Method for realizing interface authentication based on Springboot aspect

Abstract

The invention provides a method for realizing interface authentication based on a Springboot aspect, and relates to the technical field of computer data authority verification, and the method comprises the following steps: S1, defining a user-defined annotation at a server, and declaring at least one attribute for authentication dimension configuration; and S2, marking the user-defined annotation on a service interface method needing to be authenticated, and assigning a value to the attribute so as to declare the dimension required by authentication and the parameter key corresponding to the dimension. According to the method, multi-dimensional authentication can be supported in a mode of customizing the permission dimension, if expansion is needed, the permission dimension can be automatically added in a section interface class, and single-dimension or multi-dimension joint authentication is supported; according to the method, the authentication dimension is declarated through the predefined custom annotation hard code, the aspect can directly position and obtain the corresponding parameter value according to the key name during execution, the method thoroughly avoids the situation that the whole request parameter list needs to be traversed in a traditional authentication scheme, and the system performance is improved.

Description

Technical Field

[0001] This invention relates to the field of computer data permission verification technology, specifically a method for implementing interface authentication based on Spring Boot aspects. Background Technology

[0002] In a front-end / back-end separated software development model, applications typically need to receive HTTP / S requests from various clients, identify the purpose of each request, and provide feedback. Only requests deemed correct are allowed to proceed. If client requests are not rigorously authenticated, and the application does not perform corresponding verification, there is a risk of data leakage. Existing mainstream technologies mostly use simple, single authentication methods, which suffer from limitations in feature updates and are applicable to all services, not specific services. Based on these considerations, this invention proposes integrating Spring Boot's aspect modules to implement multi-dimensional, complex authentication functionality for a specific service. Summary of the Invention

[0003] To address the shortcomings of existing technologies, this invention provides a method for implementing interface authentication based on Spring Boot aspects. This method can perform multi-dimensional and complex authentication filtering on all client requests, thereby avoiding unauthorized requests.

[0004] To achieve the above objectives, the present invention provides the following technical solution:

[0005] A method for implementing interface authentication based on Spring Boot aspects includes the following steps:

[0006] S1. Define a custom annotation on the server side, which declares at least one attribute for configuring authentication dimensions;

[0007] S2. Mark the custom annotation on the business interface method that requires authentication and assign attribute values ​​to declare the dimensions required for authentication and their corresponding parameter keys.

[0008] S3. Define an aspect class that is configured to intercept all methods annotated with custom annotations; when the client calls the business interface, the aspect class is triggered before the business method is executed;

[0009] S4. The aspect class executes authentication logic; specifically including:

[0010] S41. Parse the custom annotation and obtain at least one parameter key declared therein;

[0011] S42. Based on the parameter key, directly obtain the corresponding parameter value from the parameters requested by the client, and use it as the authentication value;

[0012] S43. Parse the client's access credentials to obtain user identity information;

[0013] S44. Compare the user identity information with the authentication value;

[0014] S45. If the comparison is successful, the business method is allowed to continue execution; if the comparison fails, an exception is thrown and access is denied.

[0015] Preferably, the authentication dimension attributes include at least one of "User ID", "Project ID", "Enterprise ID", "Unit ID", and "Role".

[0016] Preferably, in step S4, the client's access credentials are JWT tokens carried in the HTTP request header, and the user identity information is obtained by parsing the JWT token.

[0017] Preferably, in step S3, parsing the authentication dimension configuration of the aspect class and obtaining at least one parameter key includes: obtaining the parameter list of the business interface method through the aspect parameter JoinPoint, and directly locating and obtaining the corresponding parameter value from the parameter list based on the parameter key obtained from the custom annotation.

[0018] Preferably, the custom annotation limits its target to a method and specifies that it takes effect at runtime.

[0019] Preferably, in step S3, the interception of methods annotated by the custom annotation is specified by marking the methods in the aspect class with the @Before advice annotation and configuring the pointcut expression as @annotation.

[0020] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the above-described method.

[0021] The present invention also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the above-described method.

[0022] This invention provides a method for implementing interface authentication based on Spring Boot aspects. It has the following beneficial effects:

[0023] (1) This invention can support multi-dimensional authentication by customizing the permission dimension (mainly by comparing the personnel-related parameters in the request with the personnel-related parameters reserved in the system). If expansion is needed, it can be added in the aspect interface class and supports single-dimensional or multi-dimensional joint authentication.

[0024] (2) The Spring Boot aspect implementation method in this invention is convenient for users to plug and play, with low intrusion into existing business. Existing interfaces that require authentication can simply be referenced directly without adding any additional code. The way to import it is to directly add "@CheckQx(String userId,bool role.......)" above the interface. This method provides convenience for implementing authentication in old systems.

[0025] (3) In this invention, authentication dimensions (parameter keys) are declared by hard-coding predefined custom annotations. When the aspect is executed, it can directly locate and obtain the corresponding parameter value based on this key name. This method completely avoids the performance overhead caused by traversing the entire request parameter list (including Header, URL, Body, etc.) in traditional authentication schemes. Especially in high-concurrency scenarios with a large number of parameters and frequent interface calls, it can significantly reduce CPU computing time, significantly shorten request response time, and improve the overall throughput of the system. Attached Figure Description

[0026] Figure 1 This is a flowchart illustrating the method for implementing interface authentication based on Spring Boot aspects according to the present invention. Detailed Implementation

[0027] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0028] Example 1:

[0029] This embodiment provides a method for implementing interface authentication based on Spring Boot aspects, and its process is as follows: Figure 1 As shown, the main steps include:

[0030] S101: Define custom annotations

[0031] First, define a custom annotation named CheckQx. This annotation is configured using Java meta-annotations:

[0032] Using @Target(ElementType.METHOD) specifies that this annotation can only be used at the method level.

[0033] The `@Retention(RetentionPolicy.RUNTIME)` annotation is used to specify that the annotation is retained at JVM runtime, so it can be read through reflection.

[0034] Inside this annotation, declare the authentication dimension attributes supported by this scheme; these attributes are hardcoded in the annotation as key-value pairs.

[0035] S102: Add annotations to business interface methods

[0036] In a standard Spring Boot @RestController class, the business method that requires authentication is annotated with the @CheckQx annotation defined in step S101, and its properties are assigned specific instructions.

[0037] The meaning of this configuration is:

[0038] userId = "userId": This declares that the method has an input parameter named userId, which needs to be authenticated with the current user's identity.

[0039] projectId = "projectId": This declares that the method has an input parameter named projectId, which needs to be authenticated with the project to which the current user belongs.

[0040] role = "admin": This declares that the user calling this method must have the admin role.

[0041] If corpId and sectionId are not set, it means that authentication is not performed on these two dimensions.

[0042] S103: Define and configure aspect classes

[0043] Define an aspect implementation class, `AspectCheckQxAspect`, and register it as a Spring container-managed bean using the `@Component` annotation. This class precisely intercepts all methods annotated with `@CheckQx` through `@Before` advice and pointcut expressions.

[0044] S104: Parse annotations and parameters to obtain the weight to be evaluated.

[0045] In the doBefore method, all the information required for authentication is parsed through the JoinPoint parameter.

[0046] Parse annotation configuration: Obtain the method signature through joinPoint.getSignature(), then obtain the @CheckQx annotation instance on the method, and read the pre-configured authentication key, such as userId, projectId, role, etc.

[0047] Directly retrieve parameter values: Use `joinPoint.getArgs()` to retrieve all input parameters of the method. Based on the key name known from the annotation (such as "userId"), directly locate the corresponding parameter value in the parameter list. For example, if the key name is known to be "userId", the value of the parameter with the same name can be found directly in the parameter list, thus avoiding the performance loss caused by traversing all parameters.

[0048] S105: Parse client credentials and perform authentication comparison

[0049] Parse credentials: Retrieve a JWT token named TOKEN from the header of the current HTTP request. Parse this token using the Springboot-jwt third-party library to extract the current user's core identity information, such as: user ID (currentUserId), list of projects (currentProjects), and list of roles (currentRoles).

[0050] Perform the comparison: Write the authentication and verification logic to compare the authentication value obtained in S104 with the user identity information parsed in S105.

[0051] User ID comparison: Determine whether currentUserId is equal to the userId parameter value obtained by S104.

[0052] Role comparison: Determine if the currentRoles list contains the "admin" role configured in the annotation. (The same applies to project, enterprise, and other dimensions.)

[0053] S106: Make an authentication decision

[0054] If all configured dimensions are successfully compared, authentication is successful, the aspect logic ends, and the business method getPrivateData is called normally.

[0055] If any dimension comparison fails, the aspect immediately throws a security exception such as AccessDeniedException, preventing the execution of the business method and returning an "Access Denied" response to the client.

[0056] Example 2

[0057] This embodiment also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement any of the methods described in Embodiment 1.

[0058] Example 3

[0059] This embodiment also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method described in any of the embodiments in Example 1.

[0060] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A method for implementing interface authentication based on Springboot aspect, characterized in that, The method comprises the following steps: S1, defining a custom annotation on a service end, wherein at least one attribute for authentication dimension configuration is declared; S2, annotating the custom annotation on a business interface method requiring authentication, and attribute assignment is performed to declare the authentication required dimensions and their corresponding parameter keys; S3, defining an aspect class configured to intercept all methods annotated by the custom annotation; When the client calls the business interface, the aspect class is triggered before the business method is executed; S4, the aspect class executes authentication logic; specifically comprising: S41, parsing the custom annotation to obtain at least one parameter key declared therein; S42, according to the parameter key, directly obtaining the corresponding parameter value from the parameters requested by the client as the to-be-authenticated value; S43, parsing the access credentials of the client to obtain user identity information; S44, comparing the user identity information with the to-be-authenticated value; S45, if the comparison is successful, the business method is allowed to continue to execute; if the comparison fails, an exception is thrown and access is denied.

2. The method for implementing interface authentication based on Springboot aspect according to claim 1, characterized in that: The authentication dimension attribute includes at least one of "user ID", "project ID", "enterprise ID", "unit ID", and "role".

3. The method for implementing interface authentication based on Springboot aspect according to claim 1, characterized in that: In step S4, the access credentials of the client are a JWT token carried in the HTTP request header, and the user identity information is obtained by parsing the JWT token.

4. The method for implementing interface authentication based on Springboot aspect according to claim 3, characterized in that, In step S3, the aspect class parses the authentication dimension configuration to obtain at least one parameter key, including: obtaining the parameter list of the business interface method through the aspect parameter JoinPoint, and directly locating and obtaining the corresponding parameter value from the parameter list according to the parameter key obtained from the custom annotation.

5. The method for implementing interface authentication based on Springboot aspect according to claim 1, characterized in that: The custom annotation limits its target to a method and specifies that it takes effect at runtime.

6. The method of claim 1, wherein: In step S3, the method in the aspect class is annotated with the @Before notification annotation and the pointcut expression is configured as @annotation to specify that the method annotated by the custom annotation is intercepted.

7. An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor executes the program to implement the method of any one of claims 1-6.

8. A computer-readable storage medium having stored thereon a computer program, characterized in that, The program is executed by the processor to implement the method of any one of claims 1-6.

Images