Webpage authentication method and device, electronic equipment, storage medium and program product

Abstract

The invention provides a webpage authentication method and device, electronic equipment, a storage medium and a program product. The method comprises the following steps: in response to a calling request which is initiated in a front-end webpage and is used for calling a client method, sending a permission acquisition request to a client through the front-end webpage; the client generates authentication information corresponding to the front-end webpage based on the permission acquisition request, and sends the authentication information to the front-end webpage; the front-end webpage initiates a calling request to the client based on the authentication information; and the client performs permission verification based on the authentication information, calls and executes a client method based on the call request to obtain call data after the verification is passed, and returns the call data to the front-end webpage. According to the webpage authentication method and device, the electronic equipment, the storage medium and the program product, the authentication information is actively acquired by the front end in the permission verification process, the problem of network interception injection is avoided, and the webpage authentication method and device are suitable for scenes where network interception cannot be achieved.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to a webpage authentication method, device, electronic device, storage medium, and program product. Background Art

[0002] Currently, the interactive communication bridge between the client and the front-end web page mainly relies on the communication bridge (JsBridge). In the method of using the communication bridge to interact with the client and the front-end web page, it is necessary to authenticate the front-end web page.

[0003] Related technologies can be used to authenticate based on URLs or by injecting tokens through network interception. However, URL-based authentication is less secure. Some web pages cannot be intercepted through network interception technology, so authentication based on injecting tokens through network interception cannot be used. Summary of the Invention

[0004] In view of this, the purpose of the present disclosure is to provide a webpage authentication method, device, electronic device, storage medium and program product.

[0005] Based on the above objectives, the first aspect of the present disclosure provides a webpage authentication method, comprising:

[0006] In response to a call request for calling a client method initiated in a front-end webpage, sending a permission acquisition request to the client through the front-end webpage;

[0007] The client generates authentication information corresponding to the front-end webpage based on the permission acquisition request, and sends the authentication information to the front-end webpage;

[0008] The front-end webpage initiates the call request to the client based on the authentication information;

[0009] The client performs permission verification based on the authentication information, and after the verification is passed, calls and executes the client method based on the call request to obtain call data, and returns the call data to the front-end webpage.

[0010] In some embodiments, the method further comprises:

[0011] The front-end webpage triggers a preset authentication information acquisition protocol through a preset webpage function processing method to generate the permission acquisition request.

[0012] In some embodiments, the webpage function processing method includes:

[0013] Method used to display a dialog box to prompt the user for input.

[0014] In some embodiments, the front-end webpage is a main webpage or a nested webpage; the client generates authentication information corresponding to the front-end webpage based on the permission acquisition request, and sends the authentication information to the front-end webpage, including:

[0015] The client obtains the URL information of the main webpage or nested webpage that sends the permission acquisition request, generates the authentication information based on the URL information through the client authentication information management component, and sends the authentication information to the main webpage or nested webpage that sends the permission acquisition request.

[0016] In some embodiments, the client performs permission verification based on the authentication information, including:

[0017] The client obtains corresponding website information from the client authentication information management component based on the authentication information, and performs authority verification according to the website information.

[0018] In some embodiments, the front-end webpage is a nested webpage; the front-end webpage initiates the call request to the client based on the authentication information, including:

[0019] generating a webpage identifier for the nested webpage;

[0020] The front-end webpage initiates the call request to the client based on the authentication information and the webpage identifier.

[0021] In some embodiments, returning the call data to the front-end webpage includes:

[0022] If the client detects the existence of the webpage identifier, the client encrypts the call data based on the authentication information to obtain encrypted call data, and sends the encrypted call data to the nested webpage.

[0023] In some embodiments, sending the encrypted call data to the nested webpage includes:

[0024] The client broadcasts the encrypted call data and the webpage identifier;

[0025] The nested webpage obtains the encrypted call data based on the webpage identifier, and decrypts the encrypted call data according to the authentication information to obtain the call data.

[0026] In some embodiments, the call request is a call request based on a communication bridge;

[0027] The front-end webpage initiates the call request through a hook call interface.

[0028] In some embodiments, the method further comprises:

[0029] In response to a second call request for calling a client method initiated in the front-end webpage, intercepting the second call request by the client;

[0030] The client generates authentication information corresponding to the front-end webpage based on the second call request, and injects the authentication information into the intercepted return information through the webpage editing code;

[0031] The front-end webpage obtains the authentication information based on the interception return information, and initiates the second call request to the client based on the authentication information;

[0032] The client performs permission verification based on the authentication information, and after the verification is passed, calls and executes the client method based on the second call request to obtain call data, and returns the call data to the front-end webpage.

[0033] A second aspect of the present disclosure provides a webpage authentication device, comprising:

[0034] The sending module is configured to: in response to a call request for calling a client method initiated in a front-end webpage, send a permission acquisition request to the client through the front-end webpage;

[0035] A generating module configured to: generate, by the client, authentication information corresponding to the front-end webpage based on the permission acquisition request, and send the authentication information to the front-end webpage;

[0036] An initiating module is configured to: the front-end webpage initiates the call request to the client based on the authentication information;

[0037] The calling module is configured to: the client performs permission verification based on the authentication information, and after the verification is passed, calls and executes the client method based on the calling request to obtain calling data, and returns the calling data to the front-end webpage.

[0038] A third aspect of the present disclosure provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the webpage authentication method as described in the first aspect when executing the computer program.

[0039] A fourth aspect of the present disclosure provides a non-transitory computer-readable storage medium, wherein the non-transitory computer-readable storage medium stores computer instructions, and the computer instructions are used to enable the computer to execute the webpage authentication method described in the first aspect.

[0040] A fifth aspect of the present disclosure provides a computer program product, comprising computer program instructions, which, when executed on a computer, enable the computer to execute the webpage authentication method as described in the first aspect.

[0041] From the above, it can be seen that the web page authentication method, device, electronic device, storage medium and program product provided by the present disclosure, when the front-end web page needs to call the client method, the front-end web page first sends a permission acquisition request to the client to obtain the authentication information corresponding to the front-end web page from the client; when the front-end web page initiates a call request to the client, it can carry the authentication information for the client to perform permission verification on the front-end web page, and complete the call if the permission verification passes; the permission verification is only for the authentication information, and does not distinguish whether the front-end web page is the main web page or the nested web page, which simplifies the authentication logic and improves the maintainability of the system; in the process of permission verification, the front end actively obtains the authentication information, avoiding the problem of network interception injection, and is suitable for scenarios where network interception cannot be passed. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the technical solutions in the present disclosure or related technologies, the following briefly introduces the drawings required for use in the embodiments or related technical descriptions. Obviously, the drawings described below are only embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0043] Figure 1 A schematic diagram showing an exemplary system provided by an embodiment of the present disclosure is shown.

[0044] Figure 2 A flowchart of an exemplary method provided by an embodiment of the present disclosure is shown.

[0045] Figure 3 A flowchart of another exemplary method provided by an embodiment of the present disclosure is shown.

[0046] Figure 4 A flowchart of another exemplary method provided by an embodiment of the present disclosure is shown.

[0047] Figure 5 A schematic diagram of an exemplary device provided by an embodiment of the present disclosure is shown.

[0048] Figure 6 A schematic diagram of the hardware structure of an exemplary computer device provided by an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0049] In order to make the objectives, technical solutions and advantages of the present disclosure more clearly understood, the present disclosure is further described in detail below in conjunction with specific embodiments and with reference to the accompanying drawings.

[0050] It should be noted that, unless otherwise defined, the technical terms or scientific terms used in the embodiments of the present disclosure should have the usual meanings understood by people with ordinary skills in the field to which the present disclosure belongs. The "first", "second" and similar words used in the embodiments of the present disclosure do not indicate any order, quantity or importance, but are only used to distinguish different components. "Include" or "comprise" and similar words mean that the elements or objects appearing before the word include the elements or objects listed after the word and their equivalents, without excluding other elements or objects. "Connect" or "connected" and similar words are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. "Up", "down", "left", "right" and the like are only used to indicate relative position relationships. When the absolute position of the described object changes, the relative position relationship may also change accordingly.

[0051] It is understandable that before using the technical solutions of each embodiment of the present disclosure, the type, scope of use, usage scenarios, etc. of the personal information involved will be informed to the user in an appropriate manner, and the user's authorization will be obtained.

[0052] For example, in response to a user's active request, a prompt message is sent to the user to clearly inform the user that the requested operation will require the acquisition and use of the user's personal information. This allows the user to independently choose whether to provide personal information to the electronic device, application, server, storage medium, or other software or hardware that performs the operation of the disclosed technical solution based on the prompt message.

[0053] As an optional but non-limiting implementation, in response to a user's active request, the prompt information may be sent to the user in the form of a pop-up window, in which the prompt information may be presented in text form. Furthermore, the pop-up window may also contain a selection control for the user to select "agree" or "disagree" to provide personal information to the electronic device.

[0054] It is understandable that the above notification and user authorization process are merely illustrative and do not constitute a limitation on the implementation of the present disclosure. Other methods that comply with relevant laws and regulations may also be applied to the implementation of the present disclosure.

[0055] Figure 1 FIG. 1 is a schematic diagram of an exemplary system 100 provided by an embodiment of the present disclosure.

[0056] like Figure 1As shown, system 100 can be used to implement interactive functions between a client and a front-end web page, and can include terminal devices 102A and 104A, a server 106, and a database server 108. A medium (e.g., a network) providing a communication link can be included between terminal devices 102A and 104A and server 106 and database server 108. The network can include various connection types, such as wired or wireless communication links or fiber optic cables.

[0057] Various applications (APPs) or software can be installed on the terminal devices 102A and 104A, such as project management applications or software, collaborative office applications or software, image processing applications or software, video conferencing applications or software, reading applications or software, video applications or software, social applications or software, payment applications or software, web browsers and instant messaging tools, etc.

[0058] The terminal devices 102A and 104A herein can be either hardware or software. When the terminal devices 102A and 104A are hardware, they can be various electronic devices with display screens, including but not limited to smartphones, tablet computers, e-book readers, MP3 players, laptop computers, and desktop computers (PCs). When the terminal devices 102A and 104A are software, they can be installed in the electronic devices listed above. They can be implemented as multiple software programs or software modules (for example, to provide distributed services), or as a single software program or software module. This is not specifically limited here.

[0059] Server 106 may be a server that provides various services, such as a backend server that supports various applications displayed on terminal devices 102A and 104A. Database server 108 may also be a database server that provides various services. It is understood that if server 106 can perform the relevant functions of database server 108, database server 108 may not be provided in system 100.

[0060] The server 106 and database server 108 herein can also be hardware or software. When they are hardware, they can be implemented as a distributed server cluster consisting of multiple servers, or as a single server. When they are software, they can be implemented as multiple software programs or software modules (for example, to provide distributed services), or as a single software program or software module. No specific limitations are imposed herein.

[0061] It should be noted that the information processing method provided in the embodiment of the present disclosure can be executed by the server 106. It should be understood that Figure 1The numbers of terminal devices, users, servers and database servers in the embodiment are merely illustrative. Any number of terminal devices, users, servers and database servers may be provided as required.

[0062] In some embodiments, the terminal devices 102A and 104A include a front-end and a client. The front-end refers to the user interface portion of the software application, and the client refers to the mobile terminal portion of the software application. The front-end and the client cooperate to implement the interaction between the application or software and the user on the terminal devices 102A and 104A.

[0063] The interactive communication bridge between the client and the front end mainly depends on the communication bridge (JsBridge).

[0064] JSBridge is an interface for communication between the front-end (i.e., JavaScript, web pages) and the native side on platforms like Android and iOS. In cross-side development, HTML5 (a language for describing web content) often leverages on-side capabilities to enhance web pages, such as opening native pages on the end and accessing end-side app or user information. The native side also frequently needs to push events and callback information to the web page.

[0065] JSBridge communication methods: Taking Android as an example, common JSBridge communications include Uniform Resource Locator (URL) interception. When a URL with a specific scheme jumps, it can be monitored by the web view (webview)'s shouldOverrideUrlLoading method; prompt, which can be monitored by the webview's onJsPrompt method; console.log, which can be monitored by the webview's onConsoleMessage method; JavaScriptInterface, which can inject an object into the window through the webview.addJavascriptInterface method. Object-related function calls will be automatically mapped to the client-side code.

[0066] Authentication and authorization: Authentication verifies the identity of the claimant, while authorization verifies the authenticity of the identity and rights claimed by the claimant. In mainstream mobile apps, JSBridge typically provides numerous methods at the underlying layer, including many sensitive methods. Developers prefer to restrict access to these sensitive methods to specific whitelisted pages, so they typically implement authorization on the web page. Authentication is typically achieved through a unique, immutable URL identifying the web page.

[0067] In related technologies, JSBridge authentication is mainly implemented based on the following two methods:

[0068] 1. URL-based authentication: The client determines the page source based on the URL currently loaded by WebView and decides whether to allow JSBridge calls accordingly.

[0069] This method is simple to implement, but it cannot handle scenarios such as forgery and page jumps, and has low security.

[0070] 2. Authentication based on network interception and token injection: The client intercepts page requests at the network layer and injects JavaScript code containing a token into the returned HTML. When the page calls JSBridge, it must carry this token. The client verifies the token's validity before allowing the call.

[0071] This method is highly secure, but in some special cases, the main document of the page cannot be intercepted through network interception technology due to security and compliance requirements. In such scenarios where the main document cannot be intercepted through the network, the page cannot obtain a valid token and thus cannot call the JSBridge function normally.

[0072] At the same time, in related technologies, when the front-end web page includes both the main page (mainframe) and the nested page (iframe), the iframe still uses the mainframe for authentication when calling JSBridge. However, the iframe cannot obtain the mainframe's token data, and the client cannot accurately confirm whether the JSBridge call is actually from the iframe. This leads to the following security risks: the iframe cannot independently obtain a valid token, affecting functional use; the client cannot distinguish the call source, which may lead to permission confusion; the mainframe may hijack the iframe's callback data, causing data leakage.

[0073] In addition, the related technology still has the following problems:

[0074] (1) Inaccurate iframe identification: The client identifies iframes by determining whether the response is HTML, which is not accurate enough. For example, when the iframe loads the URL "aaa.com? redirect=xx.com", the response obtained is the HTML resource of xx.com, but because it is intercepted by the network, WebView will mistakenly believe that the real domain name is aaa.com.

[0075] (2) Token may be obtained illegally: The front-end can directly obtain HTML through network request methods such as Fetch. If the client mistakenly judges it as an iframe and injects the token, the front-end can directly parse and obtain the token data, resulting in security risks.

[0076] In view of this, embodiments of the present disclosure provide a webpage authentication method to solve or partially solve the above-mentioned problem.

[0077] like Figure 2 As shown, the webpage authentication method includes:

[0078] Step S101 , in response to a call request for calling a client method initiated in a front-end webpage, a permission acquisition request is sent to the client via the front-end webpage.

[0079] The front end may include only the main web page, or may include the main web page and at least one nested web page.

[0080] The main web page is the outermost HTML page loaded in the WebView. It is the entry point for the entire web content.

[0081] Nested web pages are pages that are nested using HTML <iframe>The tag is another independent HTML document (page) embedded inside the main web page.

[0082] In this embodiment, whether the front-end webpage includes only the main webpage or includes both the main webpage and the nested webpage, when inputting the call request, the permission acquisition request can be first sent to the client through the front-end webpage.

[0083] The method of calling the request can be understood as a request for calling a client method initiated by the front-end webpage to the client when the front-end webpage and the client establish a JsBridge connection. Optionally, the calling request can include a request method. In the embodiment of the present disclosure, the request method can be a client method.

[0084] In some embodiments, the call request is a call request based on JsBridge.

[0085] In some embodiments, the front-end web page initiates a permission acquisition request through the front-end software development kit (JavaScript Software Development Kit, JSSDK).

[0086] Step S103: The client generates authentication information corresponding to the front-end webpage based on the permission acquisition request, and sends the authentication information to the front-end webpage.

[0087] In this embodiment, after the client receives the permission acquisition request, it generates authentication information corresponding to the front-end webpage based on the permission acquisition request. Wherein, the authentication information may include a token, an authentication certificate, etc., which is not limited in this embodiment.

[0088] After generating the authentication information, the client sends the authentication information to the front-end web page, which can save the authentication information so that authentication can be performed based on the authentication information when executing the call request.

[0089] In some embodiments, the front-end web page receives and saves the authentication information through the front-end software development tool kit, and the authentication information is the authentication information corresponding to the web page of the input call request.

[0090] Step S105, the front-end webpage initiates the call request to the client based on the authentication information.

[0091] In this embodiment, the front-end webpage initiates the call request to the client. When initiating the call request, it also carries the authentication information.

[0092] Step S107, the client performs permission verification based on the authentication information, and after the verification is passed, calls and executes the client method based on the call request to obtain call data, and returns the call data to the front-end webpage.

[0093] The client receives the call request, obtains authentication information and performs permission verification based on the authentication information.

[0094] After verification, the client executes the corresponding native function and generates call data, and then returns the call data to the front-end web page. The front-end web page receives the call data and sends the call data to the business callback function.

[0095] In some embodiments, the front-end web page initiates the call request through the front-end software development toolkit, and receives the call data through the front-end software development toolkit when the call data is returned, and then passes the call data to the business callback function through the front-end software development toolkit.

[0096] In this embodiment, when the front-end web page needs to call the client method, the front-end web page first sends a permission acquisition request to the client to obtain authentication information corresponding to the front-end web page from the client; when the front-end web page initiates a call request to the client, it can carry the authentication information for the client to perform permission verification on the front-end web page, and complete the call if the permission verification passes; the permission verification is only based on the authentication information, and does not distinguish whether the front-end web page is the main web page or the nested web page, which simplifies the authentication logic and improves the maintainability of the system; in the process of permission verification, the front end actively obtains the authentication information, avoiding the problem of network interception injection, and is suitable for scenarios that cannot be intercepted through the network.

[0097] In some embodiments, the method further includes: the front-end web page triggers a preset authentication information acquisition protocol through a preset web page function processing method to generate the permission acquisition request.

[0098] In this embodiment, an authentication information acquisition protocol can be pre-set, and a preset web page function processing method is used to trigger the authentication information acquisition protocol, thereby generating a permission acquisition request.

[0099] In some embodiments, the preset web page function processing method may be an existing method. For example, the method may be localStorage and sessionStorage for implementing local storage.

[0100] In some embodiments, the preset web page function processing method may be a method for displaying a dialog box to prompt the user to input information, namely, window.prompt.By triggering the authentication information acquisition protocol through window.prompt, there is no cross-domain restriction, which can reduce the complexity of implementation.

[0101] In this embodiment, the authentication information acquisition protocol may include:

[0102] The front end calls the prompt function and passes in a specific string to mark the authentication information acquisition protocol;

[0103] The client intercepts the prompt call and, when it detects the specific string, executes the authentication information acquisition method defined in the protocol to obtain the authentication information and returns the authentication information to the caller of the prompt, i.e., the front-end web page. Otherwise, the web page view will process the prompt function by default.

[0104] When the front end calls the JSB method, it needs to pass in two parameters: the web page identifier of the nested web page, which is used to identify this call; and authentication information;

[0105] After the client completes the operation, it needs to return the result to the front end. If it contains a web page identifier of a nested web page, the result is sent to the nested web page via broadcast (postMessage); otherwise, the JSB call data is directly called back.

[0106] In this embodiment, authentication information is actively obtained through window.prompt, which avoids the problem of network interception and injection, and is suitable for scenarios where network interception is not possible.

[0107] In some embodiments, the front-end web page is a main web page or a nested web page.

[0108] The front end may include only the main web page, or may include the main web page and at least one nested web page at the same time.

[0109] When the front end includes only the main web page, the caller of the call request, i.e., the front end web page, is the main web page. When the front end includes both the main web page and the nested web page, the caller of the call request, i.e., the front end web page, can be either the main web page or the nested web page.

[0110] In step S103, the client generates authentication information corresponding to the front-end web page based on the permission acquisition request, and sends the authentication information to the front-end web page, including: the client obtains the URL information of the main web page or nested web page that sends the permission acquisition request, generates the authentication information based on the URL information through the client authentication information management component, and sends the authentication information to the main web page or nested web page that sends the permission acquisition request.

[0111] Among them, the website information can be a Uniform Resource Locator (URL).

[0112] As shown in Figure 3 and Figure 4, when the front-end web page sends a permission acquisition request to the client, it sends the URL of the main web page or the nested web page that sends the permission acquisition request to the client. The client sends this URL to the client authentication information management component (TokenManager). The client authentication information management component generates authentication information based on this URL, such as a token (Token), and sends this authentication information to the client. The client then sends this authentication information to the front-end web page. Then the main web page or the nested web page that sends this permission acquisition request, that is, the caller of the call request, can keep this authentication information for subsequent processing of the call request.

[0113] In some embodiments, if the front-end web page is a web page in the main document scenario, when the main web page needs to call a client method, first determine whether there is authentication information corresponding to the main web page in the current environment. If not, obtain the authentication information through prompt and then make the call; if it exists, there is no need to obtain the authentication information, and the call can be directly made after authentication based on the authentication information.

[0114] In some embodiments, if the front-end web page is a web page in the nested web page scenario, when the nested web page needs to call a client method, synchronously call prompt to obtain the authentication information and then make the call.

[0115] In some embodiments, the client performs permission verification based on the authentication information in step S107, including: the client obtains the corresponding website information from the client authentication information management component based on the authentication information, and performs permission verification according to the website information.

[0116] When the front-end web page发起 a call request to the client, it will carry authentication information. The client receives this call request and queries the URL from the client authentication information management component based on the authentication information; if the URL does not exist, the permission verification fails. If the URL exists, the client authentication information management component returns this URL to the client.The client performs authentication based on this URL.

[0117] As shown in Figure 3, if the front-end web page is the main web page, after the permission verification passes, the client calls and executes the client method based on the call request to obtain call data, and returns the call data to the front-end web page.

[0118] In some embodiments, the front-end web page is a nested web page; the front-end web page发起所述调用请求 to the client based on the authentication information in step S105 includes:

[0119] Step S301, generating a web page identifier for the nested web page.

[0120] As shown in Figure 4, if the front-end web page is a nested web page, a web page identifier iframe_id of the nested web page is generated.

[0121] Step S303, the front-end web page发起所述调用请求 to the client based on the authentication information and the web page identifier.

[0122] When the nested web page发起 a call request to the client, it carries the authentication information Token and the web page identifier iframe_id of the nested web page at the same time. The client receives this call request, queries the URL from the client authentication information management component based on the authentication information; if the URL does not exist, the permission verification fails. If the URL exists, the client authentication information management component returns the URL to the client. The client performs permission verification based on this URL.

[0123] After the permission verification passes, the client calls and executes the client method based on the call request to obtain call data, and then returns the call data to the front-end web page.

[0124] In some embodiments, returning the call data to the front-end web page includes: if the client detects the existence of the web page identifier, encrypting the call data based on the authentication information to obtain encrypted call data, and sending the encrypted call data to the nested web page. It should be noted that there seems to be an unclear expression "发起所述调用请求" in the original text. You may need to check and clarify this part for a more accurate translation. The above translation is based on the existing text as much as possible.

[0125] As shown in Figure 4, when the client determines that there is a web page identifier iframe_id for a nested web page, it indicates that the caller's front-end web page is a nested web page. When the call data of the nested web page is returned to the nested web page, it needs to pass through the main web page. To prevent the main web page from hijacking the call data, the call data needs to be encrypted.

[0126] In some embodiments, the client may use the authentication information as a key and encrypt the call data using a symmetric encryption method to obtain encrypted call data, and then return the encrypted call data to the nested web page to ensure data security.

[0127] Among them, the symmetric encryption method may include methods such as AES-GCM, AES-CBC, ChaCha20-Poly1305, etc.

[0128] In some embodiments, an asymmetric encryption method such as RSA may also be used to encrypt the call data. Among them, the client uses the public key for encryption and the front end uses the private key for decryption.

[0129] In some embodiments, the call data may also be transmitted through the HTTP protocol, relying on the encryption mechanism of the HTTP protocol to protect the transmission of the call data.

[0130] In some embodiments, the sending of the encrypted call data to the nested web page includes:

[0131] Step S401, the client broadcasts the encrypted call data and the web page identifier.

[0132] Step S403, the nested web page obtains the encrypted call data based on the web page identifier, decrypts the encrypted call data according to the authentication information, and obtains the call data.

[0133] In this embodiment, once the URL of the nested web page changes, it cannot be correctly called back to the corresponding nested web page.Therefore, in this embodiment, the encrypted call data and the web page identifier iframe_id are sent by broadcasting (postMessage) to achieve secure cross-frame communication; the front-end software development toolkit of the front-end web page is matched based on the web page identifier iframe_id of the current web page and the iframe_id received by broadcasting. If there is a match, it means that the encrypted call data is the data returned by the call request initiated by the current nested web page. The encrypted call data is then decrypted based on the authentication information of the current nested web page, and after the decryption is completed, it is called back to the business callback.

[0134] In some embodiments, the front-end web page initiates the call request through the hook call interface provided by the front-end software development tool kit, ensuring that the web page identifier iframe_id and authentication information Token of the nested web page are carried during the call, thereby enhancing the security of the call.

[0135] In some embodiments, the method further comprises:

[0136] In response to a second call request for calling a client method input on a front-end webpage, intercepting the second call request by the client;

[0137] the client generates authentication information corresponding to the front-end webpage based on the second call request, and injects the authentication information into the intercepted return information through the webpage editing code;

[0138] The front-end webpage obtains the authentication information based on the interception return information, and initiates the second call request to the client based on the authentication information;

[0139] The client performs authority verification based on the authentication information, and after the verification is passed, calls and executes the client method based on the second call request to obtain call data, and returns the call data to the front-end web page.

[0140] In this embodiment, before the web page view of the front-end web page loads the page, the client intercepts the second call request and generates a corresponding authentication information Token for the front-end web page, and injects a Javascript code containing the authentication information Token into the interception return information returned. The front-end web page obtains the authentication information Token through the injected Javascript code, carries the authentication information Token when calling, so that the client can perform permission verification based on the authentication information Token. After the verification is passed, the client calls and executes the client method based on the second call request to obtain call data, and returns the call data to the front-end web page.

[0141] In this embodiment, the method of injecting authentication information Token based on network interception is combined with the method of actively obtaining authentication information through prompt, thereby satisfying the permission verification when the front-end web page calls the client method.

[0142] It should be noted that the method of the embodiment of the present disclosure can be performed by a single device, such as a computer or server. The method of this embodiment can also be applied to a distributed scenario and completed by multiple devices cooperating with each other. In the case of such a distributed scenario, one of the multiple devices can only perform one or more steps in the method of the embodiment of the present disclosure, and the multiple devices will interact with each other to complete the described method. It should be noted that the above describes some embodiments of the present disclosure. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the above embodiments and still achieve the desired results. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0144] Based on the same inventive concept, corresponding to any of the above-mentioned embodiment methods, the present disclosure also provides an interactive device between a client and a front end.

[0145] Referring to <a href='javascript:;' class="see-img-anchor" img-id="HDA00054797138100000In some embodiments , the calling module 17 is further configured to:

[0157] The client obtains the corresponding website information from the client authentication information management component based on the authentication information, and performs authority verification according to the website information.

[0158] In some embodiments, the front-end webpage is a nested webpage; the initiating module 15 is further configured to:

[0159] Generating a webpage identifier for the nested webpage;

[0160] The front-end web page initiates the call request to the client based on the authentication information and the web page identifier. In some embodiments , the calling module 17 is further configured to:

[0162] If the client detects the existence of the web page identifier, the call data is encrypted based on the authentication information to obtain encrypted call data, and the encrypted call data is sent to the nested web page.

[0163] In some embodiments, sending the encrypted call data to the nested web page includes:

[0164] The client broadcasts the encrypted call data and the web page identifier;

[0165] The nested web page obtains the encrypted call data based on the web page identifier, decrypts the encrypted call data according to the authentication information, and obtains the call data.

[0166] In some embodiments, the call request is a call request based on a communication bridge;

[0167] The front-end web page initiates the call request through the hook call interface.

[0168] In some embodiments, the device is further configured to:

[0169] In response to a second call request for invoking a client method input on the front-end web page, intercept the second call request through the client;

[0170] The client generates authentication information corresponding to the front-end web page based on the second call request, and injects the authentication information into the intercepted return information through web editing code;

[0171] The front-end web page obtains the authentication information based on the intercepted return information, and发起 the second call request to the client based on the authentication information;

[0172] The client performs permission verification based on the authentication information, and after the verification passes, invokes and executes the client method based on the second call request to obtain call data, and returns the call data to the front-end web page.

[0173] For the convenience of description, when describing the above device, various modules are described separately according to their functions. Of course, when implementing the present disclosure, the functions of each module can be implemented in the same or multiple software and / or hardware.

[0174] The device in the above embodiment is used to implement the corresponding method in any of the foregoing embodiments, and has the beneficial effects of the corresponding method embodiments, which will not be elaborated herein.

[0175] Based on the same inventive concept, corresponding to the method in any of the above embodiments, the present disclosure further provides an electronic device, including a memory, a processor, and a computer program stored on the memory and executable on the processor. When the processor executes the program, it implements the method in any of the above embodiments.

[0176] Figure 6 shows a more specific schematic diagram of the hardware structure of the electronic device provided in this embodiment. The device may include: a processor 1010, a memory 1020, an input / output interface 1030, a communication interface 1040, and a bus 1050. Among them, the processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040 are communicatively connected to each other inside the device through the bus 1050.

[0177] The processor 1010 can be implemented using a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this specification. The memory 1020 can be implemented in the form of ROM (Read Only Memory, read-only memory), RAM (Random Access Memory, random access memory), static storage device, dynamic storage device, etc. The memory 1020 can store an operating system and other application programs. When the technical solution provided by the embodiment of this specification is realized by software or firmware, the relevant program code is stored in the memory 1020 and called by the processor 1010 for execution. The input / output interface 1030 is used to connect an input / output module to implement information input and output. The input / output module can be configured as a component in the device (not shown in the figure), or it can be externally connected to the device to provide corresponding functions. The input device may include a keyboard, a mouse, a touch screen, a microphone, various sensors, etc., and the output device may include a display, a speaker, a vibrator, an indicator light, etc. The communication interface 1040 is used to connect a communication module (not shown) to enable communication interaction between the device and other devices. The communication module can communicate via a wired mode (e.g., USB, network cable, etc.) or a wireless mode (e.g., mobile network, WIFI, Bluetooth, etc.).

[0181] The bus 1050 comprises a pathway for transmitting information between the various components of the device (eg, the processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040). It should be noted that, although the above- mentioned device only shows the processor 1010, the memory 1020, the input / output interface 1030, the communication interface 1040 and the bus 1050, in the specific implementation process, the device may also include other components necessary for normal operation. In addition, it will be understood by those skilled in the art that the above-mentioned device may also only include the components necessary for implementing the embodiment of this specification, without having to include all the components shown in the figure.

[0183] The electronic device of the above embodiment is used to implement the corresponding method in any of the above embodiments, and has the beneficial effects of the corresponding method embodiment, which will not be repeated here.

[0184] Based on the same inventive concept, corresponding to any of the above-mentioned embodiment methods, the present disclosure also provides a non-transitory computer-readable storage medium, wherein the non-transitory computer-readable storage medium stores computer instructions, and the computer instructions are used to enable the computer to execute the method described in any of the above embodiments. The computer - readable medium of the present embodiment includes permanent and non-permanent, removable and non-removable media and can realize information storage by any method or technology.Information can be computer-readable instructions, data structure, module of program or other data.Examples of computer storage media include, but are not limited to phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, read-only compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassette, magnetic tape magnetic disk storage or other magnetic storage device or any other non-transmission medium, which can be used to store information that can be accessed by a computing device.

[0186] The computer instructions stored in the storage medium of the above embodiment are used to enable the computer to execute the method described in any of the above embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0187] Based on the same inventive concept, corresponding to any of the above-mentioned embodiments, the present disclosure further provides a computer program product, which includes a computer program. In some embodiments, the computer program is executable by one or more processors so that the processors execute the method described. Corresponding to the execution subject corresponding to each step in each embodiment of the method, the processor that executes the corresponding step may belong to the corresponding execution subject.

[0188] The computer program product of the above embodiment is used to enable the processor to execute the method described in any of the above embodiments, and has the beneficial effects of the corresponding method embodiment, which will not be repeated here.

[0189] Those skilled in the art will appreciate that the embodiments of the present disclosure may be implemented as a system, method, or computer program product.Therefore, the present disclosure may be embodied in the following forms: entirely in hardware, entirely in software (including firmware, resident software, microcode, etc.), or a combination of hardware and software, generally referred to herein as a "circuit," "module," or "system." Furthermore, in some embodiments, the present disclosure may be embodied in the form of a computer program product embodied in one or more computer-readable media, wherein the computer-readable media contains computer-readable program code. Any combination of one or more computer-readable media can be adopted.Computer-readable media can be computer-readable signal media or computer-readable storage media.Computer-readable storage media can be, for example, but not limited to, a system, device or component of electricity, magnetism, light, electromagnetic, infrared or semiconductor, or any combination thereof. A more specific example (non-exhaustive example) of computer-readable storage media can for example include: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device or any suitable combination thereof. In this document, a computer-readable storage medium can be any tangible medium comprising or storing a program, which can be used or used in combination with an instruction execution system, a device or a device.

[0191] A computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, wherein the computer-readable program code is carried. The data signal propagated may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. The computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0192] The program code contained on the computer readable medium can be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical cable, RF, etc., or any suitable combination of the above.

[0193] Computer program code for performing operations of the present disclosure may be written in one or more programming languages, or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages.The program code may execute entirely on the user's computer, partially on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer, or entirely on the remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider). Should be understood that each square frame in flow chart and / or block diagram and the combination of each square frame in flow chart and / or block diagram can be realized by computer program instructions.These computer program instructions can be provided for the processor of general-purpose computer, special-purpose computer or other programmable data processing device, thereby produce a kind of machine, these computer program instructions are carried out by computer or other programmable data processing device, have produced the device of function / operation stipulated in the square frame in realization flow chart and / or block diagram.

[0195] These computer program instructions may also be stored in a computer-readable medium that enables a computer or other programmable data processing device to operate in a specific manner, such that the instructions stored in the computer-readable medium produce a product that includes an instruction device that implements the functions / operations specified in the blocks in the flowchart and / or block diagram.

[0196] Computer program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device so that a series of operational steps are performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, such that the instructions executed on the computer or other programmable device provide a process that implements the functions / operations specified in the blocks in the flowchart and / or block diagram. In addition , although the operation of the disclosed method is described in a particular order in the accompanying drawings, this does not require or imply that these operations must be performed in this particular order, or that all the operations shown must be performed to achieve the desired result. On the contrary, the steps described in the flow chart can change the order of execution. Additionally or alternatively, some steps can be omitted, multiple steps can be merged into one step and / or one step can be decomposed into multiple steps and executed.

[0198] The flowcharts and block diagrams in the accompanying drawings illustrate the possible implementation architectures, functions, and operations of the systems, methods, and computer program products according to various embodiments of the present application.Wherein, each box in the flow chart or block diagram can represent a module, program segment or a part of code, and the part of the above-mentioned module, program segment or code comprises one or more executable instructions for realizing the logical function of regulation.It should also be noted that in some as replacement implementations, the function annotated in the box can also occur in a sequence different from that annotated in the accompanying drawings.For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, which depends on the function involved.It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart, can be realized by a special hardware-based system that performs the function or operation of regulation, or can be realized by a combination of special hardware and computer instructions. It should be noted that although mentioned some modules or the unit of the equipment for action execution in the above detailed description, this division is not mandatory.In fact, according to the embodiment of the application, the feature and function of two or more modules described above or units can be concretized in a module or unit.On the contrary, the feature and function of a module described above or units can be further divided into and concretized by multiple modules or units.

[0200] A person of ordinary skill in the art should understand that the discussion of any of the above embodiments is merely illustrative and is not intended to imply that the scope of the present disclosure (including the claims) is limited to these examples. Under the concept of the present disclosure, the technical features in the above embodiments or different embodiments may also be combined, the steps may be implemented in any order, and there are many other variations of different aspects of the embodiments of the present disclosure as described above, which are not provided in detail for the sake of simplicity. In addition, for simplifying explanation and discussion, and in order not to make the disclosed embodiment difficult to understand, can show or can not show the known power supply / ground connection with integrated circuit (IC) chip and other parts in the accompanying drawings provided.In addition, can show device in the form of block diagram, so as to avoid making the disclosed embodiment difficult to understand, and this also considers following fact, promptly the details about the embodiment of these block diagram devices are highly dependent on the platform that will implement the disclosed embodiment (that is, these details should be fully within the scope of understanding of those skilled in the art). In the case of describing specific details (for example, circuit) to describe exemplary embodiments of the present disclosure, it is obvious to those skilled in the art that, can implement the disclosed embodiment in the absence of these specific details or when these specific details have variation.Therefore, these descriptions should be considered to be illustrative rather than restrictive.

[0202] Although the present disclosure has been described in conjunction with specific embodiments thereof, many replacements, modifications, and variations of these embodiments will be apparent to those skilled in the art based on the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) may utilize the embodiments discussed.

[0203] The embodiments of the present disclosure are intended to encompass all such substitutions, modifications, and variations that fall within the broad scope of the appended claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the embodiments of the present disclosure should be included within the scope of protection of the present disclosure.< / iframe>

Claims

1. A webpage authentication method, comprising: In response to a call request for calling a client method initiated in a front-end webpage, sending a permission acquisition request to the client through the front-end webpage; The client generates authentication information corresponding to the front-end webpage based on the permission acquisition request, and sends the authentication information to the front-end webpage; The front-end webpage initiates the call request to the client based on the authentication information; The client performs permission verification based on the authentication information, and after the verification is passed, calls and executes the client method based on the call request to obtain call data, and returns the call data to the front-end webpage.

2. The method according to claim 1, further comprising: The front-end webpage triggers a preset authentication information acquisition protocol through a preset webpage function processing method to generate the permission acquisition request.

3. The method according to claim 2, wherein: The webpage function processing method includes: Method used to display a dialog box to prompt the user for input.

4. The method according to claim 1, wherein The front-end webpage is a main webpage or a nested webpage; the client generates authentication information corresponding to the front-end webpage based on the permission acquisition request, and sends the authentication information to the front-end webpage, including: The client obtains the URL information of the main webpage or nested webpage that sends the permission acquisition request, generates the authentication information based on the URL information through the client authentication information management component, and sends the authentication information to the main webpage or nested webpage that sends the permission acquisition request.

5. The method according to claim 4, wherein The client performs permission verification based on the authentication information, including: The client obtains corresponding website information from the client authentication information management component based on the authentication information, and performs authority verification according to the website information.

6. The method according to claim 4, wherein: The front-end web page is a nested web page; The front-end webpage initiates the call request to the client based on the authentication information, including: generating a webpage identifier for the nested webpage; The front-end webpage initiates the call request to the client based on the authentication information and the webpage identifier.

7. The method according to claim 6, wherein: The step of returning the call data to the front-end webpage includes: If the client detects the existence of the webpage identifier, the client encrypts the call data based on the authentication information to obtain encrypted call data, and sends the encrypted call data to the nested webpage.

8. The method according to claim 7, further comprising: The client broadcasts the encrypted call data and the webpage identifier; The nested webpage obtains the encrypted call data based on the webpage identifier, and decrypts the encrypted call data according to the authentication information to obtain the call data.

9. The method according to claim 1, wherein The calling request is a calling request based on a communication bridge; The front-end webpage initiates the call request through a hook call interface.

10. The method according to any one of claims 1 to 9, further comprising: In response to a second call request for calling a client method initiated in the front-end webpage, intercepting the second call request by the client; The client generates authentication information corresponding to the front-end webpage based on the second call request, and injects the authentication information into the intercepted return information through the webpage editing code; The front-end webpage obtains the authentication information based on the interception return information, and initiates the second call request to the client based on the authentication information; The client performs permission verification based on the authentication information, and after the verification is passed, calls and executes the client method based on the second call request to obtain call data, and returns the call data to the front-end webpage.

11. A webpage authentication device, comprising: The sending module is configured to: in response to a call request for calling a client method initiated in a front-end webpage, send a permission acquisition request to the client through the front-end webpage; A generating module configured to: generate, by the client, authentication information corresponding to the front-end webpage based on the permission acquisition request, and send the authentication information to the front-end webpage; An initiating module is configured to: the front-end webpage initiates the call request to the client based on the authentication information; The calling module is configured to: the client performs permission verification based on the authentication information, and after the verification is passed, calls and executes the client method based on the calling request to obtain calling data, and returns the calling data to the front-end webpage.

12. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the webpage authentication method according to any one of claims 1 to 10 when executing the computer program.

13. A non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to cause the computer to execute the webpage authentication method according to any one of claims 1 to 10.

14. A computer program product, characterized in that The method comprises computer program instructions, which, when executed on a computer, enable the computer to execute the webpage authentication method according to any one of claims 1 to 10.

Images