Front-end code release method and device, resource access method and device, equipment and application system

Abstract

The invention discloses a front-end code release method and device, a resource access method and device, equipment and an application system, which are used for solving the problem of how to avoid data leakage of the application system in the prior art. The publishing method comprises the following steps: acquiring a first routing item used for indicating an access path of a first resource; acquiring a first front-end code used for realizing the first routing item; and deploying the first front-end code to an isolation area. And splitting the first front-end code for realizing the first routing item and deploying the first front-end code in an isolation area. Since the first front-end code is only the implementation code for realizing resource access of the extranet client, only the front-end code required by own resource access can be acquired from the extranet client, the leakage of data which can be acquired by only an intranet client user is avoided, and the security of application system data is improved. For an interface calling request sent by a client, a request source identifier is added, and the access authority of the client is limited based on the identifier, so that the data security is further improved.

Description

Technical Field

[0001] The present application relates to the field of software development, and in particular to a front-end code publishing, resource access method, device, equipment and application system. Background Art

[0002] An application system refers to a software system that can meet specific business and user needs. It completes pre-defined tasks by interacting with hardware devices.

[0003] The front-end code of an application system refers to the code running on the user's device (such as the application system client), which is used to create or render the display page of the application system front end and realize user interaction.

[0004] In the prior art, for the same application system that supports access by both intranet clients and extranet clients, the two types of clients use the same set of front-end codes - that is, the same set of front-end codes includes both implementation codes for rendering and presenting the display pages of the extranet clients and implementation codes for rendering and presenting the display pages of the intranet clients.

[0005] In order to improve the loading efficiency of the front-end display page of the application system, the front-end code is usually stored in the client cache, but this makes it easy to obtain the front-end code: for example, the front-end code can be easily obtained from the client cache.

[0006] Under the premise that the front-end code is easily accessible, once a high-level authority is obtained through certain illegal means such as attacks or eavesdropping (for example, the user name and login password of the intranet client user are obtained), the display page of the intranet client can be displayed by running the front-end code on the external client; further, the external client can obtain the routing item information contained in the front-end code, and access the resource at the URL corresponding to the page component according to the correspondence between the page component (such as a button) and the URL (Uniform Resource Locator) specified in the routing item information, resulting in the leakage of important / sensitive data in the resource that only the intranet client user has the right to know. Summary of the invention

[0007] The embodiments of the present application provide a front-end code publishing, resource access method, device, equipment and application system to solve the problem of how to avoid application system data leakage existing in the prior art.

[0008] The present application embodiment adopts the following technical solutions:

[0009] A front-end code publishing method, comprising:

[0010] Acquire a first routing item for indicating an access path of a first resource; the first resource is a resource in the application system that can be opened to external network clients for access;

[0011] Acquire a first front-end code for implementing the first routing item;

[0012] The first front-end code is deployed to the isolation area so that the external network client obtains the first front-end code from the isolation area; the isolation area is a network area located between the internal network and the external network; the internal network is the local area network where the server and back-end database of the application system are located; the external network is other networks except the local area network.

[0013] A resource access method based on the above front-end code publishing method, the resource access method comprising:

[0014] Send a resource access request to the application system, wherein the resource access request includes an interface call request and a static resource request; and cause the application system to execute:

[0015] Add a request source identifier to the interface resource request, and forward the interface call request with the request source identifier added to the gateway device; forward the static resource request to the front-end server; wherein the interface call request includes target interface information of the request call; the gateway device obtains the request source identifier from the interface call request with the request source identifier added; generates an authentication request including the request source identifier; sends the authentication request and the interface call request received by the gateway device to the user center device; the user center device determines whether the client has the authority to call the target interface based on the information of the target interface included in the interface call request sent by the gateway device and the request source identifier included in the authentication request sent by the gateway device; if the judgment result is no, the client is denied from calling the target interface;

[0016] Display the return result of the resource access request.

[0017] An application system includes a reverse proxy server, a gateway device, and a user center device:

[0018] The reverse proxy server is used to receive the interface call request and the static resource request sent by the client of the application system; add the request source identifier to the interface call request, and forward the interface call request with the request source identifier added to the gateway device; forward the static resource request to the front-end server; wherein the interface call request contains the information of the target interface of the request call;

[0019] The gateway device is used to obtain a request source identifier from an interface call request to which a request source identifier is added; generate an authentication request including the request source identifier; and send the authentication request and the interface call request received by the gateway device to a user center device;

[0020] The user center device is used to determine whether the client has the authority to call the target interface based on the information of the target interface contained in the interface call request sent by the gateway device and the request source identifier contained in the authentication request sent by the gateway device; if the judgment result is no, the client is denied from calling the target interface.

[0021] A front-end code publishing device, comprising:

[0022] A first routing item information acquisition unit is used to acquire a first routing item for indicating an access path to a first resource; the first resource is a resource in the application system that can be opened to an external network client for access;

[0023] A first front-end code acquisition unit, used to acquire a first front-end code for implementing the first routing item;

[0024] A deployment unit is used to deploy the first front-end code to the isolation area so that the external network client obtains the first front-end code from the isolation area; the isolation area is a network area located between the internal network and the external network; the internal network is the local area network where the server and back-end database of the application system are located; the external network is a network other than the local area network.

[0025] A resource access device based on the above front-end code publishing method comprises:

[0026] The request sending unit is used to send an interface call request and a static resource request to the application system, so that the application system executes:

[0027] Add a request source identifier to the interface resource request, and forward the interface call request with the request source identifier added to the gateway device; forward the static resource request to the front-end server; wherein the interface call request includes target interface information of the request call; the gateway device obtains the request source identifier from the interface call request with the request source identifier added; generates an authentication request including the request source identifier; sends the authentication request and the interface call request received by the gateway device to the user center device; the user center device determines whether the client has the authority to call the target interface based on the information of the target interface included in the interface call request sent by the gateway device and the request source identifier included in the authentication request sent by the gateway device; if the judgment result is no, the client is denied from calling the target interface;

[0028] The result display unit is used to display the return results of the call request and the static resource request.

[0029] A computing device, comprising: a memory and a processor, wherein:

[0030] The memory is used to store computer programs;

[0031] The processor is coupled to the memory and is used to execute the computer program stored in the memory to perform the above method.

[0032] A computer-readable storage medium storing a computer program, wherein the computer program can implement the above method when executed by a computer.

[0033] A computer program product comprises a computer program, and the computer program implements the above method when executed by a processor.

[0034] At least one of the above technical solutions adopted in the embodiments of the present application can achieve the following beneficial effects:

[0035] This application separates the first front-end code that implements the first routing item and deploys the first front-end code in an isolated area. Since the first routing item corresponds to the access path for the external network client to access resources, the first front-end code is only the implementation code for implementing the external network client resource access. Therefore, the external network client can only obtain the front-end code required for its own resource access, avoiding the leakage of data that can only be known by the internal network client user, and improving the security of the application system data. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0037] Figure 1 A specific implementation flow chart of a front-end code publishing method provided in an embodiment of the present application;

[0038] Figure 2 A schematic diagram of the structure of the front-end code deployment framework provided in the embodiment of the present application;

[0039] Figure 3 A specific implementation flow chart of a resource access method provided in an embodiment of the present application;

[0040] Figure 4 A schematic diagram of the structure of an application system provided in an embodiment of the present application;

[0041] Figure 5A specific schematic diagram of a front-end code publishing device provided in an embodiment of the present application;

[0042] Figure 6 A schematic diagram of the specific structure of a resource access device provided in an embodiment of the present application;

[0043] Figure 7 A schematic diagram of the specific structure of a computing device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0044] In order to make the purpose, technical solution and advantages of the present application clearer, the technical solution of the present application will be clearly and completely described below in combination with the specific embodiments of the present application and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present application.

[0045] Those skilled in the art may appreciate that, with the development of technology and the emergence of new scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0046] The terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and need not be used to describe a specific order or sequential order. It should be understood that the terms used in this way can be interchangeable under appropriate circumstances, which is only to describe the distinction mode adopted by the objects of the same attributes when describing in the embodiments of the present application. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, so that the process, method, system, product or equipment comprising a series of units need not be limited to those units, but may include other units that are not clearly listed or inherent to these processes, methods, products or equipment.

[0047] In order to solve the problem of how to avoid application system data leakage existing in the prior art, an embodiment of the present application provides a front-end code publishing method.

[0048] The executor of the method may be any computing device that can implement the method, such as a server, a mobile phone, a personal computer, a smart wearable device, a smart robot, and the like.

[0049] In addition, the execution order of different steps is not limited in the embodiment of the present application. When using the method provided in the embodiment of the present application, the execution order of different steps can be adjusted according to actual needs.

[0050] For ease of description, the method provided in the embodiment of the present application is described in detail below by taking a front-end code publishing device as the execution subject of the method as an example.

[0051] like Figure 1 As shown, it is a specific implementation flow chart of a front-end code publishing method provided in an embodiment of the present application, including the following steps 11 to 13:

[0052] Step 11: Obtain a first routing entry for indicating an access path to a first resource.

[0053] Among them, the first resource is a resource in the application system that can be opened to external network clients for access.

[0054] Routing items are navigation links for pages or components in an application system, defining the access paths to resources that users can access. These access paths include URL paths, as well as page content and components associated with each URL path. The implementation of routing items usually relies on front-end frameworks or libraries, such as Vue.js and React (two front-end JavaScript frameworks), which provide routing management functions, allowing developers to easily manage page navigation in the application system.

[0055] The first routing item defines the access path of resources that the application system can open to external network clients.

[0056] It should be noted that the two types of clients mentioned in this application - "intranet client" and "extranet client" - are determined based on the network environment in which the client is located; specifically: a client installed in an extranet environment is an extranet client, and a client installed in an intranet environment is an intranet client.

[0057] The network environment involved in this application includes an internal network environment and an external network environment. The internal network is the local area network where the server and back-end database of the application system are located; the external network is other networks except the local area network.

[0058] In step 11, a first routing item for indicating an access path to a first resource is obtained, which specifically includes the following steps 111 to 112:

[0059] Step 111, according to different publishing environments, split the full routing item into a first routing item and a second routing item, write them into two routing list sub-files respectively, and provide them for reference by the routing core file index.js.

[0060] The route list sub-file of the first route item is internetRouter.js, and the route list sub-file of the second route item is intranetRouter.js.

[0061] Step 112, the routing core file imports the routing list sub-file corresponding to the environment variable VUE_APP_ENV according to the environment variable.

[0062] The environment variable represents the network environment. For example, when the environment variable represents the external network environment, the route list file internetRouter.js of the first route item is introduced; when the environment variable represents the internal network environment, the route list sub-file intranetRouter.js of the second route item is introduced.

[0063] Step 12: Obtain a first front-end code for implementing the first routing item.

[0064] The front-end code includes HTML (HyperText Markup Language) files that define the page structure and content, CSS (Cascading Style Sheets) files that define the page layout (such as appearance and style), JavaScript files that implement page interactivity and dynamic functions, and routing item information that determines the page response when users visit different URLs, etc.

[0065] The front-end code can implement the specific functions of these routing item information. It includes processing the interaction between users and pages, such as page jump after clicking navigation links, data acquisition and display, etc. The front-end code identifies and processes different routing requests through the routing management module, loads the corresponding page or component according to the definition of the routing item, and updates the user interface to reflect the status of the current page.

[0066] The first front-end code is used to implement a page corresponding to an access path that can be opened to external network clients to access resources.

[0067] In step 12, obtaining a first front-end code for implementing the first routing item includes:

[0068] The code including the first routing item information is obtained as the first front-end code.

[0069] Step 13: deploy the first front-end code to the isolation area so that the external network client obtains the first front-end code from the isolation area.

[0070] The DMZ (demilitarized zone) is also called a demilitarized zone. This area is a buffer zone between a non-safe system and a safe system set up to solve the problem that users accessing the external network cannot access the internal network server after installing a firewall.

[0071] The isolation zone is a network area between the internal network and the external network. Some server facilities that must be made public, such as corporate web servers, can be placed in this area. On the other hand, such an isolation zone can more effectively protect the internal network. Because this network deployment has an additional barrier for attackers from the external network compared to the general firewall solution.

[0072] In order to achieve the smooth release of the first front-end code and facilitate the deployment and maintenance of the application system, the deployment process of the first front-end code also includes packaging processing of the first front-end code.

[0073] Deploying the first front-end code in the isolation area specifically includes the following steps 131 to 134:

[0074] Step 131, determining the type of the target publishing environment for the first front-end code.

[0075] The types of publishing environments include external network environments and internal network environments. The first front-end code is determined based on the external network environment, so the target publishing environment of the first front-end code is the external network environment.

[0076] Step 132: when the type is an external network type, obtain configuration parameters matching the external network type.

[0077] In order to meet the different packaging requirements of front-end codes corresponding to different network environments, and to facilitate the maintenance of webpack (a code packaging tool) configuration parameters for different network environments, packaging configuration files for different network environments are added to the webpackConfig directory to control the webpack configuration parameters in different network environments (such as file size, file name format, number of hash value digits, etc.). For example, add packaging configuration files internet.js (used to control webpack configuration parameters in the external network environment) and intranet.js (used to control webpack configuration parameters in the internal network environment).

[0078] Therefore, when packaging the front-end code, obtain the configuration parameters that match the network environment.

[0079] Step 133: Pack the first front-end code into a front-end code package based on the configuration parameters.

[0080] Based on the webpack configuration parameters, use webpack to package the first front-end code. The webpack packaging process includes the following steps 1 to 3:

[0081] Step 1: During the construction phase, the front-end framework first creates a module object based on the dependencies introduced in the entry file main.js.

[0082] In the webpack packaging process, the entry file main.js is the starting point of packaging. Webpack reads the entry file main.js and identifies specific statements in the entry file (import, require, etc.); after identifying specific statements, it creates a module object for each introduced module. This module object represents the module itself and contains the module's identifier (such as path), content, and other modules it may depend on.

[0083] Step 2: Call Webpack's loader to translate the module into standard JS (JavaScript), and call the JS interpreter to convert the standard JS into an abstract syntax tree object, from which to find the modules that the module depends on.

[0084] Loaders are the system used in Webpack to process non-JavaScript files (such as CSS, images, etc.) and convert them into JavaScript modules.

[0085] After the loader is done, webpack calls the JS interpreter to parse JavaScript into an abstract syntax tree. An abstract syntax tree is a tree-like data structure that represents the grammatical structure of the code, allowing webpack to understand and operate the code.

[0086] Step 3: After all dependent files introduced in main.js have been processed, a package file is generated.

[0087] After all modules in the entry file are processed in step 2, webpack will generate one or more package files (usually called bundles or chunks), that is, the front-end code package.

[0088] Step 134, deploying the front-end code package to the isolation area.

[0089] In order to further strengthen the restriction on external network clients accessing resources, an implementation method of this embodiment includes the following steps 14 to 15:

[0090] Step 14: Obtain a third routing item provided by the backend of the application system.

[0091] The third routing item is used to indicate: after the external network client logs into the application system, the access path of the resources that can be opened to the external network client for access is determined.

[0092] In a specific implementation, the specific information in the third routing item may be different based on different users, that is, the third routing item may be based on the resource access rights set by the user.

[0093] Step 15: When the first routing item and the third routing item are found to be inconsistent, the access of the external network client to the resources of the application system is controlled based on the routing item common to the third routing item and the first routing item.

[0094] When the first routing item and the third routing item are inconsistent, the routing information shared by the two is used to control the access of the external network client user to the resource, which can further strengthen the protection of the resource.

[0095] In order to further enhance the security of the application system opening up resources to the intranet client, a specific implementation method of the embodiment of the present application includes the following steps 16 to 18:

[0096] Step 16: Obtain a second routing entry for indicating an access path to a second resource.

[0097] The second resource is a resource in the application system that can be opened to the intranet client for access. The intranet client refers to the client of the application system installed in the internal network environment.

[0098] The second routing item defines the access path of the resources that the application system can open to the intranet client.

[0099] In step 16, a second routing entry for indicating an access path to a second resource is obtained, referring to the process of steps 111 to 112 above.

[0100] Step 17: Obtain a second front-end code for implementing the second routing item.

[0101] The second front-end code is used to implement the page corresponding to the access path that can be opened to the intranet client to access resources.

[0102] Get the second front-end code for implementing the second routing item, including:

[0103] The code including the second routing item information is obtained as the second front-end code.

[0104] Step 18: deploy the second front-end code to the internal network so that the internal network client obtains the second front-end code from the internal network.

[0105] In order to achieve the smooth release of the second front-end code and facilitate the deployment and maintenance of the application system, the deployment process of the second front-end code also includes packaging of the second front-end code. The specific packaging process can be the same as the process of steps 131 to 134 above, except for the object to be packaged. In this implementation, the method of steps 131 to 134 can be used to package the second front-end code, and the corresponding network publishing environment is the internal network environment.

[0106] At this point, the splitting and separate deployment of the first front-end code and the second front-end code have been completed.

[0107] like Figure 2 As shown, the first front-end code corresponding to the external network client 21 is deployed in the isolation area 22, and the second front-end code corresponding to the internal network client 23 is deployed in the internal network area 24. Therefore, the external network client obtains only the first front-end code determined by the application system for the realization of its own resource access, and the second front-end code determined for the realization of the internal network client access is deployed in the internal network area with multiple security guarantees, which is difficult for the external network client user to obtain through illegal means. This further avoids the leakage of data that the application system only uses for internal network access, and enhances the security of the application system data.

[0108] In this implementation, it is also necessary to obtain a fourth routing item, which is used to indicate: after the intranet client user logs into the application system, the access path of the resource that can be opened to the intranet client user for access.

[0109] When the second route item is compared with the fourth route item and is inconsistent, the data that is not in the fourth route item is removed from the second route item to achieve effective control of route permissions by the backend. The filtered route information is added to the route manager (vue-router) as the front-end route permission whitelist for permission control in subsequent access.

[0110] The above description implements the protection of application system data at the front end of the application system. In order to further protect the data of the application system, the embodiment of the present application further considers the back end of the application system and provides an implementation method for protecting the application system data, which specifically includes:

[0111] A first request forwarder is deployed in the isolation area, and the first request forwarder is used to add a first request source identifier to the request sent by the external network client; and a second request forwarder is deployed in the internal network, and the second request forwarder is used to add a second request source identifier to the request sent by the internal network client.

[0112] Specifically, the first request forwarder and the second request forwarder can be implemented by a reverse proxy server. The first request source identifier is used to identify that the request comes from an external network client, and the first request source identifier can be netflag=internet; correspondingly, the second request source identifier is used to identify that the request comes from an internal network client, and the second request source identifier can be netflag=intranet.

[0113] After adding request source identifiers to requests from different types of clients (actually different network environments), the requests with the added request source identifiers are sent to the application system backend based on the request forwarder (the first request forwarder or the second request forwarder), so that the backend can further authenticate the client request to avoid data leakage.

[0114] In the above embodiment of the present application, the first front-end code for implementing the first routing item is split out, and the first front-end code is deployed in an isolated area. Since the first routing item corresponds to the access path for the external network client to access resources, the first front-end code is only the implementation code for implementing the external network client to access resources. Therefore, only the front-end code for accessing its own resources can be obtained from the external network client, which avoids the leakage of data that can only be known by the internal network client user and improves the security of the application system data.

[0115] On the basis of the above embodiments, in order to further solve the problem of how to avoid application system data leakage existing in the prior art, embodiment 2 of the present application provides a data access method based on the front-end code publishing method.

[0116] The executor of the method is the client of the application system, and the specific implementation can be any computing device that can install the client and implement the method, such as a server, a mobile phone, a personal computer, a smart wearable device, a smart robot, etc.

[0117] In addition, the execution order of different steps is not limited in the embodiment of the present application. When using the method provided in the embodiment of the present application, the execution order of different steps can be adjusted according to actual needs.

[0118] For ease of description, the method provided in the embodiment of the present application is described in detail below by taking a data access device as the execution subject of the method as an example.

[0119] like Figure 3 As shown, it is a schematic diagram of a specific implementation process of a data access method based on a front-end code publishing method provided in an embodiment of the present application, including the following steps 31 to 32:

[0120] Step 31, sending a resource access request to the application system, the resource access request including an interface call request and a static resource request; causing the application system to execute:

[0121] Add a request source identifier to the interface resource request, and forward the interface call request with the request source identifier added to the gateway device; forward the static resource request to the front-end server; wherein the interface call request includes target interface information of the request call; the gateway device obtains the request source identifier from the interface call request with the request source identifier added; generates an authentication request including the request source identifier; sends the authentication request and the interface call request received by the gateway device to the user center device; the user center device determines whether the client has the authority to call the target interface based on the information of the target interface included in the interface call request sent by the gateway device and the request source identifier included in the authentication request sent by the gateway device; if the judgment result is no, the client is denied from calling the target interface.

[0122] An interface call request can be an API (Application Programming Interface) request. When a client needs to interact with resources or functions on a server, it usually sends an HTTP (HyperText Transfer Protocol) request to call the API interface provided by the server; the API request contains the target interface information of the request call, and usually also contains a request header and a request body to provide additional information and data.

[0123] Static resources refer to fixed files stored on the server. The content of these files will not change when requested, and the same copy of the file will be obtained each time it is requested. Static resources mainly include HTML, CSS, JavaScript, images, video files, etc. These resources are pre-stored on the server and will not be dynamically generated based on user requests or interactions. In order to quickly respond to user requests for static resources, static resources are usually stored on the front-end server.

[0124] For access requests to static resources, they are forwarded to the front-end server through the reverse server of the application system. It should be noted that for static resource requests of different client types, they are usually sent to the front-end server of the corresponding network source - that is, static resource requests sent by external network clients are forwarded to the front-end server in the isolation zone; static resource requests sent by internal network clients are forwarded to the front-end server in the internal network zone.

[0125] For interface call requests, the reverse proxy server forwards them to the user API gateway cluster (gateway device) of the intranet application layer. When forwarding interface call requests, add the request source identifier in the request header. For requests from external network clients, add the identifier netflag=internet; for requests from intranet clients, add the identifier netflag=intranet.

[0126] After the user API gateway cluster (gateway device) of the intranet application layer receives the interface call request with the request source identifier added, it takes out the request source identifier in the request header, and when calling the user center for authentication, it passes the request source identifier as a parameter to the user center as an authentication request.

[0127] After receiving the authentication request, the user center determines whether the client has the authority to call the target interface; if the determination result is no, the client is denied from calling the target interface. Specifically, it includes:

[0128] The user center stores API permission data, which contains the allowed network source field. For example, 000000 means that it can be accessed in any network environment, 000001 means that it only supports intranet access, 000010 means that it only supports extranet access, 000100 means that it only supports dedicated line access, and so on.

[0129] The user center determines whether the current interface call request has permission to access the target interface based on the stored API permission data, the source identification parameters in the authentication request, and the target interface information. For example, if the request source identification of the interface call request is netflag=intranet, and the target interface corresponds to the 000000 network segment, then the intranet client user has permission to access the target interface and the authentication is successful; for another example, if the request source identification of the interface call request is netflag=internet, and the target interface corresponds to the 000001 network segment, then the external network client user does not have permission to access the target interface and the authentication fails. If the judgment result is yes, that is, the authentication is successful, the data corresponding to the API interface is returned to the client; if the judgment result is no, that is, the authentication fails, the client is denied from calling the target interface.

[0130] Step 32: Display the return result of the resource access request.

[0131] The return result may include the return result of the static resource request and the return result of the interface call request. The return result of the interface call request may be the data corresponding to the returned API interface or the result of access failure.

[0132] Based on the fact that Example 1 avoids the leakage of data that can only be known to intranet client users and improves the security of application system data, in the above-mentioned embodiment of the present application, the interface call request for intranet data issued by the client is marked with the request source to identify the network source of the request. For requests from different network sources, the target interface to be accessed is identified to further determine whether the current request has the authority to access the corresponding target interface. For requests without access authority, the client's call to the target interface is rejected, which further avoids the leakage of intranet data and enhances the data security of the application system.

[0133] On the basis of the above embodiments, in order to further solve the problem of how to avoid application system data leakage existing in the prior art, embodiment 3 of the present application provides an application system.

[0134] The specific structural diagram of the application system is as follows Figure 4 As shown, it includes a client 41, a reverse proxy server 42, a gateway device 43 and a user center device 44.

[0135] The client 41 implements interaction with the user, is used to send interface call requests and static resource requests, and displays the return results of the requests.

[0136] The reverse proxy server 42 is used to receive interface call requests and static resource requests sent by the client of the application system; add a request source identifier to the interface call request, and forward the interface call request with the request source identifier added to the gateway device; forward the static resource request to the front-end server; wherein the interface call request contains information about the target interface of the request call.

[0137] For access requests to static resources, they are forwarded to the front-end server through the reverse server 42 of the application system. It should be noted that for static resource requests of different client types, they are usually sent to the front-end server of the corresponding network source - that is, static resource requests sent by external network clients are forwarded to the front-end server in the isolation zone; static resource requests sent by internal network clients are forwarded to the front-end server in the internal network zone.

[0138] For the interface call request, the reverse proxy server 42 forwards it to the gateway device. When forwarding the interface call request, the request source identifier is added to the request header. For requests from external network clients, the identifier netflag=internet is added; for requests from internal network clients, the identifier netflag=intranet is added.

[0139] The gateway device 43 is used to obtain the request source identifier from the interface call request with the request source identifier added; generate an authentication request including the request source identifier; and send the authentication request and the interface call request received by the gateway device to the user center device.

[0140] After receiving the interface call request with the request source identifier added, the gateway device 43 takes out the request source identifier in the request header, and when calling the user center for authentication, passes the request source identifier as a parameter to the user center as an authentication request.

[0141] The user center device 44 is used to determine whether the client has the authority to call the target interface based on the information of the target interface contained in the interface call request sent by the gateway device and the request source identifier contained in the authentication request sent by the gateway device; if the judgment result is no, the client is denied from calling the target interface.

[0142] The user center 44 stores API permission data, which includes an allowed network source field. For example, 000000 means that it can be accessed in any network environment, 000001 means that it only supports intranet access, 000010 means that it only supports Internet access, 000100 means that it only supports dedicated line access, and so on.

[0143] The user center 44 determines whether the current interface call request has the permission to access the target interface based on the stored API permission data, the source tag parameter in the authentication request, and the target interface information. For example, if the request source identifier of the interface call request is netflag=intranet, and the target interface corresponds to the 000000 network segment, then the intranet client user has the permission to access the target interface and the authentication is successful; for another example, if the request source identifier of the interface call request is netflag=internet, and the target interface corresponds to the 000001 network segment, then the external network client user does not have the permission to access the target interface and the authentication fails. If the judgment result is yes, that is, the authentication is successful, the data corresponding to the API interface is returned to the client; if the judgment result is no, that is, the authentication fails, the client is denied from calling the target interface.

[0144] Based on the fact that Example 1 avoids the leakage of data that can only be known to intranet client users and improves the security of application system data, the application system provided by the above-mentioned embodiment of the present application marks the request source of the interface call request for intranet data issued by the client to identify the network source of the request, and for requests from different network sources, identifies the target interface to be accessed to further determine whether the current request has the authority to access the corresponding target interface. For requests without access rights, the client's call to the target interface is rejected, further avoiding the leakage of intranet data and enhancing the data security of the application system.

[0145] In order to solve the problem of how to avoid application system data leakage existing in the prior art, based on the same inventive concept as the above-mentioned embodiment 1, embodiment 4 of the present application also provides a front-end code publishing device.

[0146] The front-end code publishing device includes: Figure 5 The following functional units are shown:

[0147] The first routing item information acquisition unit 51 is used to acquire a first routing item for indicating an access path to a first resource; the first resource is a resource in the application system that can be opened to external network clients for access.

[0148] The first front-end code acquisition unit 52 is used to acquire a first front-end code for implementing the first routing item.

[0149] The deployment unit 53 is used to deploy the first front-end code to the isolation area so that the external network client obtains the first front-end code from the isolation area; the isolation area is a network area located between the internal network and the external network; the internal network is the local area network where the server and back-end database of the application system are located; the external network is a network other than the local area network.

[0150] The deployment unit 53 specifically includes a publishing environment type determination subunit, a configuration parameter acquisition subunit, a code packaging subunit and a code deployment subunit.

[0151] in,

[0152] A publishing environment type determination subunit, used to determine the type of the target publishing environment of the first front-end code;

[0153] A configuration parameter acquisition subunit, used for acquiring configuration parameters matching the external network type when the type is an external network type;

[0154] A code packaging subunit, packaging the first front-end code into a front-end code package based on the configuration parameters;

[0155] The code deployment subunit is used to deploy the front-end code package to the isolation area.

[0156] In order to further strengthen the restriction on external network clients' access to resources, the publishing device of this embodiment further includes a third routing item acquisition unit and a resource access control unit.

[0157] in,

[0158] The third routing item acquisition unit is used to acquire the third routing item provided by the backend of the application system.

[0159] A resource access control unit is used to control the access of the external network client to the resources of the application system based on the common routing items in the third routing item and the first routing item when the first routing item and the third routing item are inconsistent.

[0160] In order to further enhance the security of the application system opening up resources to intranet clients, the publishing device of this embodiment further includes a second routing item information acquisition unit and a second front-end code acquisition unit.

[0161] in,

[0162] A second routing item information acquisition unit, used to acquire a second routing item for indicating an access path to a second resource; the second resource is a resource in the application system that can be opened to an intranet client for access;

[0163] A second front-end code acquisition unit, used to acquire a second front-end code for implementing the second routing item;

[0164] And through the deployment unit 53, the second front-end code is deployed to the internal network, so that the intranet client obtains the second front-end code from the internal network.

[0165] In the front-end code publishing device provided in the above embodiment of the present application, the first front-end code that implements the first routing item is split out and deployed in the isolation area. Since the first routing item corresponds to the access path for the external network client to access resources, the first front-end code is only the implementation code for implementing the external network client resource access. Therefore, only the front-end code required for its own resource access can be obtained from the external network client, avoiding the leakage of data that can only be known by the internal network client user, and improving the security of the application system data.

[0166] In order to solve the problem of how to avoid application system data leakage existing in the prior art, based on the same inventive concept as the above-mentioned embodiment 2, embodiment 5 of the present application also provides a resource access device.

[0167] The resource access device includes: Figure 6 The following functional units 61-62 are shown:

[0168] The request sending unit 61 is used to send an interface call request and a static resource request to the application system, so that the application system executes:

[0169] Add a request source identifier to the interface resource request, and forward the interface call request with the request source identifier added to the gateway device; forward the static resource request to the front-end server; wherein the interface call request includes target interface information of the request call; the gateway device obtains the request source identifier from the interface call request with the request source identifier added; generates an authentication request including the request source identifier; sends the authentication request and the interface call request received by the gateway device to the user center device; the user center device determines whether the client has the authority to call the target interface based on the information of the target interface included in the interface call request sent by the gateway device and the request source identifier included in the authentication request sent by the gateway device; if the judgment result is no, the client is denied from calling the target interface;

[0170] The result display unit 62 is used to display the return results of the call request and the static resource request.

[0171] The resource access device provided in the above-mentioned embodiments of the present application, on the basis of Embodiment 1 avoiding the leakage of data that can only be known to the intranet client user and improving the security of the application system data, performs a request source mark on the interface call request for intranet data issued by the client to identify the network source of the request, and for requests from different network sources, identifies the target interface to be accessed to further determine whether the current request has the authority to access the corresponding target interface, and for requests without access authority, denies the client's call to the target interface, further avoiding the leakage of intranet data and enhancing the data security of the application system.

[0172] Based on the same inventive concept as the aforementioned embodiments of the present application, the embodiments of the present application also provide a computing device.

[0173] like Figure 7 As shown, the computing device includes: a memory 71 and a processor 72. The memory 71 can be configured to store various other data to support operations on the electronic device. Examples of these data include instructions for any application or method for operating on the electronic device. The memory 71 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as a static random access memory (SRAM), an electrically erasable programmable read-only memory (EEPROM), an erasable programmable read-only memory (EPROM), a programmable read-only memory (PROM), a read-only memory (ROM), a magnetic memory, a flash memory, a magnetic disk or an optical disk.

[0174] The processor 72 is coupled to the memory 71 and is used to execute the computer program stored in the memory 71, so as to execute a front-end code publishing method described in the aforementioned embodiment 1, or a resource access method based on the front-end code publishing method described in embodiment 2 of the present application.

[0175] When the processor 72 executes the computer program to execute the front-end code publishing method, the first front-end code that implements the first routing item is split out and deployed in the isolation area. Since the first routing item corresponds to the access path for the external network client to access resources, the first front-end code is only the implementation code for implementing the external network client to access resources. Therefore, only the front-end code required for its own resource access can be obtained from the external network client, avoiding the leakage of data that can only be known by the internal network client user, and improving the security of the application system data.

[0176] When the processor 72 executes the computer program to execute the resource access method based on the front-end code publishing method, on the basis of avoiding the leakage of data that only the intranet client user can know and improving the security of the application system data, the interface call request for the intranet data issued by the client is marked with the request source to identify the network source of the request. For requests from different network sources, the target interface to be accessed is identified to further determine whether the current request has the permission to access the corresponding target interface. For requests without access rights, the client's call to the target interface is rejected, further avoiding the leakage of intranet data and enhancing the data security of the application system. .

[0177] When the processor 72 executes the computer program in the memory 71, in addition to the above functions, it can also realize other functions, and the details can be found in the description of the previous embodiments.

[0178] Further, such as Figure 7 As shown, the computing device also includes: a display 74, a communication component 73, a power component 75, an audio component 76 and other components. Figure 7 Only some components are shown schematically, and it does not mean that the computing device only includes Figure 7 Components shown.

[0179] Accordingly, an embodiment of the present application further provides a computer-readable storage medium storing a computer program, and when the computer program is executed by a computer, the methods provided in the above embodiments can be implemented.

[0180] An embodiment of the present application also provides a computer program product, including a computer program, which implements the methods provided in the above embodiments when executed by a processor.

[0181] The computer program product includes a computer program stored on a non-transitory computer-readable storage medium. The computer program includes program instructions. When the program instructions are executed by a processor, the methods provided in the above embodiments are implemented.

[0182] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0183] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0184] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A front-end code publishing method, characterized in that: include: Acquire a first routing entry for specifying an access path to a first resource; The first resource is a resource in the application system that can be opened to external network clients for access; Acquire a first front-end code for implementing the first routing item; The first front-end code is deployed to the isolation area so that the external network client obtains the first front-end code from the isolation area; the isolation area is a network area located between the internal network and the external network; the internal network is the local area network where the server and back-end database of the application system are located; the external network is other networks except the local area network.

2. The method according to claim 1, characterized in that Deploy the first front-end code to the isolation area, including: Determining a type of a target publishing environment for the first front-end code; When the type is an external network type, obtaining configuration parameters matching the external network type; Based on the configuration parameters, packaging the first front-end code into a front-end code package; Deploy the front-end code package to the isolation area.

3. The method according to claim 1, characterized in that The method further comprises: Acquire a second routing item for indicating an access path to a second resource; the second resource is a resource in the application system that can be opened to an intranet client for access; Obtain a second front-end code for implementing the second routing item; The second front-end code is deployed to the internal network so that the internal network client obtains the second front-end code from the internal network.

4. The method according to claim 1, characterized in that The method further comprises: Acquire a third routing item provided by the backend of the application system; the third routing item is used to indicate: after the external network client logs into the application system, the access path of the resource that can be opened to the external network client for access; When the first routing item and the third routing item are found to be inconsistent after comparison, the access of the external network client to the resources of the application system is controlled based on the routing item common to the third routing item and the first routing item.

5. The method according to claim 1, characterized in that The method further comprises: The isolation zone also deploys a first request forwarder; the first request forwarder is used to add a first request source identifier to the request sent by the external network client.

6. A resource access method based on the front-end code publishing method according to claim 1, characterized in that: The resource access method includes: Send a resource access request to the application system, the resource access request including an interface call request and a static resource request; and cause the application system to execute: Add a request source identifier to the interface resource request, and forward the interface call request with the request source identifier added to the gateway device; forward the static resource request to the front-end server; wherein the interface call request includes target interface information of the request call; the gateway device obtains the request source identifier from the interface call request with the request source identifier added; generates an authentication request including the request source identifier; sends the authentication request and the interface call request received by the gateway device to the user center device; the user center device determines whether the client has the authority to call the target interface based on the information of the target interface included in the interface call request sent by the gateway device and the request source identifier included in the authentication request sent by the gateway device; if the judgment result is no, the client is denied from calling the target interface; Display the return result of the resource access request.

7. An application system, characterized in that: Including client, reverse proxy server, gateway device, user center device: Client, used to send interface call requests and static resource requests; A reverse proxy server, used to receive interface call requests and static resource requests sent by the client of the application system; Adding a request source identifier to the interface call request, and forwarding the interface call request with the request source identifier added to the gateway device; forwarding the static resource request to the front-end server; wherein the interface call request includes information about the target interface requested to be called; The gateway device is used to obtain a request source identifier from an interface call request to which a request source identifier is added; generate an authentication request including the request source identifier; and send the authentication request and the interface call request received by the gateway device to a user center device; The user center device is used to determine whether the client has the authority to call the target interface based on the information of the target interface contained in the interface call request sent by the gateway device and the request source identifier contained in the authentication request sent by the gateway device; if the judgment result is no, the client is denied from calling the target interface.

8. A front-end code publishing device, characterized in that: include: A first routing item information acquiring unit, configured to acquire a first routing item for indicating an access path to a first resource; The first resource is a resource in the application system that can be opened to external network clients for access; A first front-end code acquisition unit, used to acquire a first front-end code for implementing the first routing item; A deployment unit, configured to deploy the first front-end code to the isolation area, so that the external network client obtains the first front-end code from the isolation area; The isolation zone is a network area located between the internal network and the external network; the internal network is the local area network where the server and back-end database of the application system are located; and the external network is other networks except the local area network.

9. A resource access device based on the front-end code publishing method according to claim 1, characterized in that: include: A request sending unit, used to send interface call requests and static resource requests to the application system; The application system is caused to execute: Adding a request source identifier to the interface resource request, forwarding the interface call request with the request source identifier added to the gateway device; forwarding the static resource request to the front-end server; The interface call request includes target interface information requested for calling; The gateway device obtains a request source identifier from the interface call request to which the request source identifier is added; generates an authentication request including the request source identifier; sends the authentication request and the interface call request received by the gateway device to the user center device; the user center device determines whether the client has the authority to call the target interface based on the information of the target interface included in the interface call request sent by the gateway device and the request source identifier included in the authentication request sent by the gateway device; If the judgment result is no, then refusing the client to call the target interface; The result display unit is used to display the return results of the call request and the static resource request.

10. A computing device, characterized in that: include: Memory and processor, wherein: The memory is used to store computer programs; The processor is coupled to the memory and is used to execute the computer program stored in the memory to execute the method according to any one of claims 1 to 6.

11. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a computer, it can implement the method described in any one of claims 1 to 6.

12. A computer program product, characterized in that The invention comprises a computer program, which implements the method according to any one of claims 1 to 6 when executed by a processor.

Images