be repeated. The terms "module," "unit," and "subunit," etc., used below refer to combinations of software and / or hardware that perform a predetermined function. Although the apparatus described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.
[0091] Figure 5 This is a structural block diagram of the microservice gateway authentication system in this embodiment, as shown below. Figure 5 As shown, the device includes a cleaning module 10, an adding module 20, and a verification module 30.
[0092] It should be noted that the above modules can be functional modules or program modules, and can be implemented through software or hardware. For modules implemented through hardware, the above modules can reside in the same processor; or the above modules can be located in different processors in any combination.
[0093] The cleaning module 10 is used to obtain a first request message from a client through the gateway layer, and clean the first request message by internal authentication identifier to obtain a second request message; and call a first microservice application based on the second request message; the adding module 20 is used to construct a target request when the first microservice application calls the second microservice application, add a target internal authentication identifier to the third request message of the target request, and send the target request to the target interface of the second microservice application; the verification module 30 is used to determine whether the target interface supports internal authentication; when the target interface supports internal authentication, perform internal authentication verification on the target request based on the target internal authentication identifier; and execute the business logic of the target interface when the internal authentication verification passes.
[0094] The above system solves the problems of system redundancy and difficulty in later maintenance caused by users obtaining data other than business authentication in the existing technology. While obtaining data other than user business authentication, it improves the maintainability of the system.
[0095] In some embodiments, the cleaning module 10 is further configured to construct a global interceptor at the gateway layer to intercept the first request message; and to perform internal authentication identifier cleaning on the request header of the first request message.
[0096] In some embodiments, the adding module 20 is also configured to add a randomly generated target internal authentication identifier to the request header of the third request message.
[0097] In some embodiments, the addition module 20 is also configured to store the target's internal authentication identifier into a message queue via the first microservice application.
[0098] In some embodiments, the verification module 30 is further configured to execute the business logic of the first microservice application, obtain a response result, and return the response result to the client when the first microservice application does not call the second microservice application.
[0099] In some embodiments, the verification module 30 is also used to add an internal authentication annotation to the target interface to determine whether the target interface supports internal authentication.
[0100] This embodiment also provides an electronic device including a memory and a processor, the memory storing a computer program and the processor being configured to run the computer program to perform the steps in any of the above method embodiments.
[0101] Optionally, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor and the input / output device is connected to the processor.
[0102] Optionally, in this embodiment, the processor can be configured to perform the following steps via a computer program:
[0103] S1 obtains the first request message from the client through the gateway layer, cleans the first request message with internal authentication identifiers, and obtains the second request message; based on the second request message, it calls the first microservice application.
[0104] S2, when the first microservice application calls the second microservice application, constructs a target request, adds the target internal authentication identifier to the third request message of the target request, and sends the target request to the target interface of the second microservice application.
[0105] S3, determine whether the target interface supports internal authentication; if the target interface supports internal authentication, perform internal authentication verification on the target request according to the target internal authentication identifier, and execute the business logic of the target interface when the internal authentication verification is successful.
[0106] It should be noted that the specific examples in this embodiment can refer to the examples described in the above embodiments and optional implementations, and will not be repeated in this embodiment.
[0107] Furthermore, in conjunction with the microservice gateway authentication methods provided in the above embodiments, this embodiment can also provide a storage medium for implementation. This storage medium stores a computer program; when executed by a processor, the computer program implements any of the microservice gateway authentication methods described in the above embodiments.
[0108] It should be understood that the specific embodiments described herein are merely illustrative of the application and not intended to limit it. All other embodiments derived by those skilled in the art based on the embodiments provided in this application without inventive effort are within the scope of protection of this application.
[0109] Obviously, the accompanying drawings are merely some examples or embodiments of this application. Those skilled in the art can apply this application to other similar situations based on these drawings without any creative effort. Furthermore, it is understood that although the work done in this development process may be complex and lengthy, for those skilled in the art, certain design, manufacturing, or production modifications made based on the technical content disclosed in this application are merely conventional technical means and should not be considered as insufficient disclosure of this application.
[0110] The term "embodiment" in this application refers to a specific feature, structure, or characteristic described in connection with an embodiment that may be included in at least one embodiment of this application. The appearance of this phrase in various places in the specification does not necessarily imply the same embodiment, nor does it imply that it is mutually exclusive with or independent of other embodiments. It will be clearly or implicitly understood by those skilled in the art that the embodiments described in this application may be combined with other embodiments without conflict.
[0111] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of patent protection. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the appended claims.
Claims
1. A microservice gateway authentication method, characterized in that, include: The gateway layer obtains the first request message of the client's request and cleans the first request message with internal authentication identifiers to obtain the second request message. Based on the second request message, the first microservice application is invoked; When the first microservice application calls the second microservice application, a target request is constructed, a target internal authentication identifier is added to the third request message of the target request, and the target request is sent to the target interface of the second microservice application; wherein, the target internal authentication identifier is specifically a randomly generated 32-bit character; Determine whether the target interface supports internal authentication; if the target interface supports internal authentication, perform internal authentication verification on the target request based on the target internal authentication identifier; if the internal authentication verification passes, execute the business logic of the target interface.
2. The microservice gateway authentication method according to claim 1, characterized in that, The step of obtaining the first request message of the client-initiated request through the gateway layer and performing internal authentication identifier cleaning on the first request message includes: A global interceptor is constructed at the gateway layer to intercept the first request message; The request header of the first request message is cleaned with internal authentication flags.
3. The microservice gateway authentication method according to claim 1, characterized in that, Adding a target internal authentication identifier to the third request message of the target request includes: Add the randomly generated internal authentication identifier of the target to the request header of the third request message.
4. The microservice gateway authentication method according to claim 1, characterized in that, After adding the target internal authentication identifier to the third request message of the target request, the method further includes: The first microservice application stores the target's internal authentication identifier in a message queue.
5. The microservice gateway authentication method according to claim 4, characterized in that, The step of performing internal authentication verification on the target request based on the target's internal authentication identifier includes: The target internal authentication identifier is obtained from the third request message. When the target internal authentication identifier exists in the message queue, the internal authentication verification is successful.
6. The microservice gateway authentication method according to claim 1, characterized in that, After invoking the first microservice application according to the second request message, the process further includes: When the first microservice application does not call the second microservice application, the business logic of the first microservice application is executed, a response result is obtained, and the response result is returned to the client.
7. The microservice gateway authentication method according to claim 1, characterized in that, The determination of whether the target interface supports internal authentication includes: The internal authentication annotation on the target interface is used to determine whether the target interface supports internal authentication.
8. A microservice gateway authentication system, characterized in that, include: The cleaning module is used to obtain the first request message of the request initiated by the client through the gateway layer, and to clean the first request message by internal authentication identifier to obtain the second request message. Based on the second request message, the first microservice application is invoked; An add module is used to construct a target request when the first microservice application calls the second microservice application, add a target internal authentication identifier to the third request message of the target request, and send the target request to the target interface of the second microservice application; wherein, the target internal authentication identifier is specifically a randomly generated 32-bit character. The verification module is used to determine whether the target interface supports internal authentication; when the target interface supports internal authentication, it performs internal authentication verification on the target request according to the target internal authentication identifier; and when the internal authentication verification passes, it executes the business logic of the target interface.
9. An electronic device comprising a memory and a processor, characterized in that, The memory stores a computer program, and the processor is configured to run the computer program to perform the microservice gateway authentication method according to any one of claims 1 to 7.
10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the microservice gateway authentication method according to any one of claims 1 to 7.