Permission verification method, filter, front-end server and storage medium

Abstract

The present application discloses a permission verification method, a filter, a front-end server, and a storage medium, and relates to the field of permission control technology. The permission verification method applied to the filter includes: intercepting an interface request sent by a front-end server, wherein the interface request is generated by the front-end server in response to a trigger operation for a target page element in a menu interface; determining an interface permission set that matches the interface request; determining a target access permission of a target interface indicated by the interface request based on an association relationship between a preset interface and an interface access permission; and sending an interface request to a back-end server when the interface permission set includes the target access permission. The present application implements permission control for a back-end interface by configuring an association relationship between an interface and an interface access permission outside the back-end server, thereby improving the efficiency of permission control.

Description

Technical Field

[0001] The present application relates to the technical field of permission control, and in particular to a permission verification method, a filter, a front-end server and a storage medium. Background Art

[0002] User function permission control is typically based on the RBAC (Role-Based Access Control) model, which implements page function permission control through the user-role-menu relationship. However, this solution only guarantees menu access permission control at the front-end level and cannot effectively prevent users from illegally calling corresponding back-end interfaces.

[0003] To prevent illegal user calls, developers typically add permission verification code to the backend business code to verify the permissions of the backend interfaces. However, the backend business code is large and complex, and the permission verification logic for different backend interfaces varies. Each permission verification code is stored separately in the backend interface code, making it difficult for developers to uniformly manage and control interface permissions, resulting in low efficiency. Summary of the Invention

[0004] The main purpose of this application is to provide a permission verification method, filter, front-end server and storage medium, aiming to solve the technical problem of how to improve the efficiency of permission control.

[0005] To achieve the above objectives, the present application proposes a permission verification method, which is applied to a filter and includes:

[0006] Intercepting an interface request sent by a front-end server, wherein the interface request is generated by the front-end server in response to a triggering operation on a target page element in a menu interface;

[0007] Determine the interface permission set that matches the interface request;

[0008] Determining the target access permission of the target interface indicated by the interface request according to the association relationship between the preset interface and the interface access permission;

[0009] In a case where the interface permission set includes the target access permission, the interface request is sent to the backend server.

[0010] In one embodiment, the method further comprises:

[0011] In the case where the backend interface of the backend server is updated, the association relationship between the interface and the interface access authority is modified according to the change of the backend interface.

[0012] In one embodiment, the step of determining the interface permission set that matches the interface request includes:

[0013] Determine the role information corresponding to the interface request;

[0014] The interface permission set is determined according to the role information.

[0015] In one embodiment, the step of determining the interface permission set based on the role information includes:

[0016] Determine a page element permission set based on the role information;

[0017] The interface permission set is determined according to the page element permission set.

[0018] In one embodiment, after the step of intercepting the interface request sent by the front-end server, the method further includes:

[0019] Determining a target interface indicated by the interface request;

[0020] In the event that the preset interface library does not contain the target interface, processing the interface request according to a preset rule;

[0021] In the case where the interface library includes the target interface, the step of determining the user's interface permission set according to the interface request is performed.

[0022] To achieve the above objectives, the present application proposes a permission verification method, which is applied to a front-end server and includes:

[0023] Displaying a menu page, wherein the menu page includes at least one page element;

[0024] generating an interface request in response to a triggering operation on a target page element in the menu page;

[0025] The interface request is sent to the back-end server, wherein a filter is set between the back-end server and the front-end server, the filter is used to intercept the interface request and determine the interface permission set that matches the interface request, and determine the target access permission of the target interface indicated by the interface request based on the association relationship between the preset interface and the interface access permission. When the interface permission set includes the target access permission, the interface request is sent to the back-end server.

[0026] In one embodiment, after the step of displaying the menu page, the method further includes:

[0027] Determining, based on the acquired user identifier, a page element permission set that matches the user identifier, and determining the page elements included in the page element permission set as operable page elements;

[0028] Displaying the operable page element in the menu page; or,

[0029] In the menu page, the operable page elements and other elements in the menu page are displayed separately.

[0030] In addition, to achieve the above-mentioned purpose, the present application also proposes a permission verification device, which is applied to a filter and includes:

[0031] A request interception module, configured to intercept an interface request sent by a front-end server, wherein the interface request is generated by the front-end server in response to a triggering operation on a target page element in a menu interface;

[0032] A set determination module, configured to determine a set of interface permissions that matches the interface request;

[0033] an authority determination module, configured to determine a target access permission of a target interface indicated by the interface request based on a preset association relationship between the interface and the interface access permission;

[0034] The request sending module is used to send the interface request to the backend server when the interface permission set includes the target access permission.

[0035] In addition, to achieve the above-mentioned purpose, the present application also proposes a permission verification device, which is applied to a front-end server and includes:

[0036] A display module, configured to display a menu page, wherein the menu page includes at least one page element;

[0037] A generating module, configured to generate an interface request in response to a triggering operation on a target page element in the menu page;

[0038] A sending module is used to send the interface request to the back-end server, wherein a filter is set between the back-end server and the front-end server, and the filter is used to intercept the interface request and determine the interface permission set that matches the interface request, and determine the target access permission of the target interface indicated by the interface request based on the association relationship between the preset interface and the interface access permission. When the interface permission set includes the target access permission, the interface request is sent to the back-end server.

[0039] In addition, to achieve the above-mentioned purpose, the present application also proposes a filter, which includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the permission verification method described above.

[0040] In addition, to achieve the above-mentioned purpose, the present application also proposes a front-end server, which includes: a memory, a processor, and a computer program stored on the memory and runnable on the processor, and the computer program is configured to implement the steps of the permission verification method described above.

[0041] In addition, to achieve the above-mentioned purpose, the present application also proposes a storage medium, which is a computer-readable storage medium. A computer program is stored on the storage medium, and when the computer program is executed by the processor, the steps of the permission verification method described above are implemented.

[0042] In addition, to achieve the above-mentioned purpose, the present application also provides a computer program product, which includes a computer program. When the computer program is executed by a processor, it implements the steps of the permission verification method described above.

[0043] One or more technical solutions proposed in this application have at least the following technical effects: intercepting the interface request generated and sent by the front-end server in response to the triggering operation of the target page element in the menu interface through a filter; since the interface request can reflect the relevant information of the user who triggered the request, the interface permission set that matches the request can be determined based on the interface request, and the interface permission set can indicate the back-end interface that the user has the right to access; then, through the interface association relationship between the preset interface and the interface access permission, the target access permission of the target interface indicated by the interface request is determined, and the target access permission reflects the access permission required for the user to request the target interface; then, the interface permission can be quickly verified by matching the interface permission set and the target access permission. If the interface permission set contains the target access permission, it means that the user has the right to access the target interface, and the interface request can be sent to the back-end server to complete the response to the interface request triggered by the user. This application realizes the unified management and control of interface access permissions by setting the association relationship between the interface and the interface access permission, thereby improving the efficiency of permission control. In addition, this application can perform permission verification through a filter independent of the back-end server, without modifying the back-end code, thereby improving the efficiency of permission verification. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0045] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0046] Figure 1 A flowchart of the first embodiment of the method for verifying application permissions is provided;

[0047] Figure 2 This is a general diagram of the interface authority control provided in Example 2 of this application;

[0048] Figure 3 A schematic diagram of the permission verification process applied to a filter provided in Example 3 of the present application;

[0049] Figure 4 This is a schematic diagram of the module structure of a permission verification device for this application;

[0050] Figure 5 A schematic diagram of the module structure of another permission verification device for this application;

[0051] Figure 6 A schematic diagram of the device structure of the hardware operating environment of the filter involved in the permission verification method in the embodiment of the present application;

[0052] Figure 7 This is a schematic diagram of the device structure of the hardware operating environment of the front-end server involved in the permission verification method in the embodiment of the present application. DETAILED DESCRIPTION

[0053] It should be understood that the specific embodiments described herein are merely used to explain the technical solutions of the present application and are not intended to limit the present application.

[0054] In order to better understand the technical solution of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.

[0055] Since the current common back-end interface permission control solutions are all implemented based on annotations, annotations are added to the corresponding back-end interfaces with permission character parameters. This method of adding annotations to interfaces is highly invasive to business codes. Especially when performing permission control on an already developed application system, it is necessary to add annotations to all interfaces that require permissions. This not only brings a lot of workload and reduces the efficiency of permission control, but also easily affects the stability of the original system and violates the open-closed principle.

[0056] The present application provides a solution, which is applied to filters. First, it intercepts the interface request generated and sent by the front-end server in response to the trigger operation for the target page element in the menu interface. Since the interface request can reflect the relevant information of the user who triggered the request, the interface permission set that matches the request can be determined based on the interface request, and the interface permission set can indicate the back-end interface that the user has the right to access. Furthermore, through the interface association relationship between the preset interface and the interface access permission, the target access permission of the target interface indicated by the interface request is determined, and the target access permission reflects the access permission required for the user to request the target interface. Then, the interface permission can be quickly verified by matching the interface permission set and the target access permission. If the interface permission set contains the target access permission, it means that the user has the right to access the target interface. After determining that the permission verification of the interface request has passed, the interface request can be sent to the back-end server to complete the response to the interface request triggered by the user. The present application manages the association relationship between the interface and the interface access permission through a filter independent of the back-end server. The permission control of the back-end interface can be completed without coupling with the business back-end code, thereby improving the efficiency of permission control.

[0057] It should be noted that the execution subject of this embodiment can be a computing service device with data processing, network communication and program running functions, such as a tablet computer, personal computer, mobile phone, etc., or a front-end server that can realize the above functions.

[0058] The following uses the filter as the execution subject to illustrate this embodiment and the following embodiments. Based on this, the embodiment of the present application provides a permission verification method, referring to Figure 1 , Figure 1 This is a flowchart of the first embodiment of the permission verification method of this application.

[0059] In this embodiment, the permission verification method includes steps S10 to S40:

[0060] Step S10: intercepting an interface request sent by the front-end server, wherein the interface request is generated by the front-end server in response to a triggering operation on a target page element in the menu interface;

[0061] In one feasible embodiment, [1] a menu page is displayed through a front-end server. The menu page can be any interactive interface including page elements. Then, in response to the user's triggering operation on the target page element in the menu page, the front-end server generates an interface request for the back-end interface corresponding to the target page element, and sends the interface request to the back-end server, expecting a response from the back-end server. However, a filter is set between the front-end server and the back-end server. The filter is used to intercept the interface request sent by the front-end server to the back-end server, verify the interface authority of the user who triggered the interface request, and prevent the user from illegally calling the back-end interface. The filter successfully separates the interface authority verification from the back-end business code, which facilitates the unified management and control of the interface authority and improves the efficiency of authority control.

[0062] Exemplarily, the filter may be deployed on a gateway.

[0063] Step S20, determining the interface permission set that matches the interface request;

[0064] In a feasible embodiment, after intercepting the interface request sent by the front-end server, the filter determines which interfaces the current user has access rights to based on the user information in the interface request, and obtains an interface permission set for subsequent interface permission verification. The interface permission set can be expressed in the form of data, queues, linked lists, etc.

[0065] For example, the filter is configured with a permission management table that stores the mapping between user IDs and backend interfaces to which the user has access rights. The filter can determine the permission characters of the backend interfaces that the user can access by matching the user ID, and then obtain the interface permission set.

[0066] Step S30, determining the target access permission of the target interface indicated by the interface request according to the association relationship between the preset interface and the interface access permission;

[0067] It should be noted that the association relationship between the interface and the interface access rights can be presented in the form of a database table, etc., to facilitate user configuration and management.

[0068] In a feasible embodiment, after intercepting the interface request sent by the front-end server, the filter can determine the target interface indicated in the interface request based on the request address and request method in the interface request; and then can determine the access rights of the target interface based on the association between the preset interface and the interface access rights.

[0069] For example, before the permission check, the user needs to enter the interface comparison table on the filter, and match the request address, request method and back-end interface one by one, so that the filter can determine the target interface indicated by the interface request. For example, after intercepting the interface request sent by the front-end server, the filter parses the request address and request method from it; then, based on the interface comparison table, it determines whether the request address has a unique corresponding back-end interface. If so, it determines it as the target interface of the interface request; if not, it further matches according to the request method to determine the target interface; then, based on the association between the preset interface and the interface access permission, it can determine the target access permission of the target interface. The matching order of the above request address and request method is not fixed.

[0070] Exemplarily, the page path identifier can be further extracted from the request address, and the path identifier can be assigned a permission character. For example, for the homepage of the ordering system, the user has access rights to all back-end interfaces corresponding to the triggered operations in the page. The interface requests for the same page in the URL often have the same part, which is determined as the page path identifier, such as http: / / order.com / home, and the identifier is assigned a permission character. After intercepting the interface request, the filter first filters the request method, and then extracts the page path identifier from the request address. If the page path identifier has a unique corresponding permission character, the permission character is determined as the target access permission character of the target interface, thereby realizing permission management of all interfaces in the page, thereby improving the efficiency of permission control.

[0071] For example, the target interface can also be determined based on the request header information (such as Content-Type, etc.) in the interface request. For example, the filter is configured with a resource interface comparison table, and the filter can determine a unique target interface based on the data resource expected to be obtained in the request header information.

[0072] It is understandable that when the backend interface changes, users can adjust the interface permissions by modifying the association between the interface and the interface access rights without modifying the business code, thereby achieving non-invasive interface permission control and improving the efficiency of permission control.

[0073] Step S40: When the interface permission set includes the target access permission, an interface request is sent to the backend server.

[0074] If the interface permission set that matches the interface request contains the access rights for the target interface, it indicates that the user who triggered the interface request has the permission to access the corresponding backend interface. Therefore, if the interface permission set contains the target access rights, the filter determines that the permission check for the intercepted interface request has passed and forwards the interface request to the backend server, so that the backend server can respond to the interface request sent by the front-end server.

[0075] This embodiment provides a permission verification method, which uses a filter to perform permission verification on intercepted interface requests to reduce the risk of users illegally accessing the back-end interface; and uses a filter independent of the back-end server to manage the association between the interface and the interface access rights, avoiding direct modification of the corresponding back-end business code, thereby achieving unified management and non-intrusive control of back-end interface permissions, thereby improving the efficiency of permission control.

[0076] Based on the first embodiment of the present application, in the second embodiment of the present application, the same or similar contents as those in the above-mentioned embodiment 1 can be referred to the above introduction and will not be repeated hereafter. On this basis, step S20 includes:

[0077] Step S21, determining the role information requested by the interface;

[0078] For example, after intercepting the interface request sent by the front-end server, the filter can determine the user ID by parsing the authentication information of the interface request, and then query the user role comparison table to determine the user's current role information based on the user ID; it can also read the session information in the interface request and then determine the user's role information from historical session data based on the session information.

[0079] Step S22: Determine the interface permission set based on the role information.

[0080] In one feasible embodiment, the user's role information can be used to determine which backend interfaces the current role has access to. Furthermore, based on the association between the preset role and the interface access permissions, the current role's interface permission set can be determined and used as the current user's interface permission set. The association between the role and the interface access permissions can be stored in a database table or other form.

[0081] For example, in addition to role information, you can further obtain the attribute information of the current interface request (such as geographic location, operation time, etc.), and determine the interface permission set based on the user's role information, attribute information and preset permission rules. For example, the permission rules stipulate that ordinary employees (role information) only have the right to access the query interface (target interface) during non-working hours (attribute information). Then, after intercepting the interface request sent by the employee to the back-end server through the front-end server during non-working hours, the filter performs a permission query and finds that it only has the right to access the query interface. The interface request to access the query interface is forwarded to the back-end server, other interface requests are not responded to, and a prompt message is sent to the front-end server.

[0082] In this embodiment, by introducing role information, the interface permissions of different users belonging to the same role can be managed in a unified manner, which simplifies the configuration and update process of permissions for each user, thereby improving the efficiency of permission control.

[0083] In a feasible implementation, step S22 includes:

[0084] Step S24: determining the page element permission set based on the role information;

[0085] It should be noted that the page element permission set refers to a set of triggering permissions that a user has for page elements of a menu page of a front-end server.

[0086] Step S25: Determine the interface permission set based on the page element permission set.

[0087] In a feasible embodiment, based on the role to which the current user belongs and the page elements that the current role can trigger, the permission characters of the page elements that the current user can trigger are determined to obtain a page element permission set; then, based on the page element permission set and the association between the page elements and the interface access rights, the permission characters of the back-end interfaces that the current user can access are determined to obtain an interface permission set, thereby realizing the binding of the page elements of the front-end server and the back-end interface of the back-end server.

[0088] For example, please refer to Figure 2 , Figure 2An overall schematic diagram of interface permission control is provided. Each user has a corresponding role. The menu page of the current user can be determined based on the user's role information. The menu page includes a directory, a function menu, and page elements. The directory and function menu can be switched by clicking on the front-end layout elements without interacting with the back-end server. The page elements are bound to the back-end interface. The page elements that the current user can trigger can be determined based on the user's role information, and then the back-end interface that the user can access can be determined. That is, the interface permission can be determined based on the page element permission, and finally an association relationship between user-role-page element-interface is formed.

[0089] In this implementation, by binding the front-end page elements and the back-end interface, the interface permissions are quickly determined. Based on the adjustment of the page element permissions, the interface permissions will also be adjusted accordingly without the need for users to manually adjust them separately. This ensures the consistency of page element permissions and interface permissions, while improving the efficiency of permission control.

[0090] Based on the first embodiment and / or the second embodiment of the present application, in the third embodiment of the present application, the same or similar contents as those in the first and second embodiments above can be referred to above and will not be described in detail.

[0091] Step A10: When the backend interface of the backend server is updated, the association relationship between the interface and the interface access authority is modified according to the change of the backend interface.

[0092] In one feasible embodiment, the filter monitors the backend interface configuration of the backend server. When an update of the backend interface is detected, the association between the interface and the interface access rights is automatically modified according to the changes in the backend interface, such as addition, deletion, interface name modification, etc.

[0093] Exemplarily, when the backend interface is deleted or the interface name is modified, the corresponding backend interface in the association relationship is automatically deleted or the name of the corresponding backend interface in the association relationship is modified.

[0094] For example, when a backend interface is added, the corresponding backend interface is automatically added to the association relationship, and the access permission character of the interface is randomly generated; subsequent users can query the association relationship and assign the access permission character of the newly added port to the user or role.

[0095] In this embodiment, the interface permissions are automatically updated by modifying the association between the interface and the interface access rights. There is no need to adjust the backend business code, and there is no need to recompile and deploy the business code, which reduces the user's configuration time and improves the control efficiency of the interface permissions.

[0096] In a feasible implementation manner, after step S10, the method further includes:

[0097] Step S01, determining the target interface indicated by the interface request;

[0098] Step S02: If the preset interface library does not contain the target interface, process the interface request according to the preset rules;

[0099] For example, the preset interface library includes backend interfaces that have been entered in the filter. According to the preset processing rules, during the development and testing phase of the server, the filter intercepts interface requests for backend interfaces that have not been entered, skips the permission check for the interface requests, and forwards them normally to the backend server so that developers can carry out related development and testing work normally; during the operation phase of the server, if the filter intercepts interface requests for backend interfaces that have not been entered, it indicates that there may be a user attempting to illegally attack the backend server. Therefore, the filter can reject the user's access request and output an alarm message. This embodiment does not specifically limit how to set the processing rules.

[0100] Step S03: When the interface library contains the target interface, a step of determining an interface permission set that matches the interface request is executed.

[0101] For example, in order to help understand the implementation process of the permission verification method applied to the filter obtained by combining this embodiment with the above embodiment 1, please refer to Figure 3Specifically: the filter executes step S101 to intercept the interface request sent by the front-end server; S102, determines the target interface according to the request address and request method in the interface request; S103, determines whether the preset interface library contains the target interface; if the interface library does not contain the target interface, the filter executes step S104 to process the interface request according to the preset rules, and the processing methods include skipping the check, denying access, etc.; if the interface library contains the target interface, the filter executes step S105 to determine the interface permission set that the interface request matches, and the interface permission set contains the permission characters of the back-end interface that the user can access; S106, determines the interface permission set according to the preset rules. The association relationship between the interface and the interface access permission character determines the access permission character of the target interface; S107, determines whether the user's interface permission set contains the access permission character; when the user's interface permission set does not contain the access permission character, that is, the permission verification fails, the filter executes step S108, outputs a prompt message, and prompts the management personnel that there is currently no permission access so that timely investigation can be carried out; when the user's interface permission set contains the access permission character, that is, the permission verification passes, the filter executes step S109, sends the intercepted interface request to the back-end server, so that the back-end server responds to the interface request, and sends the response information to the front-end server.

[0102] In this embodiment, by determining in advance whether the back-end server contains the target interface and then deciding whether to perform permission verification based on the determination result, the workload of the filter is reduced and the working efficiency of the filter is improved.

[0103] Based on the first embodiment, the second embodiment and / or the third embodiment of the present application, in the fourth embodiment of the present application, the same or similar contents as those in the first embodiment, the second embodiment and the third embodiment can be referred to above and will not be described in detail. The following describes this embodiment by taking the front-end server as the execution subject as an example. On this basis, the permission verification method includes steps E10 to E30:

[0104] Step E10: displaying a menu page, wherein the menu page includes at least one page element;

[0105] In a feasible embodiment, in order to facilitate user operation, the front-end server displays a menu page, which refers to an interactive interface including at least one page element, and the page element refers to the interactive element on the web page or application interface, including but not limited to menus, buttons, links, etc. within the page.

[0106] Step E20, generating an interface request in response to a triggering operation on a target page element in the menu page;

[0107] Exemplarily, the front-end server uses event monitoring technology to capture the user's triggering operations on the page elements in the menu page, such as clicking, dragging and dropping, sliding, etc., and determines the page elements triggered by the user as the target page elements. Then, based on the relevant configuration of the target page elements and the data resources provided by the user, an interface request is generated. The interface request includes the request address, request method, request header and request body (data resources), etc.

[0108] Step E30, sending an interface request to the back-end server, wherein a filter is set between the back-end server and the front-end server, the filter is used to intercept the interface request and determine the interface permission set that matches the interface request, and determine the target access permission of the target interface indicated by the interface request based on the association relationship between the preset interface and the interface access permission. When the interface permission set includes the target access permission, the interface request is sent to the back-end server.

[0109] In this embodiment, the front-end server generates an interface request based on the user's trigger operation on the page element, converts the user operation into a form that the machine can understand, and sends the interface request to the back-end server to facilitate the back-end server to respond to the user operation.

[0110] In a feasible implementation manner, after step E10, the method further includes:

[0111] Step E11: determining a page element permission set that matches the user identifier based on the acquired user identifier, and determining the page elements included in the page element permission set as operable page elements;

[0112] In one feasible embodiment, the user ID of the current user is obtained based on the user's login information; then, based on the user ID, the page elements that the current user can access or operate are determined from a preset user permission library to obtain the page element permission set of the current user.

[0113] For example, role information can also be introduced to divide users into roles, and the same role can access or operate the same page elements. The front-end server determines the role information of the current user based on the obtained user identifier, and then determines the page element permission set of the current user based on the role information. This user-role-page element association facilitates the permission management of page elements for different users. By simply modifying the page element permission corresponding to the role, the page element permissions of all users belonging to the role can be adjusted, thereby improving the control efficiency of page element permissions.

[0114] Step E12: displaying operable page elements in the menu page; or,

[0115] Step E13: In the menu page, the operable page elements are displayed separately from other elements in the menu page.

[0116] Exemplarily, the front-end server determines the operable page elements that the current user is authorized to trigger or interact with based on the page element permission set, and renders these operable page elements, so that all page elements on the current menu interface can be triggered or interacted with by the current user; or, the operable page elements are rendered with a color, size, etc. that is different from other page elements in the menu page, so as to distinguish the displayed operable page elements from other elements in the menu page in the menu page, so that the user can judge whether he has the authority to interact by the display method of the page elements in the display interface.

[0117] Exemplarily, before sending an interface request, the user's page element triggering permission can be verified through the page element permission set. For example, a mobile phone number query webpage displays a name input box, a query button, and a new button, and the second permission character corresponding to the query button is a. The front-end server determines the user's page element permission set for the webpage based on the identification information of the user logging into the webpage. If there is no character a in the list, the user's triggering operation on the query button will not be responded to; if the list contains character a, the front-end server will convert the triggering operation for the query button into an interface request, and send the interface request to the back-end server, so that the back-end server responds to the interface request. By verifying the user's page element triggering permission through the front-end server, it is ensured that only users with corresponding permissions can trigger specific functions, thereby realizing access control for front-end page elements.

[0118] In this embodiment, by providing a customized display interface for the user, it is convenient for the user to clearly understand the permissions he has and perform related operations, thereby improving the user experience.

[0119] It should be noted that the above examples are only used to understand this application and do not constitute a limitation on the permission verification method of this application. More simple transformations based on this technical concept are all within the scope of protection of this application.

[0120] This application also provides a permission verification device, please refer to Figure 4 , the permission verification device is applied to the filter, and the device includes:

[0121] A request interception module 10 is used to intercept an interface request sent by a front-end server, wherein the interface request is generated by the front-end server in response to a triggering operation on a target page element in a menu interface;

[0122] A set determination module 20 is used to determine the interface permission set that matches the interface request;

[0123] The permission determination module 30 is used to determine the target access permission of the target interface indicated by the interface request based on the association relationship between the preset interface and the interface access permission;

[0124] The request sending module 40 is configured to send an interface request to a backend server when the interface permission set includes the target access permission.

[0125] The permission verification device provided in the embodiments of the present application, which employs the permission verification method of the above-described embodiments, can solve the technical problem of how to improve the efficiency of permission control. Compared with the prior art, the beneficial effects of the permission verification device provided in the present application are the same as those of the permission verification method provided in the above-described embodiments, and the other technical features of the permission verification device are the same as those disclosed in the above-described embodiments and are not further described here.

[0126] This application embodiment also provides another permission verification device, please refer to Figure 5 , the permission verification device is applied to the filter, and the device includes:

[0127] A display module 50 is used to display a menu page, wherein the menu page includes at least one page element;

[0128] A generating module 60 is configured to generate an interface request in response to a triggering operation on a target page element in a menu page;

[0129] The sending module 70 is used to send an interface request to the back-end server, wherein a filter is set between the back-end server and the front-end server, and the filter is used to intercept the interface request and determine the interface permission set that matches the interface request. According to the association relationship between the preset interface and the interface access permission, the target access permission of the target interface indicated by the interface request is determined. When the interface permission set includes the target access permission, the interface request is sent to the back-end server.

[0130] The permission verification device provided in the embodiments of the present application, which employs the permission verification method of the above-described embodiments, can solve the technical problem of how to improve the efficiency of permission control. Compared with the prior art, the beneficial effects of the permission verification device provided in the present application are the same as those of the permission verification method provided in the above-described embodiments, and the other technical features of the permission verification device are the same as those disclosed in the above-described embodiments and are not further described here.

[0131] An embodiment of the present application provides a filter, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the permission verification method in the above-mentioned embodiment one.

[0132] Reference below Figure 6 , which shows a schematic diagram of a filter structure suitable for implementing embodiments of the present application. The filters in the embodiments of the present application can include, but are not limited to, mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), and in-vehicle terminals (e.g., in-vehicle navigation terminals), as well as fixed terminals such as digital TVs and desktop computers. Figure 6 The filter shown is only an example and should not limit the functions and scope of use of the embodiments of the present application.

[0133] like Figure 6 As shown, the filter may include a processing device 1001 (e.g., a central processing unit, graphics processing unit, etc.), which can perform various appropriate actions and processes based on programs stored in read-only memory (ROM) 1002 or programs loaded from storage device 1003 into random access memory (RAM) 1004. RAM 1004 also stores various programs and data required for filter operation. Processing device 1001, ROM 1002, and RAM 1004 are interconnected via bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems may be connected to I / O interface 1006: input devices 1007, such as a touchscreen, touchpad, keyboard, mouse, image sensor, microphone, accelerometer, gyroscope, etc.; output devices 1008, such as a liquid crystal display (LCD), speaker, vibrator, etc.; storage device 1003, such as a magnetic tape or hard disk; and communication device 1009. Communication device 1009 can allow the filter to communicate with other devices wirelessly or wired to exchange data. Although the figure shows a filter with various systems, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems can be implemented or have instead.

[0134] In particular, according to the embodiments disclosed in the present application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, the embodiments disclosed in the present application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program comprising program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network via a communication device, or installed from a storage device 1003, or installed from a ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0135] The filter provided in the embodiments of this application utilizes the permission verification method of the aforementioned embodiments to solve the technical problem of improving the efficiency of permission control. Compared to the prior art, the filter provided in this application has the same beneficial effects as the permission verification method provided in the aforementioned embodiments, and the other technical features of this filter are the same as those disclosed in the aforementioned embodiments, and are not further described here.

[0136] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0137] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

[0138] An embodiment of the present application also provides a front-end server, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the permission verification method in the above-mentioned embodiment one.

[0139] Reference below Figure 7, which shows a schematic diagram of the structure of a front-end server suitable for implementing the embodiments of the present application. The front-end server in the embodiments of the present application may include, but is not limited to, mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), in-vehicle terminals (such as in-vehicle navigation terminals), and fixed terminals such as digital TVs and desktop computers. Figure 7 The front-end server shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of the present application.

[0140] like Figure 7 As shown, the front-end server may include a processing device 2001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes based on programs stored in a read-only memory (ROM) 2002 or programs loaded from a storage device 2003 into a random access memory (RAM) 2004. RAM 2004 also stores various programs and data required for front-end server operations. Processing device 2001, ROM 2002, and RAM 2004 are interconnected via a bus 2005. An input / output (I / O) interface 2006 is also connected to the bus. Typically, the following systems may be connected to I / O interface 2006: input devices 2007, such as a touchscreen, touchpad, keyboard, mouse, image sensor, microphone, accelerometer, gyroscope, etc.; output devices 2008, such as a liquid crystal display (LCD), speaker, vibrator, etc.; storage devices 2003, such as a magnetic tape or hard disk; and communication devices 2009. Communication device 2009 can allow front-end server to carry out wireless or wired communication with other equipment to exchange data.Although the figure shows the front-end server with various systems, it should be understood that it is not required to implement or have all the systems shown.Can implement or have more or less systems alternatively.

[0141] In particular, according to the embodiments disclosed in the present application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, the embodiments disclosed in the present application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program comprising program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network via a communication device, or installed from a storage device 2003, or installed from a ROM 2002. When the computer program is executed by the processing device 2001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0142] The front-end server provided in the embodiment of the present application adopts the permission verification method in the above embodiment to solve the technical problem of how to improve the efficiency of permission control. Compared with the existing technology, the beneficial effects of the front-end server provided in the present application are the same as the beneficial effects of the permission verification method provided in the above embodiment, and the other technical features of the front-end server are the same as those disclosed in the method of the previous embodiment, which will not be repeated here.

[0143] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0144] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

[0145] An embodiment of the present application provides a computer-readable storage medium having computer-readable program instructions (ie, a computer program) stored thereon, the computer-readable program instructions being used to execute the permission verification method in the above-mentioned embodiment.

[0146] The computer-readable storage medium provided in the embodiments of the present application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems or devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In this embodiment, the computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system or device. The program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination thereof.

[0147] The computer-readable storage medium may be included in the filter and / or the front-end server; or may exist independently without being assembled into the filter and / or the front-end server.

[0148] The above-mentioned computer-readable storage medium carries one or more programs. When the above-mentioned one or more programs are executed by the filter, the filter: intercepts the interface request sent by the front-end server, wherein the interface request is generated by the front-end server in response to a trigger operation for a target page element in a menu interface; determines the interface permission set that matches the interface request; determines the target access permission of the target interface indicated by the interface request based on the association relationship between the preset interface and the interface access permission; and sends the interface request to the back-end server when the interface permission set includes the target access permission.

[0149] The above-mentioned computer-readable storage medium carries one or more programs. When the above-mentioned one or more programs are executed by the front-end server, the front-end server: displays a menu page, wherein the menu page includes at least one page element; generates an interface request in response to a trigger operation on a target page element in the menu page; sends the interface request to the back-end server, wherein a filter is set between the back-end server and the front-end server, and the filter is used to intercept the interface request and determine the interface permission set that matches the interface request, and determine the target access permission of the target interface indicated by the interface request based on the association relationship between the preset interface and the interface access permission, and send the interface request to the back-end server when the interface permission set includes the target access permission.

[0150] Computer program code for performing the operations of the present application may be written in one or more programming languages, or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a stand-alone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0151] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present application. In this regard, each box in the flow chart or block diagram can represent a module, program segment or a part of code, and the module, program segment or a part of code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order than that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flow chart, and the combination of the boxes in the block diagram and / or flow chart can be implemented by a dedicated hardware-based system that performs the specified function or operation, or can be implemented by a combination of dedicated hardware and computer instructions.

[0152] The modules described in the embodiments of the present application may be implemented in software or hardware, wherein the name of a module does not necessarily limit the unit itself.

[0153] The computer-readable storage medium provided in the embodiments of this application stores computer-readable program instructions (i.e., a computer program) for executing the aforementioned permission verification method, thereby solving the technical problem of improving the efficiency of permission control. Compared to the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as those of the permission verification method provided in the aforementioned embodiments, and are not further elaborated here.

[0154] An embodiment of the present application further provides a computer program product, including a computer program, which implements the steps of the above-mentioned permission verification method when executed by a processor.

[0155] The computer program product provided in the embodiments of this application can solve the technical problem of how to improve the efficiency of permission control. Compared with the prior art, the beneficial effects of the computer program product provided in this application are the same as the beneficial effects of the permission verification method provided in the above embodiments, and will not be repeated here.

[0156] The above description is only part of the embodiments of the present application and does not limit the patent scope of the present application. All equivalent structural transformations made by using the contents of the present application specification and drawings under the technical concept of the present application, or direct / indirect application in other related technical fields are included in the patent protection scope of the present application.

Claims

1. A permission verification method, characterized in that: The permission verification method is applied to a filter and a front-end server, wherein the filter is arranged between the front-end server and the back-end server, and the method includes: The front-end server displays a menu page, wherein the menu page includes at least one page element; The front-end server determines, based on the acquired user identifier, a page element permission set that matches the user identifier, and determines the page elements included in the page element permission set as operable page elements; The front-end server displays the operable page elements in the menu page, or displays the operable page elements separately from other elements in the menu page; The front-end server generates an interface request in response to a triggering operation on a target page element in the menu page; The front-end server determines whether the target user indicated by the user identifier has the triggering permission for the target page element through the page element permission set; The front-end server sends the interface request to the back-end server when the target user has the triggering authority of the target page element; The filter intercepts the interface request sent by the front-end server; The filter determines the role information corresponding to the interface request; The filter determines the page element permission set based on the role information; The filter determines the interface permission set that matches the interface request based on the page element permission set; The filter determines the target access permission of the target interface indicated by the interface request according to the association relationship between the preset interface and the interface access permission; The filter sends the interface request to the backend server when the interface permission set includes the target access permission.

2. The permission verification method according to claim 1, wherein: The method further comprises: When the backend interface of the backend server is updated, the filter modifies the association relationship between the interface and the interface access authority according to the change of the backend interface.

3. The permission verification method according to claim 1, wherein: After the step of intercepting the interface request sent by the front-end server, the method further includes: The filter determines the target interface indicated by the interface request; The filter processes the interface request according to preset rules when the preset interface library does not contain the target interface; In the case that the interface library contains the target interface, the filter performs the step of determining the interface permission set that matches the interface request.

4. A filter, characterized in that: The filter includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the permission verification method according to any one of claims 1 to 3.

5. A front-end server, characterized in that: The front-end server includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the permission verification method according to any one of claims 1 to 3.

6. A storage medium, characterized in that The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the permission verification method according to any one of claims 1 to 3 are implemented.

Images