A forum access redirection method and apparatus

Abstract

The present application relates to the technical field of computer security, and provides a forum access redirection method and device, comprising: in response to a login callback request forwarded by a reverse proxy after forum access is intercepted, obtaining an original access callback address and a uniform authentication login token in a browser Cookie; performing validity verification on the uniform authentication login token, if the uniform authentication login token is invalid, deleting the uniform authentication login token Cookie, and generating a forum logout script; encoding and splicing the forum host address and the original access callback address to a user center login address, combining the forum logout script and a user center login jump script to output to a response, so that the browser executes forum logout and user center login jump in sequence. The present application can eliminate the security risks of circular jump, semi-login state and redirection, and realize the comprehensive improvement of stability, security and user experience of the login process when the forum system accesses the uniform identity authentication system non-invasively.

Description

Technical Field

[0001] This invention relates to the field of computer security technology, and in particular to a forum access redirection method and device. Background Technology

[0002] Reverse proxy interception technology is widely used as a means of integrating forum systems with a unified identity authentication system due to its advantages such as not requiring modification of the original forum source code and flexible deployment. Specifically, unauthenticated access requests to the forum are intercepted at the reverse proxy layer or gateway layer and forwarded to the enterprise user center for authentication. After successful login at the user center, the user is redirected back to the forum, where its own user center component generates a login status. This technology enables single sign-on integration without requiring large-scale modifications to the forum's core code.

[0003] However, this technology faces the following pressing technical problems in practical engineering applications:

[0004] First, there's the issue of inconsistencies between token remnants and their status. The enterprise login token stored in a user's browser may have expired or become invalid in the user center. However, because browser cookies aren't cleared promptly, the invalid token will still be present when the user accesses the forum. In this case, if only a simple redirection is performed using a reverse proxy, the system cannot identify the token's invalid status, nor will it actively clear the residual cookie. This results in the user being repeatedly redirected to the login page, creating a loop or infinite redirection, severely impacting the user experience.

[0005] Second, there's the issue of forum logout and user center logout being out of sync. When a user clicks "logout" on the forum side, the forum's own UCenter component clears the login status on the forum side, but the enterprise login token in the user center usually remains valid. When the user visits the forum again, the reverse proxy detects that the request still carries a valid enterprise login token and does not redirect the user to the user center login page. However, the forum side has already cleared the login status, ultimately leaving the user in a semi-login state where they cannot access the forum or re-authenticate. Manually clearing browser cookies is required to recover.

[0006] Third, there's the issue of lost original access addresses. In existing simple redirection schemes, the reverse proxy intercepts the request and directly redirects to the user center login page, without saving or transmitting the original forum page address requested by the user. After successfully logging in to the user center, the system can only redirect to the forum homepage and cannot return to the target page the user initially hoped to access. This not only degrades the user experience but also increases the user's operational costs, especially in scenarios where users access deeper forum pages directly through external links or bookmarks.

[0007] Fourth, there are security risks associated with login redirect addresses. If the callback address is not properly encoded when constructing the user center login address, special characters or query parameters in the original access address may cause the redirect parameters to be truncated or parsed incorrectly, leading to login failure or page loading errors. Furthermore, unencoded callback addresses may introduce open redirect security risks, which can be maliciously exploited for phishing attacks.

[0008] Fifth, the issue of the execution order of state cleanup. In scenarios where the token expires, if the user is redirected to the user center login page before the forum logout operation is performed, or if only one cleanup step is performed while the other is ignored, both the forum login state and the enterprise token will remain in the browser, resulting in inconsistencies between the two authentication credential states. In this state, users may experience permission judgment anomalies or login state confusion when subsequently accessing the forum due to credential conflicts.

[0009] Chinese patent CN118473775A discloses a single sign-on method for third-party platforms based on Nginx server proxy forwarding. This method only solves the problem of user identification transmission between the unified authentication platform and the third-party platform. It cannot identify, verify and actively clean up expired authentication credentials (such as tokens in cookies) stored on the client. It also does not handle the problem of synchronous logout between the login state on the forum side and the login state on the unified authentication side. When the token of the unified authentication platform has expired but the client still retains the old token, the user is repeatedly redirected, gets stuck in a loop, or is in an inconsistent state of having logged out of the forum but still logged in through unified authentication because of the expired token.

[0010] Therefore, how to provide a technical method that can centrally handle token verification, state cleanup and security redirection at the reverse proxy interception entry point, so as to improve the stability of the login process and the consistency of user experience when non-intrusive forums access a unified identity authentication system, has become an urgent technical problem to be solved. Summary of the Invention

[0011] In view of this, in order to overcome the shortcomings of the prior art, the present invention aims to provide a forum access redirection method and device.

[0012] According to a first aspect of the present invention, a forum access redirection method is provided, the method comprising:

[0013] Step S1: In response to the login callback request forwarded by the reverse proxy after the forum access is blocked, obtain the original access callback address and the unified authentication login token in the browser cookie;

[0014] Step S2: Verify the validity of the unified authentication login token. If the unified authentication login token is invalid, delete the unified authentication login token cookie and generate the forum logout script.

[0015] Step S3: Encode the forum host address and the original access callback address and concatenate them to the user center login address. Combine the forum logout script and the user center login redirect script and output them to the response so that the browser can execute the forum logout and user center login redirect in sequence.

[0016] Optionally, in the forum access redirection method of the present invention, in step S1, the original access callback address and the unified authentication login token in the browser cookie are obtained as follows: After the reverse proxy intercepts the unauthenticated access to the forum's protected page, it carries the original unified resource locator of the access as a request parameter and forwards it to the callback interface of the forum adaptation service. The original unified resource locator is read from the parameters of the login callback request as the original access callback address. The browser cookie key-value pairs are parsed from the HTTP request header through the cookie utility class, the cookie item with the name of the preset token name is found, and its value is extracted as the unified authentication login token.

[0017] Optionally, in the forum access redirection method of the present invention, in step S2, the unified authentication login token is validated in the following manner: the user center token verification interface is called with the product code and the unified authentication login token as request parameters. When the returned status code is a success code and the returned data can be converted into a user information object containing a valid user account, the unified authentication login token is determined to be valid; otherwise, the unified authentication login token is determined to be invalid.

[0018] Optionally, in the forum access redirection method of the present invention, in step S2, the unified authentication login token cookie is deleted as follows: the expiration period of the cookie whose name matches the unified authentication login token name is set to zero, the path attribute is set to the root path, and a response is written back to make the browser remove the cookie.

[0019] Optionally, in the forum access redirection method of the present invention, in step S2, the forum logout script is dynamically generated by the UCenter client calling the forum UCenter synchronous logout interface, and is used to clean up the login state on the forum side.

[0020] Optionally, in the forum access redirection method of the present invention, in step S3, the user center login redirection script includes a page redirection instruction pointing to the user center login address. By embedding the forum logout script and the user center login redirection script sequentially in the HTML response body in the form of script tags, the browser executes the forum logout script first and then executes the login redirection script.

[0021] Optionally, in the forum access redirection method of the present invention, in step S3, the user center login redirection script has a preset delay time embedded in it, so that the browser executes the login redirection after the preset delay time after executing the forum logout script.

[0022] Optionally, in the forum access redirection method of the present invention, in step S3, the original access callback address is passed in as a parameter of the login callback request by the reverse proxy, the forum host address is combined with the original access callback address, the combined complete address is URL encoded, and the encoded result is used as a jump parameter to be concatenated to the user center login address, so that the user center returns to the original access page after logging in.

[0023] Optionally, the forum access redirection method of the present invention further includes: after successful login to the user center, the user calls back the forum adaptation service with a new unified authentication login token. The forum adaptation service obtains user information based on the new unified authentication login token and generates a UCenter synchronous login script. After writing the new unified authentication login token into the browser cookie, the user is redirected to the original access callback address or the forum homepage.

[0024] According to a second aspect of the present invention, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method described in the first aspect of the present invention.

[0025] The forum access redirection method and device of this invention have the following beneficial technical effects:

[0026] By performing real-time validity checks on the unified authentication login token and simultaneously deleting local cookies and generating a forum logout script by calling the UCenter interface when the token is invalid, the unified authentication credential on the browser side and the login state on the forum side are both invalidated simultaneously. This effectively avoids looping redirects and half-login states caused by token residue. By combining the original access callback address passed in by the reverse proxy with the forum host address, URL encoding it, and concatenating it to the user center login address, along with the sequentially output forum logout script and the user center login redirect script with a delay, it is ensured that users can safely and accurately return to the original access page after authentication, and that the state cleanup operation is fully effective before the login redirect. This non-intrusive solution addresses various login state splitting issues caused by invalid token residue, asynchronous logout, lost callback addresses, and disordered execution order when the forum system is integrated with the unified identity authentication system. This significantly improves the stability, security, and user experience consistency of the forum access redirection process in scenarios where multiple authentication credentials coexist. Attached Figure Description

[0027] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0028] Figure 1 This is a flowchart illustrating the forum access redirection method according to an exemplary embodiment 1 of the present invention;

[0029] Figure 2 A flowchart illustrating the unified authentication login token verification process for the forum access redirection method according to Exemplary Embodiment 1 of the present invention;

[0030] Figure 3 This is a schematic diagram of the structure of the device provided by the present invention. Detailed Implementation

[0031] The embodiments of the present invention will now be described in detail with reference to the accompanying drawings.

[0032] It should be noted that, in the absence of conflict, the following embodiments and features can be combined with each other; and, based on the embodiments of this disclosure, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this disclosure.

[0033] It should be noted that various aspects of embodiments within the scope of the appended claims are described below. It will be apparent that the aspects described herein can be embodied in a wide variety of forms, and any particular structure and / or function described herein is merely illustrative. Based on this disclosure, those skilled in the art will understand that one aspect described herein can be implemented independently of any other aspect, and two or more of these aspects can be combined in various ways. For example, any number of aspects set forth herein can be used to implement the device and / or practice the method. Additionally, this device and / or method can be implemented using structures and / or functionalities other than one or more of the aspects set forth herein.

[0034] Example 1

[0035] Exemplary embodiment 1 of the present invention provides a forum access redirection method. By centrally executing the original callback address acquisition, unified authentication login token reading and expiration cleanup, forum UCenter synchronous logout script generation, and encoded redirection output at the reverse proxy interception entry point, a complete "token verification, expiration cleanup, forum logout, and secure jumpback" processing chain is constructed. This effectively avoids the looping problem caused by expired token residue, while ensuring that users can accurately return to the original access page after unified authentication login. This improves the stability of the login process and the consistency of user experience when the forum system non-intrusively accesses the unified identity authentication system.

[0036] Figure 1 This is a flowchart illustrating the forum access redirection method according to Exemplary Embodiment 1 of the present invention, as follows: Figure 1 As shown, in this embodiment, the method of the present invention is implemented in the following manner:

[0037] Step S1: In response to the login callback request forwarded by the reverse proxy after the forum access is blocked, obtain the original access callback address and the unified authentication login token in the browser cookie.

[0038] In this embodiment, after the reverse proxy intercepts unauthenticated access to the forum's protected page, it carries the original Uniform Resource Locator (URL) as a request parameter and forwards it to the callback interface of the forum adaptation service. The URL is read from the parameters of the login callback request as the original access callback address. The browser's cookie key-value pairs are parsed from the HTTP request header using the Cookie utility class. The cookie item with the name of the preset token is found and its value is extracted as the unified authentication login token.

[0039] This embodiment uses a reverse proxy to carry the original Uniform Resource Locator (URL) of the forum's protected page as a request parameter and forward it to the adaptation service. It also uses a cookie utility class to parse browser cookie key-value pairs to extract the token value corresponding to the preset token name, thereby achieving accurate and efficient acquisition of the callback address and login token. This provides a reliable data foundation for subsequent token verification and state cleanup, improving the accuracy of the interception response and the universality of the adaptation service.

[0040] Step S2: Verify the validity of the unified authentication login token. If the unified authentication login token is invalid, delete the unified authentication login token cookie and generate the forum logout script.

[0041] Figure 2 This is a flowchart illustrating the unified authentication login token verification process of the forum access redirection method according to Exemplary Embodiment 1 of the present invention, as follows: Figure 1As shown, in this embodiment, the user center token verification interface is called using the product code and unified authentication login token as request parameters. If the returned status code is a success code and the returned data can be converted into a user information object containing a valid user account, the unified authentication login token is determined to be valid; otherwise, the unified authentication login token is determined to be invalid.

[0042] This embodiment calls the user center token verification interface with the product code and unified authentication login token as parameters, and comprehensively judges the validity of the returned status code and the user information object to determine whether the token is valid. This achieves accurate identification of the true status of the token, avoids the repeated use of invalid tokens and abnormal login process caused by blindly trusting browser cookies, and reduces the consumption of user center resources by invalid verification requests.

[0043] As an optional example, in this embodiment, the unified authentication login token cookie is deleted in the following way: the expiration period of the cookie whose name matches the unified authentication login token name is set to zero, the path attribute is set to the root path, and a response is written back to make the browser remove the cookie. This achieves the thorough and timely removal of the browser-side token cookie, avoids the problem of token residue and repeated redirection caused by untimely manual cleaning, and improves the automation and reliability of token lifecycle management.

[0044] In this embodiment, the forum logout script is dynamically generated by the UCenter client calling the forum UCenter synchronous logout interface, and is used to clean up the forum-side login state. This embodiment achieves automated clearing of the forum-side login state by dynamically generating the forum logout script through the UCenter client calling the forum UCenter synchronous logout interface, ensuring that the forum's local session is synchronously invalidated when the unified authentication token expires, and avoiding permission judgment abnormalities or half-login states caused by inconsistencies between the forum login state and the unified authentication token state.

[0045] Step S3: Encode the forum host address and the original access callback address and concatenate them to the user center login address. Combine the forum logout script and the user center login redirect script and output them to the response so that the browser can execute the forum logout and user center login redirect in sequence.

[0046] The user center login redirect script contains a page redirection instruction pointing to the user center login address. By embedding the forum logout script and the user center login redirect script sequentially in the HTML response body as script tags, the browser executes the forum logout script first and then the login redirect script. This ensures that the forum login state is completely cleared before entering the unified authentication login process, effectively avoiding credential conflicts caused by disordered state cleanup and login redirection order.

[0047] It should be noted that the user center login redirect script in this embodiment has a preset delay time embedded in it. This delay time allows the browser to execute the login redirect after executing the forum logout script, ensuring that the forum logout operation takes full effect before the redirect. This provides sufficient time for the forum logout operation to take effect, avoiding the failure to clear the forum login state due to the redirect starting before the logout script has finished executing. This further improves the reliability of state clearing and the stability of the login process.

[0048] In practical applications, the original access callback address is passed in as a parameter of the login callback request by the reverse proxy. After combining the forum host address with the original access callback address, the resulting complete address is URL encoded. The encoded result is then used as a jump parameter to be appended to the user center login address. This ensures that the original access address with special characters or query parameters is not truncated or parsed abnormally during the redirection process, while also reducing the security risks of open redirection and returning the user center login page to the original access page.

[0049] After successful login to the user center, the new unified authentication login token is sent back to the forum adaptation service. The forum adaptation service obtains user information based on the new unified authentication login token and generates a UCenter synchronous login script. After writing the new unified authentication login token to the browser cookie, it redirects to the original access callback address or the forum homepage, realizing closed-loop processing of the interception and redirection link. This ensures the consistency between the login state on the forum side and the unified authentication token state after the unified authentication login process ends, allowing users to seamlessly continue to access forum resources.

[0050] In practical applications, the unified authentication login token, forum host address, user center token verification interface address, and product code are all managed uniformly by the configuration parameters of the forum adaptation service to support flexible deployment in multi-product environments.

[0051] When a unified authentication login token exists in the login callback request, the user center logout interface is first called based on the product code and the unified authentication login token to invalidate the token on the user center side. Then, the operations of deleting the cookie and concatenating the user center login address are performed to resolve the inconsistency issue caused by the user center token remaining active after logging out of the forum. When performing token invalidation cleanup, the unified authentication login token cookie is deleted first and a forum logout script is generated. Then, the script for concatenating the user center login address and redirecting is executed and output. This ensures that invalid token cleanup and forum login state clearing are completed before login redirection, avoiding duplicate redirects or half-login states caused by residual invalid credentials.

[0052] Example 2

[0053] Exemplary embodiment 2 of the present invention provides a forum access redirection method. In this embodiment, the method of the present invention is further described in detail in conjunction with the cestc-bbs forum adaptation service. The cestc-bbs forum adaptation service receives the reverse proxy login callback through UcenterController.loginByUcNginx, and handles token cleanup, user center redirection and UCenter synchronous logout through UcenterServiceImpl.loginByUcNginx and UcenterServiceImpl.tokenCheck.

[0054] Specifically, in this embodiment, the method of the present invention is implemented in the following manner:

[0055] After intercepting unauthorized forum access via a reverse proxy, the request is forwarded to the `loginByUcNginx` interface, with the `referer` parameter included in the request. This `referer` is then used as the original callback URL to redirect the user to the intended forum page after successful login through the user center.

[0056] The adaptation service reads the enterprise login token from the browser cookie; in the project, the token name is cestcToken. CookieUtil.getCookieValueByName is used to convert the request cookie into a key-value map and retrieve the specified token.

[0057] Token verification is performed by UcenterServiceImpl.postTokenCheck, which constructs a TokenPara, writes the product code and enterprise login token, and calls UcParam.tokenCheckUrl. The response is parsed as ResultVO, and the token is considered valid only if it returns a success code and the data can be converted to SystemSsoUser and contains the userName.

[0058] If the enterprise login token is empty, the user center verification fails, the returned user information is empty, or the user account is empty, the token is deemed invalid. In this case, CookieUtil.invalidCookie is called to set the cookie's expiration time to zero and write it back to the response, thus invalidating the enterprise token on the browser side.

[0059] When the token is invalid, the user is not directly redirected to the user center. Instead, a UCenter client is created first, and ucUserSynlogout is called to generate a forum synchronous logout script. This script is used to clean up the login state on the forum side to avoid the browser leaving the forum login state while the enterprise token has expired.

[0060] The forum host address is combined with the original access callback address and then URL encoded. The project uses `ucenterPro.getHost` and `callback` to combine the original forum access address, and then uses `URLEncoder.encode` to include it as part of the referer parameter on the user center login page.

[0061] The UCenter synchronous logout script and the user center login redirect script are concatenated and written into the browser response. The browser first executes the forum logout script, and then redirects to the user center login address after a short delay, thus achieving the sequential completion of forum status cleanup and unified login entry redirection.

[0062] In this embodiment, loginByUcNginx also handles the case where a user re-enters the proxy callback after exiting the forum. If the cestcToken still exists in the request, it first constructs TokenParam and calls UcParam.logOutUrl to invalidate the token on the user center side; then it deletes the local cestcToken Cookie and concatenates the user center login address to solve the problem of inconsistent status between exiting the forum and logging into the user center.

[0063] After successful login to the user center, a callback to loginByUC will be sent, carrying a new enterprise login token. loginByUC parses the callback parameter in the request, calls getUserByUC to obtain the user account based on the token, generates the UCenter synchronous login script, writes the new enterprise login token to a cookie, and then redirects the user to the original callback address or the forum homepage.

[0064] like Figure 3 As shown, the present invention also provides a device including a processor 310, a communication interface 320, a memory 330 for storing processor-executable computer programs, and a communication bus 340. The processor 310, communication interface 320, and memory 330 communicate with each other via the communication bus 340. The processor 310 implements the aforementioned forum access redirection method by running the executable computer program.

[0065] The computer program in memory 330, when implemented as a software functional unit and sold or used as an independent product, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, a portable hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0066] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods of various embodiments or some parts of embodiments.

[0067] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A forum access redirection method, characterized in that, The method includes: Step S1: In response to the login callback request forwarded by the reverse proxy after the forum access is blocked, obtain the original access callback address and the unified authentication login token in the browser cookie; Step S2: Verify the validity of the unified authentication login token. If the unified authentication login token is invalid, delete the unified authentication login token cookie and generate the forum logout script. Step S3: Encode the forum host address and the original access callback address and concatenate them to the user center login address. Combine the forum logout script and the user center login redirect script and output them to the response so that the browser can execute the forum logout and user center login redirect in sequence.

2. The forum access redirection method according to claim 1, characterized in that, In step S1, the original access callback address and the unified authentication login token in the browser cookie are obtained as follows: After the reverse proxy intercepts unauthenticated access to the forum's protected page, it carries the original unified resource locator (URL) as a request parameter and forwards it to the callback interface of the forum adaptation service. The original URL is read from the parameters of the login callback request as the original access callback address. The browser cookie key-value pairs are parsed from the HTTP request header using the cookie utility class. The cookie item with the name of the preset token name is found and its value is extracted as the unified authentication login token.

3. The forum access redirection method according to claim 1, characterized in that, In step S2, the validity of the unified authentication login token is verified as follows: the user center token verification interface is called with the product code and the unified authentication login token as request parameters. If the returned status code is a success code and the returned data can be converted into a user information object containing a valid user account, the unified authentication login token is deemed valid; otherwise, the unified authentication login token is deemed invalid.

4. The forum access redirection method according to claim 1, characterized in that, In step S2, the unified authentication login token cookie is deleted as follows: the expiration time of the cookie whose name matches the unified authentication login token name is set to zero, the path attribute is set to the root path, and a response is written back to make the browser remove the cookie.

5. The forum access redirection method according to claim 1, characterized in that, In step S2, the forum logout script is dynamically generated by the UCenter client calling the forum UCenter synchronous logout interface, and is used to clear the login state on the forum side.

6. The forum access redirection method according to claim 1, characterized in that, In step S3, the user center login redirect script contains a page redirection instruction pointing to the user center login address. By embedding the forum logout script and the user center login redirect script sequentially in the HTML response body in the form of script tags, the browser executes the forum logout script first and then executes the login redirect script.

7. The forum access redirection method according to claim 6, characterized in that, In step S3, the user center login redirect script has a preset delay time embedded in it, so that the browser executes the login redirect after the preset delay time after executing the forum logout script.

8. The forum access redirection method according to claim 1, characterized in that, In step S3, the original access callback address is passed in as a parameter of the login callback request by the reverse proxy. After combining the forum host address with the original access callback address, the combined complete address is URL encoded. The encoded result is used as a jump parameter and appended to the user center login address so that the user center returns to the original access page after logging in.

9. The forum access redirection method according to claim 1, characterized in that, The method further includes: after successful login to the user center, the user calls back the forum adaptation service with the new unified authentication login token. The forum adaptation service obtains user information based on the new unified authentication login token and generates a UCenter synchronous login script. After writing the new unified authentication login token into the browser cookie, the user is redirected to the original access callback address or the forum homepage.

10. A computer device, characterized in that, The computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of the method according to any one of claims 1-9.

Images