A cross-domain login method, server and readable storage medium

Abstract

The application provides a cross-domain login method, a server and a readable storage medium, and relates to the technical field of communication. The method comprises the following steps: obtaining a jump request from a first domain name service to a second domain name service, the first domain name service being logged in by a user; in response to the jump request, generating credential information according to a login token and a first device identifier corresponding to the first domain name service, the login token being generated when the user logs in the first domain name service; sending the credential information to the first domain name service, so that the first domain name service sends the credential information to the second domain name service when jumping to the second domain name service; obtaining the credential information from the second domain name service, analyzing the credential information to obtain the first device identifier, and comparing the first device identifier with a second device identifier corresponding to the second domain name service; if the two are consistent, sending the login token and user identity information of the user to the second domain name service, so as to realize the login of the user to the second domain name service.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to a cross-domain login method, a server, and a readable storage medium. Background Technology

[0002] Currently, when users access different domain services, due to the browser's same-origin restriction, different domain services cannot set cookie information across domains, resulting in multiple login operations for different domain services.

[0003] To address this issue, related technologies employ a method where, when domain A redirects to domain B (a different domain), the login token or user information is sent to the server for verification via query parameters in the URL (Uniform Resource Locator). Upon successful verification, the user information is returned, allowing domain B to obtain the user's identity and thus log in.

[0004] However, in this method, the login token is exposed in plaintext. When a user forwards the link or the link is accessed by a web crawler, the login token is easily leaked and cracked, posing a great security risk. Summary of the Invention

[0005] In view of this, this application provides a cross-domain login method, server, and readable storage medium, which solves the problem of low security of cross-domain login in related technologies.

[0006] In a first aspect, embodiments of this application provide a cross-domain login method applied to a server, the method comprising:

[0007] Obtain the redirection request from the first domain name service to the second domain name service, where the first domain name service indicates that the user is already logged in;

[0008] In response to the redirection request, credential information is generated based on the login token and the first device identifier corresponding to the first domain name service, wherein the login token is generated when the user logs in to the first domain name service;

[0009] The credentials information is sent to the first domain name service so that the first domain name service can send the credentials information to the second domain name service when redirecting to the second domain name service;

[0010] Obtain credential information from the second domain name service, parse the credential information to obtain the first device identifier, and compare the first device identifier with the second device identifier corresponding to the second domain name service;

[0011] If the first device identifier matches the second device identifier, the login token and the user's identity information will be sent to the second domain name service to enable the user to log in to the second domain name service.

[0012] The method described in the embodiments of this application may also have the following additional technical features:

[0013] Optionally, in the above technical solution, before obtaining the redirection request from the first domain name service to the second domain name service, the method further includes: obtaining a login request from the first domain name service, the login request carrying the user's identity information; in response to the login request, generating a login token based on the user's identity information; and sending the login token to the first domain name service to enable the user to log in to the first domain name service.

[0014] In any of the above technical solutions, optionally, parsing the credential information to obtain the first device identifier includes: parsing the credential information according to the user identity information and the business type of the first domain name service to obtain the first device identifier.

[0015] Optionally, in any of the above technical solutions, the method further includes: determining the business type of the first domain name service and / or determining the business type of the second domain name service.

[0016] Optionally, in any of the above technical solutions, the method further includes: obtaining the first device identifier corresponding to the first domain name service and the second device identifier corresponding to the second domain name service through a preset interface.

[0017] In any of the above technical solutions, optionally, the server includes a middleware module and a processing module; wherein, the middleware module is used to obtain a redirection request, and in response to the redirection request, send a login token and a first device identifier corresponding to the first domain name service to the processing module; the processing module is used to generate credential information based on the login token and the first device identifier; the middleware module is also used to send the credential information to the first domain name service, and obtain credential information from the second domain name service, and send the credential information and the second device identifier of the second domain name service to the processing module; the processing module is also used to parse the credential information to obtain the first device identifier, and compare the first device identifier with the second device identifier corresponding to the second domain name service, and if the first device identifier and the second device identifier are consistent, send the login token and the user's user identity information to the middleware module; the middleware module is also used to send the login token and the user's user identity information to the second domain name service to realize the user's login to the second domain name service.

[0018] In any of the above technical solutions, optionally, the middleware module is further configured to obtain a login request from the first domain name service, the login request carrying the user's identity information, and in response to the login request, send the user's identity information to the processing module; the processing module is further configured to generate a login token based on the user's identity information; the middleware module is further configured to send the login token to the first domain name service to enable the user to log in to the first domain name service.

[0019] In any of the above technical solutions, optionally, the first device identifier and / or the second device identifier are generated based on device information, which includes at least one of the following: client name, client model, client screen parameters, client operating system type, and client operating system version.

[0020] Secondly, embodiments of this application provide a server, which includes a middleware module and a processing module;

[0021] The middleware module is used to obtain the redirection request from the first domain name service to the second domain name service, and in response to the redirection request, send the login token and the first device identifier corresponding to the first domain name service to the processing module. The first domain name service is where the user is already logged in, and the login token is generated when the user logs in to the first domain name service.

[0022] The processing module is used to generate credential information based on the login token and the first device identifier;

[0023] The middleware module is also used to send credential information to the first domain name service so that the first domain name service can send credential information to the second domain name service when redirecting to the second domain name service, and to obtain credential information from the second domain name service, and send the credential information and the second device identifier of the second domain name service to the processing module;

[0024] The processing module is also used to parse the credential information to obtain the first device identifier, and compare the first device identifier with the second device identifier. If the first device identifier and the second device identifier are consistent, the login token and the user's user identity information are sent to the middle platform module.

[0025] The middleware module is also used to send the login token and the user's identity information to the second domain name service to enable the user to log in to the second domain name service.

[0026] Thirdly, embodiments of this application provide a readable storage medium on which a program or instructions are stored, which, when executed by a processor, implement the steps of the method as described in the first aspect.

[0027] In this embodiment, on the one hand, users can access services across domains without logging in, meaning they can seamlessly access services without needing to log in twice, thus reducing login operations. On the other hand, by encrypting the login token using the user's client's device identifier, even if the access link is shared or intercepted by other clients, because the device identifiers of other clients are different from the user's client, other clients cannot decrypt the login token encrypted with the user's client's device identifier, reducing the risk of login token leakage and cracking, and improving security. Furthermore, by comparing the first device identifier corresponding to the first domain name service with the second device identifier corresponding to the second domain name service, it can be determined whether the second domain name service and the first domain name service are logged in by the same client, thereby further improving login security.

[0028] The above description is only an overview of the technical solution of this application. In order to better understand the technical means of this application and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of this application more obvious and understandable, the following are specific embodiments of this application. Attached Figure Description

[0029] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0030] Figure 1 One of the flowcharts illustrating a cross-domain login method according to an embodiment of this application is shown;

[0031] Figure 2 An interactive schematic diagram of an embodiment of this application is shown;

[0032] Figure 3 A structural block diagram of the server according to an embodiment of this application is shown;

[0033] Figure 4 A schematic diagram of the cross-domain login system according to an embodiment of this application is shown. Detailed Implementation

[0034] The technical solutions of the embodiments of this application will be clearly described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application are within the scope of protection of this application.

[0035] The terms "first," "second," etc., used in the specification and claims of this application are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such use of data can be interchanged where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first," "second," etc., are generally of the same class and the number of objects is not limited; for example, a first object can be one or more. Furthermore, in the specification and claims, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0036] The cross-domain login method, server, and readable storage medium provided in this application will be described in detail below with reference to the accompanying drawings and through specific embodiments and application scenarios.

[0037] This application provides a cross-domain login method applied to a server. The server and client communicate with each other. The client has a first domain name service and a second domain name service. The business types of the first domain name service and the second domain name service include insurance services, real estate services, car services, course services, payment services, etc.

[0038] It should be noted that the first domain name service and the second domain name service can be different services within the same company. For example, the first domain name service is the insurance service of Company A, and the second domain name service is the real estate service of Company A. The first domain name service and the second domain name service can also be services between different companies. For example, the first domain name service is the browser of Company B, and the second domain name service is the shopping website of Company C.

[0039] like Figure 1 As shown, the method includes:

[0040] Step 101: Obtain the redirection request from the first domain name service to the second domain name service, where the first domain name service indicates that the user is already logged in;

[0041] Step 102: In response to the redirection request, generate credential information based on the login token and the first device identifier corresponding to the first domain name service, wherein the login token is generated when the user logs in to the first domain name service;

[0042] Step 103: Send the credential information to the first domain name service so that the first domain name service can send the credential information to the second domain name service when redirecting to the second domain name service;

[0043] Step 104: Obtain credential information from the second domain name service, parse the credential information to obtain the first device identifier, and compare the first device identifier with the second device identifier corresponding to the second domain name service;

[0044] Step 105: If the first device identifier matches the second device identifier, the login token and the user's identity information are sent to the second domain name service to enable the user to log in to the second domain name service.

[0045] In this embodiment, the client has already logged into the first domain service by requesting the server. After logging into the first domain service, if there is a need to redirect from the first domain service to the second domain service, the client sends a redirection request to the server.

[0046] After receiving a redirect request from the first domain name service to the second domain name service, the server obtains the first device identifier corresponding to the first domain name service. Based on the login token generated when the user logs into the first domain name service and the first device identifier corresponding to the first domain name service, the server generates temporary credential information. In other words, the login token is encrypted using the first device identifier corresponding to the first domain name service, and then the credential information is sent to the first domain name service.

[0047] It should be noted that the generated voucher information is a temporary voucher, which has an expiration time and will become invalid after a preset period, thereby improving security.

[0048] On the client side, when the first domain name service redirects to the second domain name service, the second domain name service obtains the credential information from the first domain name service and sends it to the server. Upon receiving the credential information, the server parses and decrypts it to obtain the first device identifier. It then obtains the second device identifier corresponding to the second domain name service and compares it with the decrypted first device identifier. If they match, it indicates that the same client is logging into both the first and second domain name services. The server then sends the login token and the user's identity information to the second domain name service to enable automatic login on the second domain name service.

[0049] It should be noted that the aforementioned device identifier (first device identifier or second device identifier) ​​is the client's identity identifier. The device identifier is generated through device information. Each client has its own device information, which includes, but is not limited to, client name, client model, client screen parameters, client operating system type, and client operating system version.

[0050] In this embodiment, on the one hand, users can access services across domains without logging in, meaning they can seamlessly access services without needing to log in twice, thus reducing login operations. On the other hand, by encrypting the login token using the user client's device identifier, even if the access link is shared or intercepted by other clients, because the device identifiers of other clients are different from those of the user client, other clients cannot decrypt the login token encrypted with the user client's device identifier, reducing the risk of login token leakage and cracking, and improving security. Furthermore, by comparing the first device identifier corresponding to the first domain service with the second device identifier corresponding to the second domain service, it can be determined whether the second domain service and the first domain service are logged in by the same client, thereby further improving login security.

[0051] In one embodiment of this application, before obtaining the redirection request from the first domain name service to the second domain name service, the method further includes: obtaining a login request from the first domain name service, the login request carrying the user's user identity information; in response to the login request, generating a login token based on the user identity information; and sending the login token to the first domain name service to enable the user to log in to the first domain name service.

[0052] In this embodiment, before the first domain name service redirects to the second domain name service, the first domain name service must enable user login. Specifically, the server receives a login request from the first domain name service, which carries the user's identity information, generates a login token based on the user's identity information, and sends the login token to the first domain name service to enable the user to log in to the first domain name service.

[0053] By using the above method, a login request is made to log in to the first domain name service, and the user identity information obtained from the login and the generated login token are stored, thus providing a basis for subsequent automatic login to the second domain name service.

[0054] In one embodiment of this application, parsing credential information to obtain a first device identifier includes: parsing the credential information according to the user's identity information and the service type of the first domain name service to obtain the first device identifier.

[0055] In this embodiment, after receiving the credential information sent by the second domain name service, the credential information is decrypted. Specifically, based on the business type of the first domain name service, if it is determined that the service of that business type allows redirection to other domain name services, then the credential information is decrypted based on the user's identity information. For example, if the business type of the first domain name service is a payment service, to ensure the security of its payment information, redirection from the first domain name service to other domain name services is not allowed; however, if the business type of the first domain name service is an automotive service, redirection from the first domain name service to other domain name services is allowed.

[0056] The above methods further ensure the security of the redirect login.

[0057] In one embodiment of this application, the method further includes: determining the business type of the first domain name service and / or determining the business type of the second domain name service.

[0058] In this embodiment, the server distributes service types to each domain name service, giving each domain name service a clear service type, thereby providing a basis for its login verification.

[0059] In one embodiment of this application, the method further includes: obtaining a first device identifier corresponding to a first domain name service and a second device identifier corresponding to a second domain name service through a preset interface.

[0060] In this embodiment, the server enables the invocation of pre-encapsulated device identifiers by setting a preset interface, namely API (Application Programming Interface).

[0061] When credential information needs to be generated, the first device identifier is obtained through a preset interface. This first device identifier is then used to encrypt the login token, generating temporary credential information. Compared to solutions that only use the login token to generate a single temporary credential to prevent the login token from being directly exposed, this method increases the encryption complexity of the login token, reduces the probability of the login token being cracked and user information being leaked, and improves security.

[0062] In one embodiment of this application, the server includes a middleware module and a processing module. The middleware module is used to obtain a redirection request and, in response to the redirection request, send a login token and a first device identifier corresponding to a first domain name service to the processing module. The processing module is used to generate credential information based on the login token and the first device identifier. The middleware module is also used to send the credential information to the first domain name service and obtain credential information from a second domain name service, and send the credential information and the second device identifier of the second domain name service to the processing module. The processing module is also used to parse the credential information to obtain the first device identifier and compare the first device identifier with the second device identifier corresponding to the second domain name service. If the first device identifier matches the second device identifier, the login token and the user's identity information are sent to the middleware module. The middleware module is also used to send the login token and the user's identity information to the second domain name service to enable the user to log in to the second domain name service.

[0063] In one embodiment, the middleware module is further configured to obtain a login request from the first domain name service, the login request carrying the user's identity information, and in response to the login request, send the user's identity information to the processing module; the processing module is further configured to generate a login token based on the user's identity information; the middleware module is further configured to send the login token to the first domain name service to enable the user to log in to the first domain name service.

[0064] In one embodiment, the processing module is further configured to parse the credential information based on the user identity information and the business type of the first domain name service to obtain the first device identifier.

[0065] In one embodiment, the processing module is further configured to determine the business type of the first domain name service and / or determine the business type of the second domain name service.

[0066] In one embodiment, the middleware module is further configured to obtain the first device identifier corresponding to the first domain name service and the second device identifier corresponding to the second domain name service through a preset interface.

[0067] In this real-time scenario, the server is equipped with a middleware module, which provides SDK (Software Development Kit) capabilities to enable information relay, making information transmission more efficient and domain name service access more convenient and faster.

[0068] Compared to solutions that use multiple servers to perform interface conversion, encryption and decryption to redirect logins between different domain name services, this application embodiment forms a platform-level solution by setting up a middleware module. This makes it convenient for various services within the company to use, has high reusability, and enables unified management, reducing development costs and truly forming a ready-to-use systematic solution.

[0069] In one specific embodiment of this application, Figure 2 An interactive schematic diagram of an embodiment of this application is shown, such as... Figure 2 As shown, the method includes:

[0070] 1001. Domain A service access middleware module provides the SDK capability for requesting login, which transmits the user identity information of the user who is about to log in;

[0071] 1002. The middleware module transmits the user's identity information to the processing module, and the processing module generates a token (i.e., a login token);

[0072] 1003. The processing module returns a token to the middleware module;

[0073] 1004. After obtaining the token, the middleware module sends the token and user identity information to domain A service, which means that the user has successfully logged in to domain A service and realized the first login.

[0074] 1005. The business logic of domain A service triggers a redirect to domain B service;

[0075] 1006. Before the redirect, the domain A service accesses the SDK capability provided by the middleware module to obtain the device identifier, that is, the ability to call the API;

[0076] 1007. The middleware module obtains the device identifier fingerprintA for domain name A by calling the API, and passes the token and fingerprintA to the processing module, which then generates a ticket.

[0077] 1008. The processing module returns the ticket to the middleware module;

[0078] 1009. The middleware module returns the ticket to the domain A service;

[0079] 1010. Redirecting from domain A service to domain B service, carrying the ticket via the URL;

[0080] 1011. Domain B service transmits the ticket to the middleware module;

[0081] 1012. The middleware module passes the ticket and fingerprintB to the processing module;

[0082] 1013. The processing module parses the ticket, extracts fingerprintA, and compares it with fingerprintB. If they match, it returns the token to the middleware module.

[0083] 1014. The middleware module sends the token and user identity information to domain B service;

[0084] 1015. Domain B service accesses services, and Domain B service stores user identity information, tokens, etc., by setting cookies.

[0085] This application's embodiments enable users to seamlessly access different domain services within a company, avoiding secondary logins and improving user experience. Simultaneously, enabling login-free access through services under different domains improves business conversion rates, demonstrating how technology empowers business operations.

[0086] Furthermore, security risks were addressed through device identification and comparison, and the reuse of service login processing was achieved through the middleware platform, thus resolving the issue of inconsistent management.

[0087] This application also provides a server, such as... Figure 3 As shown, server 300 includes a middleware module 301 and a processing module 302.

[0088] The middleware module 301 is used to obtain the redirection request from the first domain name service to the second domain name service, and in response to the redirection request, send the login token and the first device identifier corresponding to the first domain name service to the processing module 302. The first domain name service is where the user is already logged in, and the login token is generated when the user logs in to the first domain name service.

[0089] Processing module 302 is used to generate credential information based on the login token and the first device identifier;

[0090] The middleware module 301 is also used to send credential information to the first domain name service so that the first domain name service can send credential information to the second domain name service when it redirects to the second domain name service, and to obtain credential information from the second domain name service, and send the credential information and the second device identifier of the second domain name service to the processing module 302.

[0091] The processing module 302 is also used to parse the credential information to obtain the first device identifier, and compare the first device identifier with the second device identifier. If the first device identifier and the second device identifier are consistent, the login token and the user's user identity information are sent to the middleware module 301.

[0092] The middleware module 301 is also used to send the login token and the user's identity information to the second domain name service to enable the user to log in to the second domain name service.

[0093] In this embodiment, the client has already logged into the first domain service by requesting the server. After logging into the first domain service, if there is a need to redirect from the first domain service to the second domain service, the client sends a redirection request to the server.

[0094] After receiving a redirect request from the first domain name service to the second domain name service, the server obtains the first device identifier corresponding to the first domain name service. Based on the login token generated when the user logs into the first domain name service and the first device identifier corresponding to the first domain name service, the server generates temporary credential information. In other words, the login token is encrypted using the first device identifier corresponding to the first domain name service, and then the credential information is sent to the first domain name service.

[0095] On the client side, when the first domain name service redirects to the second domain name service, the second domain name service obtains the credential information from the first domain name service and sends it to the server. Upon receiving the credential information, the server parses and decrypts it to obtain the first device identifier. It then obtains the second device identifier corresponding to the second domain name service and compares it with the decrypted first device identifier. If they match, it indicates that the same client is logging into both the first and second domain name services. The server then sends the login token and the user's identity information to the second domain name service to enable automatic login on the second domain name service.

[0096] In this embodiment, on the one hand, users can access services across domains without logging in, meaning they can seamlessly access services without needing to log in twice, thus reducing login operations. On the other hand, by encrypting the login token using the user client's device identifier, even if the access link is shared or intercepted by other clients, because the device identifiers of other clients are different from those of the user client, other clients cannot decrypt the login token encrypted with the user client's device identifier, reducing the risk of login token leakage and cracking, and improving security. Furthermore, by comparing the first device identifier corresponding to the first domain service with the second device identifier corresponding to the second domain service, it can be determined whether the second domain service and the first domain service are logged in by the same client, thereby further improving login security.

[0097] In one embodiment, the middleware module 301 is further configured to obtain a login request from the first domain name service, the login request carrying the user's identity information, and in response to the login request, send the user's identity information to the processing module 302; the processing module 302 is further configured to generate a login token based on the user's identity information; the middleware module 301 is further configured to send the login token to the first domain name service to enable the user to log in to the first domain name service.

[0098] In one embodiment, the processing module 302 is further configured to parse the credential information according to the user identity information and the business type of the first domain name service to obtain the first device identifier.

[0099] In one embodiment, the processing module 302 is further configured to determine the business type of the first domain name service and / or determine the business type of the second domain name service.

[0100] In one embodiment, the middleware module 301 is further configured to obtain the first device identifier corresponding to the first domain name service and the second device identifier corresponding to the second domain name service through a preset interface.

[0101] In one embodiment, the first device identifier and / or the second device identifier are generated based on device information, which includes at least one of the following: client name, client model, client screen parameters, client operating system type, and client operating system version.

[0102] This application also provides a cross-domain login system, such as... Figure 4 As shown, this cross-domain login system includes a client, a middleware module, a processing module, and a storage layer. The client, which is the view layer, provides services for both the first and second domain names and can be implemented using technologies such as Vue and React. The middleware module, which is the intermediate layer, acts as an information relay module and can be implemented using technologies such as Node and JavaScript. The processing module, which is the service layer, is capable of processing information and can be implemented using technologies such as Java and PHP. The storage layer is used for information storage and can be implemented using technologies such as MySQL.

[0103] The specific working logic of the client, middleware module, and processing module is as described in the above embodiments and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0104] This application also provides a readable storage medium storing a program or instructions. When the program or instructions are executed by a processor, they implement the various processes of the above-described cross-domain login method embodiments and achieve the same technical effect. To avoid repetition, they will not be described again here.

[0105] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element. Furthermore, it should be noted that the scope of the methods and apparatuses in the embodiments of this application is not limited to performing functions in the order shown or discussed, but may also include performing functions substantially simultaneously or in the reverse order, depending on the functions involved. For example, the described methods may be performed in a different order than described, and various steps may be added, omitted, or combined. Additionally, features described with reference to certain examples may be combined in other examples.

[0106] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.

Claims

1. A cross-domain login method, characterized in that, Applied to a server, the method includes: Obtain a redirect request from the first domain name service to the second domain name service, wherein the first domain name service is where the user is already logged in; In response to the redirection request, credential information is generated based on the login token and the first device identifier corresponding to the first domain name service, wherein the login token is generated by the user when logging into the first domain name service; The credential information is sent to the first domain name service so that the first domain name service can send the credential information to the second domain name service when redirecting to the second domain name service; Obtain the credential information from the second domain name service, parse the credential information to obtain the first device identifier, and compare the first device identifier with the second device identifier corresponding to the second domain name service; If the first device identifier matches the second device identifier, the login token and the user's identity information are sent to the second domain name service to enable the user to log in to the second domain name service.

2. The method according to claim 1, characterized in that, Before obtaining the redirection request from the first domain name service to the second domain name service, the method further includes: Obtain a login request from the first domain name service, wherein the login request carries the user's user identity information; In response to the login request, the login token is generated based on the user identity information; The login token is sent to the first domain name service to enable the user to log in to the first domain name service.

3. The method according to claim 1, characterized in that, The process of parsing the credential information to obtain the first device identifier includes: The credential information is parsed based on the user identity information and the business type of the first domain name service to obtain the first device identifier.

4. The method according to claim 3, characterized in that, Also includes: Determine the business type of the first domain name service and / or determine the business type of the second domain name service.

5. The method according to claim 1, characterized in that, Also includes: The first device identifier corresponding to the first domain name service and the second device identifier corresponding to the second domain name service are obtained through a preset interface.

6. The method according to claim 2, characterized in that, The server includes a middleware module and a processing module; The middleware module is used to obtain the redirection request and, in response to the redirection request, send the login token and the first device identifier corresponding to the first domain name service to the processing module. The processing module is used to generate credential information based on the login token and the first device identifier; The middleware module is also used to send the credential information to the first domain name service, and to obtain the credential information from the second domain name service, and to send the credential information and the second device identifier of the second domain name service to the processing module; The processing module is further configured to parse the credential information to obtain the first device identifier, and compare the first device identifier with the second device identifier corresponding to the second domain name service. If the first device identifier and the second device identifier are consistent, the login token and the user's user identity information are sent to the middleware module. The middleware module is also used to send the login token and the user's user identity information to the second domain name service, so as to enable the user to log in to the second domain name service.

7. The method according to claim 6, characterized in that, The middleware module is also used to obtain a login request from the first domain name service, the login request carrying the user's identity information, and in response to the login request, to send the user's identity information to the processing module; The processing module is also used to generate the login token based on the user identity information; The middleware module is also used to send the login token to the first domain name service to enable the user to log in to the first domain name service.

8. The method according to any one of claims 1 to 7, characterized in that, The first device identifier and / or the second device identifier are generated based on device information, which includes at least one of the following: client name, client model, client screen parameters, client operating system type, and client operating system version.

9. A server, characterized in that, The server includes a middleware module and a processing module; The middleware module is used to obtain a redirection request from the first domain name service to the second domain name service, and in response to the redirection request, send a login token and a first device identifier corresponding to the first domain name service to the processing module. The first domain name service is where the user is already logged in, and the login token is generated when the user logs in to the first domain name service. The processing module is used to generate credential information based on the login token and the first device identifier; The middleware module is also used to send the credential information to the first domain name service, so that the first domain name service can send the credential information to the second domain name service when redirecting to the second domain name service, and to obtain the credential information from the second domain name service, and send the credential information and the second device identifier of the second domain name service to the processing module; The processing module is also used to parse the credential information to obtain the first device identifier, and compare the first device identifier with the second device identifier. If the first device identifier and the second device identifier are consistent, the login token and the user's user identity information are sent to the middleware module. The middleware module is also used to send the login token and the user's user identity information to the second domain name service, so as to enable the user to log in to the second domain name service.

10. A readable storage medium having a program or instructions stored thereon, characterized in that, When the program or instructions are executed by the processor, they implement the steps of the cross-domain login method as described in any one of claims 1 to 8.

Images