Micro-service calling method and system, storage medium and electronic equipment
By adding flag request headers to microservice calls, the gateway device determines the source of the interface call request, solving the problem of difficult to ensure the security of interface call in microservices, and achieving a balance between interface call security and performance.
Patent Information
- Application Number
- CN202411380467.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-09-30
- Publication Date
- 2024-12-27
AI Technical Summary
In microservice applications, it is difficult to distinguish an interface from an internal or external interface, which makes it difficult to ensure the security of interface call.
By adding a flag request header to the interface call request, the gateway device detects and determines whether the interface call request carries the flag request header. If it is an internal interface, the request will be rejected. If it is an external interface, the request will be responded to and authentication will be performed if necessary.
Without affecting the performance of interface calling, ensure the security of interface calling, prevent illegal calls, and realize the security of interface applications without major adjustments in the gateway and microservice services.
Smart Images
Figure CN119211354A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of computer communications, and in particular to a microservice calling method, system, storage medium and electronic device. Background Art
[0002] In microservice applications, a microservice usually provides multiple interfaces. Some are for external calls, such as web front-end, APP, other external systems, etc., which can be called external interfaces. They are generally called through gateways, and most of them require authentication. A small number of interfaces, such as login and pre-login information display interfaces, do not require authentication. Some are called for internal microservices, that is, internal interfaces, which communicate directly between internal microservices through the registration center without going through the gateway, and generally do not require authentication. Therefore, it is difficult to directly distinguish whether an interface request is an internal interface or an external interface, and the security of interface calls cannot be guaranteed. Summary of the invention
[0003] The purpose of this application is to provide a microservice calling method, system, computer-readable storage medium and electronic device, which can determine whether it is an external calling interface by adding a flag request header in the interface calling request, thereby ensuring the security of interface use without affecting the interface calling performance.
[0004] In order to solve the above technical problems, the present application provides a microservice calling method, which is applied to a gateway device. The external network access port of the server where the microservice is located is closed. The gateway device is used to add a flag request header to the network request passing through the gateway device. The specific technical solution is as follows:
[0005] When an interface call request is detected, obtaining a request interface path of the interface call request;
[0006] Parse the request interface path and determine the interface usage object;
[0007] If the interface usage object is an internal interface, determining whether the interface call request carries the flag request header;
[0008] If the interface call request carries the flag request header, reject the interface call request;
[0009] If the interface call request does not carry the flag request header, respond to the interface call request.
[0010] Optionally, the interface usage object is an external usage interface, further comprising:
[0011] Determine whether the interface user object needs to perform interface authentication;
[0012] If the interface user object needs to perform interface authentication, determine whether the interface call request contains user authentication information;
[0013] If the interface usage object does not need to perform interface authentication, respond to the interface call request.
[0014] Optionally, parsing the request interface path to determine the interface usage object includes:
[0015] Get interface path matching rules;
[0016] The request interface path is compared with the interface path matching rule to determine the interface usage object.
[0017] Optionally, parsing the request interface path to determine the user object of the interface includes:
[0018] Get the interface whitelist;
[0019] The request interface path is compared with the interface whitelist to determine the interface usage object.
[0020] Optionally, obtaining the request interface path of the interface call request includes:
[0021] The call interceptor reads the interface call request, and applies the address acquisition function in the interceptor to obtain the request interface path in the interface call request.
[0022] Optionally, when an interface call request is detected, the following is also included:
[0023] Determine whether the interface call request needs to perform interface authentication according to the interface whitelist;
[0024] If yes, execute the step of obtaining the request interface path of the interface call request;
[0025] If not, respond to the interface call request.
[0026] Optionally, also include:
[0027] A variable modification function of a global filter is set in the gateway device; the variable modification function is used to add the flag request header to the interface call request.
[0028] The present application also provides a microservice calling system, which is applied to a gateway device, wherein the external network access port of the server where the microservice is located is closed, and the gateway device is used to add a flag request header to the network request passing through the gateway device, including:
[0029] A path acquisition module, used to acquire the request interface path of the interface call request when an interface call request is detected;
[0030] An object determination module, used to parse the request interface path and determine the interface usage object;
[0031] A judging module, configured to judge whether the interface calling request carries the flag request header if the interface usage object is an internal usage interface;
[0032] The request processing module is used to reject the interface call request if the interface call request carries the flag request header; and respond to the interface call request if the interface call request does not carry the flag request header.
[0033] The present application also provides a computer-readable storage medium having a computer program stored thereon, and the computer program implements the steps of the above-mentioned method when executed by a processor.
[0034] The present application also provides an electronic device, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps of the above-mentioned method when calling the computer program in the memory.
[0035] The present application provides a microservice calling method, which is applied to a gateway device, wherein the external network access port of a server where the microservice is located is closed, and the gateway device is used to add a flag request header to a network request passing through the gateway device, wherein the network request includes an interface calling request, and the method includes: when an interface calling request is detected, obtaining a request interface path of the interface calling request; parsing the request interface path to determine an interface usage object; if the interface usage object is an internal interface, determining whether the interface calling request carries the flag request header; if the interface calling request carries the flag request header, rejecting the interface calling request; if the interface calling request does not carry the flag request header, responding to the interface calling request.
[0036] When calling microservices, this application improves the gateway device so that all network requests passing through the network management device need to add a flag request header. When processing interface call requests, it can be determined whether the interface call request contains a flag request header. If the interface call request is used to call an internal interface but contains a flag request header, it can be determined that it is called externally. At this time, the interface call request is an illegal call. This application ensures the security of interface applications without requiring major adjustments to the gateway and microservice business, while not affecting the processing performance of interface call requests.
[0037] The present application also provides a microservice calling system, a computer-readable storage medium, and an electronic device, which have the above-mentioned beneficial effects and are not described in detail here. BRIEF DESCRIPTION OF THE DRAWINGS
[0038] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.
[0039] Figure 1 A flowchart of a microservice calling method provided in an embodiment of the present application;
[0040] Figure 2 A schematic diagram of the processing process of an interface call request provided in an embodiment of the present application;
[0041] Figure 3 A flowchart of another microservice calling method provided in an embodiment of the present application;
[0042] Figure 4 A schematic diagram of the structure of a microservice calling system provided in an embodiment of the present application;
[0043] Figure 5 A structural diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION
[0044] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.
[0045] The object information involved in this application, including but not limited to the object device information, object personal information, etc., and data, including but not limited to data used for analysis, stored data, displayed data, etc., are all information and data authorized by the object or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the laws, regulations and standards of relevant countries and regions.
[0046] See also Figure 1 , Figure 1 A flowchart of a microservice calling method provided in an embodiment of the present application, the method comprising:
[0047] S101: when the interface call request is detected, obtaining the request interface path of the interface call request;
[0048] S102: parsing the request interface path to determine the interface usage object;
[0049] S103: If the interface usage object is an internal interface, determine whether the interface call request carries the flag request header; if so, proceed to S104; if not, proceed to S105;
[0050] S104: rejecting the interface call request;
[0051] S105: Respond to the interface call request.
[0052] The microservice calling method described in the embodiment of the present application needs to ensure that the external network access port of the server where the microservice is located is closed to avoid directly calling the microservice from the external network access port. At the same time, the gateway device is set to add a flag request header to the network request passing through the gateway device, and the network request includes the interface call request targeted by the embodiment of the present application. The specific form and content of the flag request header are not limited here, and it is only necessary to feedback that the network request is forwarded from the gateway device through the flag request header. And for different gateway devices, the flag request headers set by them may be different to distinguish them.
[0053] There is no limitation on how to modify the gateway device to add a flag request header to the network request. In a feasible implementation, a variable modification function of the global filter can be set in the gateway device; the variable modification function is used to add the flag request header to the interface call request.
[0054] The embodiments of the present application do not limit the source and generation method of the interface call request. As long as it is a call request for a microservice, it can be regarded as an interface call request. When an interface call request is detected, its request interface path is obtained. Specifically, the interface call request can be parsed to obtain the request interface path. The request interface path is the interface of the application microservice, which may be an external interface or an internal interface. Specifically, it is necessary to parse the request interface path to determine the interface user object, so as to judge whether the interface call request corresponds to an external interface or an internal interface according to the interface user object.
[0055] At this time, the interceptor can be called to read the interface call request, and the address acquisition function in the interceptor can be used to obtain the request interface path in the interface call request. The interceptor can be used to read, modify, record or reject the interface call request. In this embodiment, the interceptor is used to read the request interface path in the interface call request.
[0056] Here, there is no limitation on how to parse the request interface path to determine the interface user object. In a feasible implementation, a wildcard can be applied to determine the interface user object. Specifically, the interface path matching rule can be obtained first, and then the request interface path and the interface path matching rule can be compared to determine the interface user object. That is, the request path is matched by the wildcard part to detect whether the interface request path can match the interface path matching rule. Usually, it can be matched according to the full path of the interface, or it can be matched according to the wildcard rule. For example, inner / user / getUserById is a full path. If the match is successful, a unique interface path will be matched. Fuzzy retrieval can also be used. For example, the wildcard pattern of "inner / *" can match the interface path that meets the matching rule of inner / *.
[0057] In another feasible implementation, the interface user object can be determined based on the interface whitelist. Specifically, the interface whitelist can be obtained, so as to compare the request interface path and the interface whitelist to determine the interface user object. It is easy to understand that at this time, the interface whitelist needs to be defined in advance, and the interface whitelist defines the relevant information that allows the use of the interface object, such as the client identification, IP address or ID information. After the interface call request is detected, the interface whitelist can be obtained, and the interface user object can be matched according to the request source contained in the interface call request to determine whether the interface user object is located in the interface whitelist. If the interface user object is located in the interface whitelist, the interface user object can be directly determined. In addition, when verifying the interface user object, it is also possible to further verify whether the interface user object has sufficient authority to call the functional interface.
[0058] After determining the interface usage object, if the interface usage object is an internal interface, determine whether the interface call request carries the flag request header. Since the gateway device will add a flag request header to all network requests passing through, if the interface call request is initiated by the gateway device, it will contain the flag request header after being forwarded by the gateway device. Therefore, it is possible to determine whether the interface call request is an external request based on whether the interface call request carries the flag request header. Obviously, if the interface call request carries the flag request header, it indicates that it is an external request and the interface call request is rejected. If the interface call request does not carry the flag request header, the interface call request can be responded to.
[0059] It should be noted that when the interface usage object is an internal interface and the interface call request carries a flag request header, the interface call request is rejected. If the interface usage object is an external interface, the interface call request can still be responded to when the interface call request carries a flag request header.
[0060] In addition, if the interface user object is an external interface, it can be further determined whether the interface user object needs to perform interface authentication. Interface authentication refers to the identity authentication and permission check of the object requesting the interface, with the purpose of ensuring that only authorized clients can access a specific interface, thereby protecting system resources from unauthorized access.
[0061] If the interface user object needs to perform interface authentication, it can determine whether the interface call request contains user authentication information. The interface call request is responded to only when the interface call request contains user authentication information. Otherwise, the authentication fails and the interface call request is rejected.
[0062] If the interface user object does not need to perform interface authentication, it can respond to the interface call request.
[0063] In a feasible implementation, it is also possible to determine whether the interface call request needs to perform interface authentication based on the interface whitelist, that is, if the interface call object is in the interface whitelist, it is also possible not to authenticate the interface call object and directly respond to the interface call request. Otherwise, the step of obtaining the request interface path of the interface call request can be executed.
[0064] When calling microservices, the embodiment of the present application improves the gateway device so that all network requests passing through the network management device need to add a flag request header. When processing an interface call request, it can be determined whether the interface call request contains a flag request header. If the interface call request is used to call an internal interface but contains a flag request header, it can be determined that it is called externally, and the interface call request is an illegal call. The present application ensures the security of interface applications without requiring major adjustments to the gateway and microservice business, while not affecting the processing performance of the interface call request.
[0065] See also Figure 2 , Figure 2 A schematic diagram of the processing process of an interface call request provided in an embodiment of the present application, Figure 2 It includes normal external requests, i.e. out api, and illegal external requests, i.e. inner api, all of which go through the gateway device, which adds a request header GatewayHead to the request. Figure 2 The diagram includes microservice 1 and microservice 2, wherein microservice 2 is limited to internal interface calls and does not directly establish a communication connection with the gateway device. At the same time, microservice 1 can perform authentication before calling.
[0066] See also Figure 3 , Figure 3 Flow chart of another microservice calling method provided in an embodiment of the present application
[0067] Figure 3In the example, after receiving an interface call request, it can be determined whether the interface corresponding to the interface call request requires authentication. If no authentication is required, the interface call request can be directly responded to. If authentication is required, the request interface path can be parsed to determine the interface request object, and then determine whether it is an external interface.
[0068] The subsequent process can refer to the above embodiment and will not be repeated here.
[0069] First, the gateway device is modified. All network requests passing through the gateway device are added with a fixed flag request header. Taking "GatewayPass" as an example, it is marked that the network request call is accessed through the gateway, and then forwarded to the corresponding backend microservice according to the request address in the interface call request.
[0070] The server where the microservice is located closes the external network access port. All interface call requests are either forwarded to the microservice through the gateway device (external requests) or directly accessed through the registration center (internal requests).
[0071] If the internal microservice interface receives an interface call request, the interface call request first enters the interceptor, reads the request header and the request interface path, parses the request interface path, and determines whether the interface is an internal interface or an external interface.
[0072] If the requested interface is for internal use, determine whether the request header "GatewayPass" is carried. If it is carried, it indicates that the interface call request is forwarded through a gateway device. In this case, an error message is returned to reject the interface call request.
[0073] If the requested interface is for external use and requires authentication, determine whether it carries user authentication information. Only if the authentication is passed will the subsequent business processing continue and the correct information will be returned, otherwise an error message will be returned.
[0074] If the requested interface is for external use and does not require authentication, proceed directly to subsequent business processing and return correct information.
[0075] This embodiment forwards the interface call request to the internal interface to the gateway device, which is matched by the gateway device. Compared with direct interception, when an interface needs to be added in the background, there is no need to modify the relevant configuration in the gateway device, which makes the logic processing simpler and faster, and reduces the processing overhead of the gateway device. By placing the judgment and authentication logic in the business system, the development of the gateway device is simplified, and while ensuring the security of the interface, a large number of interface configurations in the gateway are avoided, which is more suitable for the fast-iterative microservice development model.
[0076] See also Figure 4A schematic diagram of the structure of a microservice calling system provided in an embodiment of the present application, the system is applied to a gateway device, and the external network access port of the server where the microservice is located is closed, the gateway device is used to add a flag request header to the network request passing through the gateway device, and the system includes:
[0077] A path acquisition module, used to acquire the request interface path of the interface call request when an interface call request is detected;
[0078] An object determination module, used to parse the request interface path and determine the interface usage object;
[0079] A judging module, configured to judge whether the interface calling request carries the flag request header if the interface usage object is an internal usage interface;
[0080] The request processing module is used to reject the interface call request if the interface call request carries the flag request header; and respond to the interface call request if the interface call request does not carry the flag request header.
[0081] The present application also provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed, the steps provided in the above embodiment can be implemented. The storage medium may include: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program codes.
[0082] The present application also provides an electronic device, see Figure 4 , a structural diagram of an electronic device provided in an embodiment of the present application, such as Figure 4 As shown, a processor 1410 and a memory 1420 may be included.
[0083] Among them, the processor 1410 may include one or more processing cores, such as a 4-core processor, an 8-core processor, etc. The processor 1410 may be implemented in at least one hardware form of DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array). The processor 1410 may also include a main processor and a coprocessor. The main processor is a processor for processing data in the awake state, also known as a CPU (Central Processing Unit); the coprocessor is a low-power processor for processing data in the standby state. In some embodiments, the processor 1410 may be integrated with a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the display screen. In some embodiments, the processor 1410 may also include an AI (Artificial Intelligence) processor, which is used to process computing operations related to machine learning.
[0084] The memory 1420 may include one or more computer-readable storage media, which may be non-transitory. The memory 1420 may also include a high-speed random access memory, and a non-volatile memory, such as one or more disk storage devices, flash memory storage devices. In this embodiment, the memory 1420 is at least used to store the following computer program 1421, wherein, after the computer program is loaded and executed by the processor 1410, it can implement the relevant steps in the method performed by the electronic device side disclosed in any of the aforementioned embodiments. In addition, the resources stored in the memory 1420 may also include an operating system 1422 and data 1423, etc., and the storage method may be temporary storage or permanent storage. Among them, the operating system 1422 may include Windows, Linux, Android, etc.
[0085] In some embodiments, the electronic device may further include a display screen 1430 , an input / output interface 1440 , a communication interface 1450 , a sensor 1460 , a power source 1470 , and a communication bus 1480 .
[0086] certainly, Figure 4 The structure of the electronic device shown does not constitute a limitation on the electronic device in the embodiments of the present application. In actual applications, the electronic device may include Figure 4 More or fewer components than shown, or combinations of certain components.
[0087] The various embodiments in the specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other. For the system provided in the embodiment, since it corresponds to the method provided in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part description.
[0088] Specific examples are used herein to illustrate the principles and implementation methods of the present application, and the description of the above embodiments is only used to help understand the method and core ideas of the present application. It should be pointed out that for ordinary technicians in this technical field, without departing from the principles of the present application, several improvements and modifications can be made to the present application, and these improvements and modifications also fall within the scope of protection of the claims of the present application.
[0089] It should also be noted that, in this specification, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprise", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the statement "comprises a ..." does not exclude the presence of other identical elements in the process, method, article or device including the element.
Claims
1. A microservice calling method, applied to a gateway device, characterized in that: The external network access port of the server where the microservice is located is closed, the gateway device is used to add a flag request header to the network request passing through the gateway device, the network request includes an interface call request, and the method includes: When the interface call request is detected, obtaining the request interface path of the interface call request; Parse the request interface path and determine the interface usage object; If the interface usage object is an internal interface, determining whether the interface call request carries the flag request header; If the interface call request carries the flag request header, reject the interface call request; If the interface call request does not carry the flag request header, respond to the interface call request.
2. The microservice calling method according to claim 1, characterized in that: If the interface usage object is an external usage interface, it also includes: Determine whether the interface user object needs to perform interface authentication; If the interface user object needs to perform interface authentication, determine whether the interface call request contains user authentication information; If the interface usage object does not need to perform interface authentication, respond to the interface call request.
3. The microservice calling method according to claim 1, characterized in that: Parsing the request interface path and determining the interface usage object includes: Get interface path matching rules; The request interface path is compared with the interface path matching rule to determine the interface usage object.
4. The microservice calling method according to claim 1, characterized in that: Parsing the request interface path and determining the user of the interface includes: Get the interface whitelist; The request interface path is compared with the interface whitelist to determine the interface usage object.
5. The microservice calling method according to claim 1, characterized in that: The request interface path for obtaining the interface call request includes: The call interceptor reads the interface call request, and applies the address acquisition function in the interceptor to obtain the request interface path in the interface call request.
6. The microservice calling method according to claim 4, characterized in that: When an interface call request is detected, it also includes: Determine whether the interface call request needs to perform interface authentication according to the interface whitelist; If yes, execute the step of obtaining the request interface path of the interface call request; If not, respond to the interface call request.
7. The microservice calling method according to claim 1, characterized in that: Also includes: Setting a variable modification function of a global filter in the gateway device; The variable modification function is used to add the flag request header to the interface call request.
8. A microservice calling system, applied to a gateway device, characterized in that: The external network access port of the server where the microservice is located is closed, and the gateway device is used to add a flag request header to the network request passing through the gateway device, including: A path acquisition module, used to acquire the request interface path of the interface call request when an interface call request is detected; An object determination module, used to parse the request interface path and determine the interface usage object; A judging module, configured to judge whether the interface calling request carries the flag request header if the interface usage object is an internal usage interface; The request processing module is used to reject the interface call request if the interface call request carries the flag request header; and respond to the interface call request if the interface call request does not carry the flag request header.
9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the microservice calling method according to any one of claims 1 to 7 are implemented.
10. An electronic device, characterized in that: It includes a memory and a processor, wherein a computer program is stored in the memory, and when the processor calls the computer program in the memory, the steps of the microservice calling method according to any one of claims 1 to 7 are implemented.