Authorization Callback Mechanism for Secure User Data Retrieval
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Developers and merchants face challenges in obtaining user information from servers while ensuring privacy and security, especially when providing targeted services to users through Internet applications.
Innovation Solution
A method and apparatus that involve sending an authorization page to a terminal after detecting a specified webpage operation, obtaining a first authorization credential from a callback page, and using it to send a user information request to a server, ensuring secure data retrieval and provision to a public identity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If the developer or merchant directly obtains user information from the server, then the service personalization capability is improved, but the user privacy security deteriorates
Solution Approach 1:
The patent introduces an authorization page and callback mechanism as intermediaries between the user terminal and the server. When a user visits a specified webpage, the system sends an authorization page to the terminal, which contains a trigger operation. Upon user interaction, a callback page is generated with embedded authorization credentials. This intermediary process allows the server to obtain user information only after explicit user authorization, thus enabling service personalization while protecting user privacy security.
2Ease of operation
If the authorization process is simplified, then the ease of operation is improved, but the security of user information deteriorates
Solution Approach 1:
The patent implements preliminary action by pre-generating authorization credentials and embedding them in the callback page URL before the actual information retrieval occurs. The authorization page is prepared in advance with trigger operations, and the callback page is pre-configured with authorization codes. This preliminary preparation maintains security while simplifying the user experience during the actual authorization moment, as users only need to perform simple trigger operations rather than complex authentication sequences.
Data Source
AI summary
The present disclosure provides a user information obtaining method and apparatus, and a server. The method includes: sending, after detecting an operation of a terminal for browsing a specified webpage using an Internet application, an authorization page for obtaining user information, the specified webpage being a webpage associated with a specified public identity, the authorization page including an option enabling the terminal to jump to a callback page; obtaining a first authorization credential from address information of the callback page after receiving an authorization confirmation instruction sent by the terminal, the authorization confirmation instruction being sent by the terminal after the terminal detects a trigger operation corresponding to the option, and the first authorization credential being added by a first server to the address information; and obtaining user information from the first server according to the first authorization credential, and providing the user information to the specified public identity.