User identity effective identification control method based on Session

Abstract

The invention discloses a Session-based user identity effective identification control method, which comprises the following steps that S1, a client initiates a login request for front-end use for the first time, a user ID and a login password are input through a front-end page, and the login request is submitted; s2, the server side automatically generates a verified user information Token value after receiving the request; s3, after the client successfully logs in, the browser is normally used for operating the front end of the business system, a service request is initiated to the rear end as required, and a login user ID is filled in an initiated request message; and S4, when the back end receives other service requests which are not the login request, performing validity judgment on the user information Token value stored in the Session. According to the scheme, the user information Token value is stored based on the browser Session, and legal interaction between the client and the server is achieved.

Description

Technical Field

[0001] The present invention relates to the technical field of code development, and in particular to a Session-based user identity effective identification control method. Background Art

[0002] With the rapid development of digital finance, the banking industry is currently innovating in web-based projects for internal management, customer marketing, etc., which require not only the simplification and convenience of human-computer interaction, but also the mandatory protection of sensitive information such as personal users. Moreover, business functions must be implemented under the security framework of the regulatory authorities, which places extremely high demands on the quality and efficiency of web project research and development. Summary of the invention

[0003] Based on the above technical problems, the present invention proposes a Session-based user identity effective identification control method, which stores Token values ​​(user information) based on the browser Session to achieve legal interaction between the client and the server. The specific technical solution is as follows.

[0004] A Session-based user identity effective identification control method stores user information Token value based on browser Session to achieve legal interaction between client and server, including the following steps: Step S1: The client initiates a login request for the first front-end use, enters the user ID and login password on the front-end page, and submits the login request; Step S2: After receiving the request, the server automatically generates a verified user information Token value; Step S3: After the client successfully logs in, the browser is used to operate the front-end of the business system normally, and a service request is initiated to the back-end as needed, and the login user ID is filled in the initiated request message; Step S4: When the backend receives other service requests other than login requests, the validity of the user information Token value stored in the Session is determined.

[0005] Specifically, step S2 includes the following sub-steps: Step S21: Based on the effective access time T requirement of the page, synthesize the effective access time node according to the current request time + T time; Step S22: Access the background user information static table to verify the user ID and login password; Step S23: Obtain the organization ID of the user from the backend organization tree; Step S24: The above three verification information are combined and encrypted and written into the userInfor of the Session and the concatenated string is encrypted with MD5; at the same time, the generated user ID, organization ID, timer, and user status information are stored in the back-end shared cache, and a message is returned to notify the client user of successful login.

[0006] Specifically, step S4 includes the following sub-steps: Step S41: Parse the value of duserInfo in Session, extract the user ID therein and compare it with the login user ID in the front-end private message. If the two contents are consistent, the request is considered to be a legitimate front-end request. Step S42: After verifying that the user ID is correct, the server takes out the valid access time node in userInfo and compares it with the current system time. If the current system time is <= the valid access time node, then this request is a valid front-end request; Step S43: If and only if the user ID = the login user ID and the current system time <= the valid access time node, the backend determines that this request is a legal and valid access and responds to this frontend request.

[0007] Specifically, the front end and the back end set effective duration access control.

[0008] Specifically, when opening a new page, the server automatically fills in the valid access time node in userInfo as a timer for page access.

[0009] Specifically, for each legitimate request of the front end within a valid page access cycle, the back end extends and updates the valid access time node.

[0010] Beneficial effects of the invention: The invention proposes a method for effective user identity identification and control based on Session, which records user identity information in Session through a mechanism that effectively records customer status on the server side, does not increase front-end storage consumption, does not increase database pressure from frequent back-end inquiries, and only automatically transmits encrypted strings through the browser and verifies the correctness of the encrypted information on the back end, thereby achieving a legitimate judgment on the front-end requesting user and realizing low-code, highly reliable front-end and back-end interaction, including login, social networking, leaving messages, etc. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] Figure 1 It is a processing flow architecture diagram of a bank branch marketing system in an embodiment of the present invention. DETAILED DESCRIPTION

[0012] In order to have a clearer understanding of the technical features, purposes and effects of the present invention, specific embodiments of the present invention are now described with reference to the accompanying drawings.

[0013] The present invention proposes a Session-based user identity effective identification control method, which stores user information Token value based on browser Session to achieve legal interaction between client and server, including the following steps: Step S1: The client initiates a login request for the first front-end use, enters the user ID and login password on the front-end page, and submits the login request; Step S2: After receiving the request, the server automatically generates a verified user information Token value; Step S3: After the client successfully logs in, the browser is used to operate the front-end of the business system normally, and a service request is initiated to the back-end as needed, and the login user ID is filled in the initiated request message; Step S4: When the backend receives other service requests other than login requests, the validity of the user information Token value stored in the Session is determined.

[0014] In this embodiment, step S2 includes the following sub-steps: Step S21: Based on the effective access time T requirement of the page, synthesize the effective access time node according to the current request time + T time; Step S22: Access the background user information static table to verify the user ID and login password; Step S23: Obtain the organization ID of the user from the backend organization tree; Step S24: The above three verification information are combined and encrypted and written into the userInfor of the Session and the concatenated string is encrypted with MD5; at the same time, the generated user ID, organization ID, timer, and user status information are stored in the back-end shared cache, and a message is returned to notify the client user of successful login.

[0015] In this embodiment, step S4 includes the following sub-steps: Step S41: Parse the value of duserInfo in Session, extract the user ID therein and compare it with the login user ID in the front-end private message. If the two contents are consistent, the request is considered to be a legitimate front-end request. Step S42: After verifying that the user ID is correct, the server takes out the valid access time node in userInfo and compares it with the current system time. If the current system time is <= the valid access time node, then this request is a valid front-end request; Step S43: If and only if the user ID = the login user ID and the current system time <= the valid access time node, the backend determines that this request is a legal and valid access and responds to this frontend request.

[0016] In this embodiment, the front end and the back end set effective duration access control; when the server opens a new page, it automatically fills in the effective access time node in userInfor as a timer for page access; for each legitimate request of the front end within the effective page access cycle, the back end extends and updates the effective access time node.

[0017] In one embodiment, the technical solution of the present invention stores the Token value (user information) based on the browser Session to achieve legal interaction between the client and the server, including the following steps: Step 1: The client initiates the first login request for front-end use, enters login information such as user ID (usapId) and login password (usapPWD) on the front-end page, and submits the login request.

[0018] Step 2: After receiving the request, the server automatically generates a Token value (verified user information): First, according to the effective access time (T) requirement of the page, the effective access time node (accessTime) is synthesized according to the current request time + T; second, the backend user information static table is accessed to verify the user ID (usapId) and login password (usapPWD); third, the user's organization ID (organId) is obtained from the backend organization tree, and the above three verification information is combined and encrypted and written into the Session's userInfor (usapId+organId+accessTime concatenated string MD5 encryption). At the same time, the generated user ID (usapId), organization ID (organId), timer (accessTime), user status and other information are stored in the backend shared cache, and a message is returned to notify the client that the user has successfully logged in.

[0019] Step 3: After the client successfully logs in, use the browser to operate the front-end of the business system normally, initiate service requests to the back-end as needed, and fill in the login user ID (usapCode) in the initiated request message.

[0020] Step 4: When the backend receives other service requests other than login requests, it will determine the validity of the Token value stored in the Session. First, parse the Session's userInfor value, take out the usapId and compare it with the usapCode in the front-end private message. If the content is consistent (usapId=usapCode), the request is considered to be a legitimate front-end request. After verifying that the user ID is correct, the server takes out the accessTime in userInfor and compares it with the current system time (systemTime). If systemTime<=accessTime, it means that this request is a valid front-end request. Only when usapId=usapCode and systemTime<=accessTime does the backend determine that this request is a legitimate and valid access, and then respond to this front-end request.

[0021] In addition, in the embodiment of the present invention, the front-end and back-end use effective time control access. After the specified idle time interval expires, the server automatically logs out the user session. When opening a new page, the server automatically fills in the accessTime in userInfor as a timer for page access. During the effective page access cycle, each legitimate request from the front-end will extend and update the accessTime by the back-end.

[0022] The following is an example of the processing flow of a bank branch marketing system. Figure 1 As shown, the effective access time interval between the front-end and back-end configured in the system is 5 minutes. Assume that an employee needs to access the system and modify the mobile phone number on the "Personal Information" page.

[0023] 1. The user's browser accesses the system homepage and automatically jumps to the login page. The user enters the employee ID, password, and verification code and clicks the "Login" button.

[0024] 2. The backend server receives the user information verification request initiated by the client, calls the head office interface, and verifies the correctness of the employee ID, password, and verification code sent by the client. After the head office returns the verification, it processes the Token value. First, obtain the employee ID and organization ID returned by the head office, and generate a valid access timestamp (process the current system time + 5m). The server concatenates the above three elements (employee ID, organization ID, timestamp), takes their MD5 code, and stores the generated encrypted string in SessionID=userInfor.

[0025] 3. The backend server stores the result value of the login user information verification (employee ID, organization ID, login status and other key information) in the backend shared cache, notifies the client of the verified employee ID and verification result through a private message, and returns the userInfor content generated in step 2 to the browser in the response content (Cookie).

[0026] 4. After the user successfully logs in, go to the homepage, browse the page and click the "My" menu, enter the "Personal Information" page, modify the mobile phone number and click the "Confirm" button. The browser will send the userInfor content saved locally to the backend service again.

[0027] 5. The backend server receives the frontend request initiated by the client to modify personal information. First, it determines the non-frontend login verification request, decrypts the userInfor content in the browser request data, and parses out the three elements of employee ID, organization ID, and timestamp. Perform a consistency comparison between the parsed employee ID and the private message in the client request, as well as the ID number and login status in the backend shared cache. After the verification is passed, the server obtains the current system time and compares it with the parsed timestamp. Currently, the server will only process the frontend request to modify the mobile phone number if the current time is earlier than the effective access deadline.

[0028] 6. After the backend server completes the modification of the mobile phone number, it adds 5m to the current system time to generate a new timestamp, reassembles "employee ID + organization ID + new timestamp", takes its MD5 code, and replaces the generated new encrypted string with SessionID=userInfor, and returns to the browser again.

[0029] The present invention has shown and described the basic principles and main features of the present invention and the advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The above embodiments and descriptions are only for explaining the principles of the present invention. Without departing from the spirit and scope of the present invention, the present invention may have various changes and improvements, which fall within the scope of the present invention. The scope of protection of the present invention is defined by the attached claims and their equivalents.

Claims

1. A Session-based user identity effective identification control method, characterized in that: The browser Session stores the user information Token value to achieve legal interaction between the client and the server, including the following steps: Step S1: The client initiates a login request for the first front-end use, enters the user ID and login password on the front-end page, and submits the login request; Step S2: After receiving the request, the server automatically generates a verified user information Token value; Step S3: After the client successfully logs in, the browser is used to operate the front-end of the business system normally, and a service request is initiated to the back-end as needed, and the login user ID is filled in the initiated request message; Step S4: When the backend receives other service requests other than login requests, the validity of the user information Token value stored in the Session is determined.

2. According to claim 1, a Session-based user identity effective identification control method is characterized in that: The step S2 comprises the following sub-steps: Step S21: Based on the effective access time T requirement of the page, synthesize the effective access time node according to the current request time + T time; Step S22: Access the background user information static table to verify the user ID and login password; Step S23: Obtain the organization ID of the user from the backend organization tree; Step S24: The above three verification information are combined and encrypted and written into the userInfor of the Session and the concatenated string is encrypted with MD5; at the same time, the generated user ID, organization ID, timer, and user status information are stored in the back-end shared cache, and a message is returned to notify the client user of successful login.

3. According to claim 2, a Session-based user identity effective identification control method is characterized in that: The step S4 comprises the following sub-steps: Step S41: Parse the value of duserInfo in Session, extract the user ID therein and compare it with the login user ID in the front-end private message. If the two contents are consistent, the request is considered to be a legitimate front-end request. Step S42: After verifying that the user ID is correct, the server takes out the valid access time node in userInfo and compares it with the current system time. If the current system time is <= the valid access time node, then this request is a valid front-end request; Step S43: If and only if the user ID = the login user ID and the current system time <= the valid access time node, the backend determines that this request is a legal and valid access and responds to this frontend request.

4. According to claim 1, a Session-based user identity effective identification control method is characterized in that: The front end and the back end are set with effective duration access control.

5. According to claim 4, a Session-based user identity effective identification control method is characterized in that: When opening a new page, the server automatically fills in the valid access time node in userInfo as a timer for page access.

6. According to claim 5, a Session-based user identity effective identification control method is characterized in that: For each legitimate request of the front end within the effective page access cycle, the back end extends and updates the effective access time node.

Images