Method and device for controlling interface access authority

Abstract

The invention provides a method and a device for controlling interface access authority, relates to the technical field of interface access, is applied to a back end of a login system, and comprises the following steps: receiving a name and a first authorization code of a target interface sent by a front end of the login system, and generating a second authorization code corresponding to the name of the target interface; sending the second authorization code to the front end; in response to a request of accessing a target interface by a front end, analyzing special parameters in a request header included in the request to obtain a front end account, a third authorization code and a name of an interface corresponding to the third authorization code; determining a fourth authorization code corresponding to the front-end account based on a corresponding relationship between the front-end account and the authorization code stored in the database; generating a fifth authorization code based on the name of the interface corresponding to the third authorization code and the fourth authorization code; and if the fifth authorization code is the same as the third authorization code, sending interface data corresponding to the target interface to the front end. The interface data is prevented from being leaked and tampered, and the security of the interface data is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of interface access, and in particular to a method and device for controlling interface access rights. Background Art

[0002] When the front end needs to obtain data from the back end, it can usually use the OAuth protocol to obtain access rights to the corresponding interface through the authorization code without touching the front end account information, and then access the corresponding data. However, in the process of obtaining the authorization code, it may be intercepted by malicious scripts. After the authorization code is stolen, the data corresponding to the interface will be at risk of being leaked and tampered with. Summary of the invention

[0003] In view of this, an object of the present invention is to provide a method and device for controlling interface access rights.

[0004] In the first aspect, an embodiment of the present invention provides a method for controlling interface access rights, which is applied to the back end of a login system, including: receiving the name of a target interface and a first authorization code sent by the front end of the login system, and generating a second authorization code corresponding to the name of the target interface; sending the second authorization code to the front end; in response to a request from the front end to access the target interface, parsing special parameters in a request header included in the request, and obtaining a front end account, a third authorization code, and the name of the interface corresponding to the third authorization code; determining a fourth authorization code corresponding to the front end account based on the correspondence between the front end account and the authorization code stored in a database; generating a fifth authorization code based on the name of the interface corresponding to the third authorization code and the fourth authorization code; if the fifth authorization code is the same as the third authorization code, sending interface data corresponding to the target interface to the front end.

[0005] In a preferred embodiment of the present invention, the above-mentioned sending of the second authorization code to the front end includes: randomly generating a first verification code based on the second authorization code, and sending the first verification code to the front end; receiving the second verification code sent by the front end, and if the first verification code is the same as the second verification code, sending the second authorization code to the front end.

[0006] In a preferred embodiment of the present invention, the validity period of the authorization code is stored in the database. Before the above-mentioned generation of the second authorization code corresponding to the name of the target interface, the method also includes: determining whether the first authorization code is within the validity period based on the database; after the above-mentioned generation of the second authorization code corresponding to the name, the method also includes: setting the validity period of the second authorization code, and storing the validity period of the second authorization code in association with the front-end account in the database.

[0007] In a preferred embodiment of the present invention, the number of times the authorization code is used is stored in a database. Before the interface data corresponding to the target interface is sent to the front end, the method also includes: limiting the number of times the third authorization code is used based on a Redis lock; before the second authorization code corresponding to the name is generated, the method also includes: determining whether there is any remaining number of times the first authorization code is used based on the database.

[0008] In second aspect, an embodiment of the present invention provides a method for controlling interface access rights, which is applied to the front end of a login system, including: randomly generating a character string in response to the registration of a front-end account, and using the front-end account and the character string as a first authorization code; sending the name of the target interface and the first authorization code to the back end of the login system; receiving the second authorization code sent by the back end, and writing the front-end account, the second authorization code and the name of the target interface as special parameters into the request header; accessing the target interface based on the request header, and receiving interface data corresponding to the target interface sent by the back end.

[0009] In a preferred embodiment of the present invention, after randomly generating a character string in response to the registration of a front-end account and using the front-end account and the character string as the first authorization code, the method further includes: setting a validity period of the first authorization code, and associating the validity period of the first authorization code with the front-end account and storing them in a database.

[0010] In a preferred embodiment of the present invention, after sending the first authorization code and the name of the target interface to the backend, the method further includes: receiving a first verification code sent by the backend, and sending the first verification code to the backend.

[0011] In a preferred embodiment of the present invention, if multiple front ends request to access the same interface within a preset time, the front ends will be responded to in the order of the time when each front end requests to access the interface.

[0012] In a third aspect, an embodiment of the present invention further provides a device for controlling interface access rights, which is applied to the back end of a login system, and includes: a second authorization code generating module, which is used to receive the name of the target interface and the first authorization code sent by the front end of the login system, and generate a second authorization code corresponding to the name of the target interface; a second authorization code sending module, which is used to send the second authorization code to the front end; a special parameter parsing module, which is used to respond to the request of the front end to access the target interface, parse the special parameters in the request header included in the request, and obtain the front end account, a third authorization code and the name of the interface corresponding to the third authorization code; a fourth authorization code determining module, which is used to determine the fourth authorization code corresponding to the front end account based on the correspondence between the front end account and the authorization code stored in a database; a fifth authorization code generating module, which is used to generate a fifth authorization code based on the name of the interface corresponding to the third authorization code and the fourth authorization code; an interface data sending module, which is used to send the interface data corresponding to the target interface to the front end if the fifth authorization code is the same as the third authorization code.

[0013] In a fourth aspect, an embodiment of the present invention further provides a device for controlling interface access rights, which is applied to the front end of a login system, and includes: a first authorization code generating module, which is used to randomly generate a character string in response to the registration of a front-end account, and use the front-end account and the character string as a first authorization code; a sending module, which is used to send the name of the target interface and the first authorization code to the back end of the login system; a second authorization code receiving module, which is used to receive the second authorization code sent by the back end, and write the front-end account, the second authorization code and the name of the target interface as special parameters into the request header; an interface data receiving module, which is used to access the target interface based on the request header, and receive interface data corresponding to the target interface sent by the back end.

[0014] The embodiments of the present invention bring the following beneficial effects:

[0015] An embodiment of the present invention provides a method and device for controlling interface access rights, which obtains a front-end account, a third authorization code, and the name of the interface corresponding to the third authorization code by parsing special parameters in a request for a front-end to access a target interface, and then generates a fifth authorization code based on the name of the interface corresponding to the third authorization code and a fourth authorization code corresponding to the front-end account. When the fifth authorization code is the same as the third authorization code, interface data corresponding to the target interface is sent to the front-end, thereby preventing the interface data from being leaked or tampered with, and improving the security of the interface data.

[0016] Other features and advantages of the present disclosure will be set forth in the following description, or some features and advantages may be inferred or unambiguously determined from the description, or may be learned by implementing the above-mentioned technology of the present disclosure.

[0017] In order to make the above-mentioned objectives, features and advantages of the present disclosure more obvious and easy to understand, preferred embodiments are specifically cited below and described in detail with reference to the attached drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0019] Figure 1 A flowchart of a method for controlling interface access rights applied to a back-end of a login system provided by an embodiment of the present invention;

[0020] Figure 2 A flowchart of a method for controlling interface access rights applied to a front end of a login system provided by an embodiment of the present invention;

[0021] Figure 3 A schematic diagram of the structure of a device for controlling interface access rights at the back end of a login system provided by an embodiment of the present invention;

[0022] Figure 4 A schematic diagram of the structure of a device for controlling access rights of a front-end interface of a login system provided by an embodiment of the present invention;

[0023] Figure 5 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0024] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0025] When the front end needs to obtain data from the back end, it can usually use the authorization of the OAuth protocol to obtain access rights to the corresponding interface through the authorization code without touching the front end account information, and then access the corresponding data. However, in the process of obtaining the authorization code, it may be intercepted by malicious scripts, and there is a risk of the authorization code being stolen. After the authorization code is stolen, the data corresponding to the interface will be at risk of being leaked and tampered with. In addition, when multiple parties obtain the authorization code and access the corresponding interface at the same time, it will cause great pressure on the server.

[0026] Based on this, an embodiment of the present invention provides a method and device for controlling interface access rights. By parsing special parameters in the request for the front-end to access the target interface, the front-end account, a third authorization code, and the name of the interface corresponding to the third authorization code are obtained. Then, a fifth authorization code is generated based on the name of the interface corresponding to the third authorization code and the fourth authorization code corresponding to the front-end account. When the fifth authorization code is the same as the third authorization code, the interface data corresponding to the target interface is sent to the front-end, thereby avoiding leakage and tampering of the interface data and improving the security of the interface data.

[0027] To facilitate understanding of this embodiment, a method for controlling interface access rights disclosed in an embodiment of the present invention is first introduced in detail.

[0028] Example 1

[0029] The embodiment of the present invention provides a method for controlling interface access rights, which is applied to the back end of a login system. Figure 1The flowchart of a method for controlling interface access rights applied to the back end of a login system is shown. The method for controlling interface access rights may include the following steps:

[0030] Step S101, receiving the name of the target interface and the first authorization code sent by the front end of the login system, and generating a second authorization code corresponding to the name of the target interface.

[0031] The name of the target interface is the name of the interface that the front end needs to access, and the first authorization code is a combination of the front end account and a random string generated when the front end account is successfully registered. The front end account is the account generated when registering and logging into the system.

[0032] Among them, after receiving the name of the target interface and the first authorization code sent by the front end of the login system, the database will be searched to see whether the front end account in the first authorization code exists, and the character string corresponding to the front end account will be checked whether it is correct. If the front end account in the first authorization code exists in the database and the character string corresponding to the front end account is correct, a second authorization code corresponding to the name of the target interface will be generated.

[0033] Specifically, a secure random number generator SecureRandom may be used to generate a 20-digit English plus numeric random number as a character string, such as "6086481862b419a7325ae5d95cae26ab19397e60".

[0034] When a character string is randomly generated, an expiration date is set for the character string. After the expiration date, a character string is randomly generated again.

[0035] The second authorization code is a combination of the first authorization code and the name of the target interface. After the second authorization code is generated, the MD5 (Message-Digest 5) algorithm is used to encrypt the second authorization code.

[0036] Step S102: Send the second authorization code to the front end.

[0037] Specifically, sending the second authorization code to the front end may include: randomly generating a first verification code based on the second authorization code, and sending the first verification code to the front end; receiving the second verification code sent by the front end, and if the first verification code is the same as the second verification code, sending the second authorization code to the front end.

[0038] Among them, the validity period can be set for the first verification code. If the first verification code has not been used after the validity period has expired, the front end needs to apply for the first verification code from the front end again.

[0039] Among them, the second verification code sent by the front end can be the same as the first verification code, or it can be different from the second verification code. When the second verification code sent by the front end is different from the first verification code, it is considered that the front end verification has failed and has no authority to access the target interface. At this time, the back end will not send the second authorization code to the front end.

[0040] The second authorization code can be sent to the front end through a communication method such as text message, email, or phone call. Specifically, the front end can be operated by the user, and the user's email address, phone number, and other information can be pre-entered in the front end to send the second authorization code to the user's email address, call the user, send text messages, etc. When other users also want to access the target interface, they can apply for the second authorization code from the user, and after the user agrees, the second authorization code can be sent to the other user for the other user to access the target interface.

[0041] Step S103, in response to the request of the front end to access the target interface, parse the special parameters in the request header included in the request to obtain the front end account, the third authorization code and the name of the interface corresponding to the third authorization code.

[0042] Among them, special parameters can be the account number, authorization code and interface name written into the request header by the front end.

[0043] The third authorization code may be the same as the second authorization code or may be different from the second authorization code. When the third authorization code is different from the second authorization code, it is considered that the front end does not have the authority to access the target interface.

[0044] Step S104: determining a fourth authorization code corresponding to the front-end account based on the correspondence between the front-end account and the authorization code stored in the database.

[0045] Among them, the fourth authorization code corresponding to the front-end account can be found through the database. The fourth authorization code can be the first authorization code. When the fourth authorization code is the first authorization code, it can be considered that the front end requesting access to the target interface is the same front end as the aforementioned front end. When the fourth authorization code is not the first authorization code, it can be considered that the front end requesting access to the target interface is other front ends different from the aforementioned front ends.

[0046] Step S105: Generate a fifth authorization code based on the name of the interface corresponding to the third authorization code and the fourth authorization code.

[0047] Since the MD5 algorithm is a one-way encryption algorithm and cannot be decrypted, in order to verify the correctness of the third authorization code, it is necessary to use the name of the interface corresponding to the third authorization code and the fourth authorization code to generate the fifth authorization code.

[0048] The fifth authorization code is a combination of the name of the interface corresponding to the third authorization code and the fourth authorization code.

[0049] The fifth authorization code may be the second authorization code, and in this case it can be considered that the front end accesses the target interface.

[0050] Step S106: If the fifth authorization code is the same as the third authorization code, the interface data corresponding to the target interface is sent to the front end.

[0051] Among them, when the fifth authorization code is the same as the third authorization code, it is considered that the front end has passed the verification. Since the third authorization code can be the second authorization code, the fifth authorization code can also be the second authorization code. At this time, it can be considered that the front end is accessing the target interface. When the third authorization code is not the second authorization code, the fifth authorization code is not the second authorization code. At this time, the front end is accessing other interfaces.

[0052] As an implementation method, the validity period of the authorization code is stored in the database. Before generating the second authorization code corresponding to the name of the target interface, the method also includes: determining whether the first authorization code is within the validity period based on the database; after generating the second authorization code corresponding to the name, the method also includes: setting the validity period of the second authorization code, and storing the validity period of the second authorization code in association with the front-end account in the database.

[0053] When the first authorization code is not within the validity period, a reminder of the expiration of the first authorization code will be sent to the front end. After receiving the reminder, the front end will update the first authorization code and use the updated first authorization code to execute the steps of the embodiment of the present invention.

[0054] Among them, the validity period of the second authorization code is less than the remaining validity period of the first authorization code. If the validity period of the second authorization code is set to be greater than the remaining validity period of the first authorization code, the second authorization code will also expire immediately after the first authorization code expires.

[0055] As another implementation method, the number of times the authorization code is used is stored in the database. Before the interface data corresponding to the target interface is sent to the front end, the method includes: limiting the number of times the third authorization code is used based on the Redis lock; before generating the second authorization code corresponding to the name, the method also includes: determining whether there is any remaining number of times the first authorization code is used based on the database.

[0056] Among them, a Redis lock can be set for the third authorization code, and the maximum number of times the third authorization code can be used and the remaining number of times the third authorization code can be used are written in the Redis lock. Each time the interface is accessed through the third authorization code, the remaining number of times will be reduced by one.

[0057] In actual applications, if multiple front-ends access the same interface within a preset time, the front-ends will be responded to in the order of the time when each front-end requests to access the interface. Furthermore, a prompt message will be sent to the unresponsive front-end, which may include the reason for the unresponsiveness and the expected time for the response.

[0058] The method for controlling interface access rights provided by an embodiment of the present invention can obtain the front-end account, the third authorization code and the name of the interface corresponding to the third authorization code by parsing the special parameters in the request for the front-end to access the target interface, and then generate a fifth authorization code based on the name of the interface corresponding to the third authorization code and the fourth authorization code corresponding to the front-end account. When the fifth authorization code is the same as the third authorization code, the interface data corresponding to the target interface is sent to the front-end, thereby avoiding the leakage and tampering of the interface data and improving the security of the interface data.

[0059] Example 2

[0060] The embodiment of the present invention provides a method for controlling interface access rights, which is applied to the front end of a login system. Figure 2 The flowchart of a method for controlling interface access rights applied to a front end of a login system is shown. The method for controlling interface access rights may include the following steps:

[0061] Step S201, randomly generate a character string in response to the registration of a front-end account, and use the front-end account and the character string as a first authorization code.

[0062] You can use the secure random number generator SecureRandom to generate a 20-digit English plus numeric random number as a string, such as "6086481862b419a7325ae5d95cae26ab19397e60".

[0063] Specifically, the front-end account and the character string may be combined to obtain the first authorization code.

[0064] Furthermore, in response to the registration of the front-end account, a character string is randomly generated, and after the front-end account and the character string are used as the first authorization code, a validity period of the first authorization code is set, and the validity period of the first authorization code is associated with the front-end account and stored in the database.

[0065] Step S202: Send the name of the target interface and the first authorization code to the back end of the login system.

[0066] After sending the name of the target interface and the first authorization code to the back end of the login system, the back end will search the database for the front end account in the first authorization code. If the front end account exists in the database, it will check whether the character string corresponding to the front end account is correct. If the front end account in the first authorization code exists in the database and the character string corresponding to the front end account is correct, a second authorization code corresponding to the name of the target interface will be generated, and the first verification code will be sent to the front end. After the front end receives the first verification code sent by the back end, it can send the first verification code to the back end when it needs to access the interface to obtain the second authorization code.

[0067] Step S203, receiving the second authorization code sent by the backend, and writing the frontend account, the second authorization code and the name of the target interface into the request header as special parameters.

[0068] Among them, there is a fixed special parameter filling format in the request header, and the front-end account, the second authorization code and the name of the target interface can be written according to the special parameter filling format.

[0069] Step S204: access the target interface based on the request header, and receive interface data corresponding to the target interface sent by the backend.

[0070] After requesting access to the target interface through the request header, the access permission is reviewed by the backend. If the frontend has access permission, the interface data corresponding to the target interface will be sent to the frontend.

[0071] The method for controlling interface access rights provided by an embodiment of the present invention can obtain a second authorization code by sending a first authorization code to a back end. After receiving the second authorization code, the name of the target interface and the second authorization code are written as special parameters into a request header to request access to the target interface to the back end. After the back end reviews and determines that the front end has access rights, the data corresponding to the target interface is sent, thereby avoiding leakage and tampering of the interface data and improving the security of the interface data.

[0072] Example 3

[0073] Corresponding to the above method embodiment, the embodiment of the present invention provides a device for controlling interface access rights, which is applied to the back end of the login system, such as Figure 3 The structure diagram of a device for controlling access rights of an interface applied to the back end of a login system is shown, and the device for controlling access rights of an interface includes:

[0074] The second authorization code generation module 301 is used to receive the name of the target interface and the first authorization code sent by the front end of the login system, and generate a second authorization code corresponding to the name of the target interface.

[0075] The second authorization code sending module 302 is used to send the second authorization code to the front end.

[0076] The special parameter parsing module 303 is used to respond to the request of the front end to access the target interface, parse the special parameters in the request header included in the request, and obtain the front end account, the third authorization code and the name of the interface corresponding to the third authorization code.

[0077] The fourth authorization code determination module 304 is used to determine the fourth authorization code corresponding to the front-end account based on the correspondence between the front-end account and the authorization code stored in the database.

[0078] The fifth authorization code generating module 305 is used to generate a fifth authorization code based on the name of the interface corresponding to the third authorization code and the fourth authorization code.

[0079] The interface data sending module 306 is used to send the interface data corresponding to the target interface to the front end if the fifth authorization code is the same as the third authorization code.

[0080] The device for controlling interface access rights provided by an embodiment of the present invention can obtain the front-end account, the third authorization code and the name of the interface corresponding to the third authorization code by parsing special parameters in the request for the front-end to access the target interface, and then generate a fifth authorization code based on the name of the interface corresponding to the third authorization code and the fourth authorization code corresponding to the front-end account. When the fifth authorization code is the same as the third authorization code, the interface data corresponding to the target interface is sent to the front-end, thereby avoiding leakage and tampering of the interface data and improving the security of the interface data.

[0081] In some embodiments, the second authorization code sending module is also used to randomly generate a first verification code based on the second authorization code, and send the first verification code to the front end; receive the second verification code sent by the front end, and if the first verification code is the same as the second verification code, send the second authorization code to the front end.

[0082] In some embodiments, the validity period of the authorization code is stored in the database, and the second authorization code generation module is also used to determine whether the first authorization code is within the validity period based on the database; set the validity period of the second authorization code, and associate the validity period of the second authorization code with the front-end account and store it in the database.

[0083] In some embodiments, the number of times the authorization code is used is stored in the database, and the interface data sending module is also used to limit the number of times the third authorization code is used based on the Redis lock; and determine whether there is any remaining number of times the first authorization code is used based on the database.

[0084] The device provided in the embodiment of the present invention has the same implementation principle and technical effects as those of the aforementioned method embodiment. For the sake of brief description, for matters not mentioned in the device embodiment, reference may be made to the corresponding contents in the aforementioned method embodiment.

[0085] Example 4

[0086] Corresponding to the above method embodiment, the embodiment of the present invention provides a device for controlling interface access rights, which is applied to the front end of the login system, such as Figure 4 The structure diagram of a device for controlling access rights of a front-end interface of a login system shown in FIG. 1 includes:

[0087] The first authorization code generation module 401 is used to randomly generate a character string in response to the registration of the front-end account, and use the front-end account and the character string as the first authorization code.

[0088] The sending module 402 is used to send the name of the target interface and the first authorization code to the back end of the login system.

[0089] The second authorization code receiving module 403 is used to receive the second authorization code sent by the backend, and write the frontend account, the second authorization code and the name of the target interface into the request header as special parameters.

[0090] The interface data receiving module 404 is used to access the target interface based on the request header and receive the interface data corresponding to the target interface sent by the backend.

[0091] The device for controlling interface access rights provided in an embodiment of the present invention can obtain a second authorization code by sending a first authorization code to a back end, and after receiving the second authorization code, write the name of the target interface and the second authorization code as special parameters into a request header to request access to the target interface to the back end, and receive data corresponding to the target interface sent after the back end reviews and determines that the front end has access rights, thereby avoiding leakage and tampering of the interface data and improving the security of the interface data.

[0092] In some embodiments, the first authorization code generation module is further used to set the validity period of the first authorization code, and associate the validity period of the first authorization code with the front-end account and store it in the database.

[0093] In some embodiments, the sending module is further used to receive a first verification code sent by the back end, and send the first verification code to the back end.

[0094] The device provided in the embodiment of the present invention has the same implementation principle and technical effects as those of the aforementioned method embodiment. For the sake of brief description, for matters not mentioned in the device embodiment, reference may be made to the corresponding contents in the aforementioned method embodiment.

[0095] Example 5

[0096] The embodiment of the present invention also provides an electronic device for executing the above method for controlling interface access rights; see Figure 5A structural schematic diagram of an electronic device is shown, which includes a memory 500 and a processor 501, wherein the memory 500 is used to store one or more computer instructions, and the one or more computer instructions are executed by the processor 501 to implement the above-mentioned method of controlling interface access rights.

[0097] Further, Figure 5 The electronic device shown further includes a bus 502 and a communication interface 503 , and the processor 501 , the communication interface 503 and the memory 500 are connected via the bus 502 .

[0098] The memory 500 may include a high-speed random access memory (RAM), and may also include a non-volatile memory, such as at least one disk storage. The communication connection between the system network element and at least one other network element is realized through at least one communication interface 503 (which may be wired or wireless), and the Internet, wide area network, local area network, metropolitan area network, etc. may be used. The bus 502 may be an ISA bus, a PCI bus, or an EISA bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 5 Only one bidirectional arrow is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0099] The processor 501 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit or software instructions in the processor 501. The above processor 501 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present invention can be implemented or executed. The general processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in the embodiment of the present invention can be directly embodied as a hardware decoding processor for execution, or a combination of hardware and software modules in the decoding processor for execution. The software module may be located in a storage medium mature in the art, such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory 500, and the processor 501 reads the information in the memory 500 and completes the steps of the method of the above embodiment in combination with its hardware.

[0100] An embodiment of the present invention also provides a computer-readable storage medium, which stores computer-executable instructions. When the computer-executable instructions are called and executed by a processor, the computer-executable instructions prompt the processor to implement the above-mentioned method of controlling interface access rights. The specific implementation can be found in the method embodiment, which will not be repeated here.

[0101] The computer program product of the method for controlling interface access rights provided in an embodiment of the present invention includes a computer-readable storage medium storing a non-volatile program code executable by a processor. The instructions included in the program code can be used to execute the method described in the previous method embodiment. The specific implementation can be found in the method embodiment and will not be repeated here.

[0102] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0103] In the several embodiments provided by the present invention, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. The device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, and the indirect coupling or communication connection of devices or units can be electrical, mechanical or other forms.

[0104] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0105] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0106] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a non-volatile computer-readable storage medium that is executable by a processor. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0107] Finally, it should be noted that the above-described embodiments are only specific implementations of the present invention, which are used to illustrate the technical solutions of the present invention, rather than to limit them. The protection scope of the present invention is not limited thereto. Although the present invention is described in detail with reference to the above-mentioned embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the above-mentioned embodiments within the technical scope disclosed by the present invention, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. A method for controlling interface access rights, characterized in that: Applied to the back end of the login system, the method includes: Receiving the name of the target interface and the first authorization code sent by the front end of the login system, and generating a second authorization code corresponding to the name of the target interface; Sending the second authorization code to the front end; In response to the request of the front end to access the target interface, parse the special parameters in the request header included in the request to obtain the front end account, the third authorization code and the name of the interface corresponding to the third authorization code; Determine a fourth authorization code corresponding to the front-end account based on the correspondence between the front-end account and the authorization code stored in the database; Generate a fifth authorization code based on the name of the interface corresponding to the third authorization code and the fourth authorization code; If the fifth authorization code is the same as the third authorization code, the interface data corresponding to the target interface is sent to the front end.

2. The method according to claim 1, characterized in that The sending the second authorization code to the front end includes: Randomly generate a first verification code based on the second authorization code, and send the first verification code to the front end; A second verification code sent by the front end is received, and if the first verification code is the same as the second verification code, the second authorization code is sent to the front end.

3. The method according to claim 1, characterized in that The database stores a validity period of the authorization code. Before generating a second authorization code corresponding to the name of the target interface, the method further includes: determining, based on the database, whether the first authorization code is within a validity period; After generating a second authorization code corresponding to the name, the method further includes: The validity period of the second authorization code is set, and the validity period of the second authorization code is associated with the front-end account and stored in the database.

4. The method according to claim 1, characterized in that The database stores the number of times the authorization code is used. Before the interface data corresponding to the target interface is sent to the front end, the method includes: Limiting the number of times the third authorization code is used based on the Redis lock; Before generating a second authorization code corresponding to the name, the method further includes: It is determined based on the database whether there is any remaining usage count of the first authorization code.

5. A method for controlling interface access rights, characterized in that: Applied to the front end of the login system, the method includes: In response to the registration of the front-end account, a character string is randomly generated, and the front-end account and the character string are used as a first authorization code; Sending the name of the target interface and the first authorization code to the back end of the login system; Receive the second authorization code sent by the backend, and write the frontend account, the second authorization code and the name of the target interface into the request header as special parameters; The target interface is accessed based on the request header, and interface data corresponding to the target interface sent by the backend is received.

6. The method according to claim 5, characterized in that After randomly generating a character string in response to the registration of the front-end account and using the front-end account and the character string as the first authorization code, the method further includes: The validity period of the first authorization code is set, and the validity period of the first authorization code is associated with the front-end account and stored in a database.

7. The method according to claim 5, characterized in that After sending the first authorization code and the name of the target interface to the back end, the method further includes: A first verification code is received from the backend, and the first verification code is sent to the backend.

8. The method according to claims 1-7, characterized in that If multiple front-ends request to access the same interface within a preset time, the front-ends will be responded to in the order of the time when each front-end requests to access the interface.

9. A device for controlling interface access rights, characterized in that: Applied to the back end of the login system, the device includes: A second authorization code generating module, used for receiving the name of the target interface and the first authorization code sent by the front end of the login system, and generating a second authorization code corresponding to the name of the target interface; A second authorization code sending module, used for sending the second authorization code to the front end; A special parameter parsing module, used to respond to the request of the front end to access the target interface, parse the special parameters in the request header included in the request, and obtain the front end account, the third authorization code and the name of the interface corresponding to the third authorization code; A fourth authorization code determination module, configured to determine a fourth authorization code corresponding to the front-end account based on the correspondence between the front-end account and the authorization code stored in a database; A fifth authorization code generating module, configured to generate a fifth authorization code based on the name of the interface corresponding to the third authorization code and the fourth authorization code; An interface data sending module is used to send the interface data corresponding to the target interface to the front end if the fifth authorization code is the same as the third authorization code.

10. A device for controlling interface access rights, characterized in that: Applied to the front end of the login system, the device comprises: A first authorization code generation module, configured to randomly generate a character string in response to the registration of a front-end account, and use the front-end account and the character string as a first authorization code; A sending module, used for sending the name of the target interface and the first authorization code to the back end of the login system; A second authorization code receiving module, used to receive the second authorization code sent by the backend, and write the frontend account, the second authorization code and the name of the target interface into the request header as special parameters; The interface data receiving module is used to access the target interface based on the request header and receive interface data corresponding to the target interface sent by the back end.

Images