The invention relates to a permission control method and
system under a micro-service architecture, and an
access token, and aims to solve the problem of low efficiency caused by frequent request of
authentication service by each resource service and frequent query of a
database by the
authentication service to obtain
current user permission information in the micro-service architecture. Accordingto the technical scheme, the method comprises the steps that a
client obtains an
access token which is returned by an
authentication server and contains an authority bit
stream, wherein the authoritybit
stream is a binary string with a fixed bit number, the bit number of the binary string is determined according to the number of
system authorities, each bit in the binary string is in one-to-onecorrespondence with the authority in the
system, and the value of each bit represents the state of the corresponding authority; a
client carries the
access token to send a resource request to the APIgateway; an API gateway carries out
security authentication on the access token and forwards the resource request to the corresponding micro-service after the authentication is passed, and the accesstoken is carried during forwarding; and a micro-service verifies the permission according to the value of the bit corresponding to the requested resource on the permission bit
stream in the access token.