CN106209727B - Session access method and device - Google Patents

Abstract

The present application provides a session access method and device, wherein the method includes: receiving a service access request sent by a client, wherein the service access request includes first terminal information of the terminal where the client is located, and a service session used to identify the client to access the service. The session identifier is obtained; the pre-stored second terminal information corresponding to the session identifier is obtained, and when it is determined that the first terminal information is the same as the second terminal information, the service access content is returned to the client. The present application improves the security of application access.

Description

A session access method and device

technical field

The present application relates to network technology, and in particular, to a session access method and apparatus.

Background technique

For Internet applications based on B/S (Browser/Server, browser/server) mode, when the server provides application data to the client corresponding to the browser, for the security of data access, the application data is usually only authorized to users who have logged in privileged user. Moreover, the access to the Internet application is in the form of a short link, and each time the client sends a data request to the server, it must establish a session with the server and carry the session identifier to maintain the access state to the same application. However, since the session ID is stored in the client and is easily copied at will, once the session ID is copied by other terminals and used to request a session from the server, there will be a security risk in application access.

SUMMARY OF THE INVENTION

In view of this, the present application provides a session access method and apparatus to improve the security of application access.

Specifically, the application is achieved through the following technical solutions:

In a first aspect, a session access method is provided, including:

receiving a service access request sent by the client, where the service access request includes first terminal information of the terminal where the client is located, and a session identifier used to identify the client's access service session;

Acquire pre-stored second terminal information corresponding to the session identifier, and return service access content to the client when it is determined that the first terminal information is the same as the second terminal information.

In a second aspect, a session access device is provided, including:

a request receiving module, configured to receive a service access request sent by the client, where the service access request includes first terminal information of the terminal where the client is located and a session identifier used to identify the client access service session;

A content feedback module, configured to acquire pre-stored second terminal information corresponding to the session identifier, and return service access content to the client when it is determined that the first terminal information is the same as the second terminal information.

The session access method and device provided by the present application, by returning the service access content to the client only when it is determined that the terminal sending the service access request is the same as the stored terminal, can avoid session accesses of different terminals at the same time, thereby improving application access reliability. safety.

Description of drawings

FIG. 1 is an access system for an Internet application shown in an exemplary embodiment of the present application;

FIG. 2 is a flowchart of a session access method according to an exemplary embodiment of the present application;

FIG. 3 is a flowchart of another session access method shown in an exemplary embodiment of the present application;

FIG. 4 is a structural diagram of a session access apparatus according to an exemplary embodiment of the present application.

Detailed ways

Exemplary embodiments will be described in detail herein, examples of which are illustrated in the accompanying drawings. Where the following description refers to the drawings, the same numerals in different drawings refer to the same or similar elements unless otherwise indicated. The implementations described in the illustrative examples below are not intended to represent all implementations consistent with this application. Rather, they are merely examples of apparatus and methods consistent with some aspects of the present application as recited in the appended claims.

FIG. 1 illustrates an Internet application access system in B/S mode. The system may include a client 11 and a server 12. For example, the client is a Tmall website opened by a browser running on the terminal 13, and the server 12 is The Tmall server corresponding to the Tmall website. The session access method and device according to the embodiments of the present application are applied to the communication between the client and the server. The following briefly describes the communication characteristics between the client 11 and the server 12:

Still taking the access of the above-mentioned Tmall client to the Tmall server as an example, the content in the Tmall website displayed on the browser can be provided by the server 12, and usually the server 12 only provides the content to users with login rights. , so the user will get an account number and password by registering on the Tmall website.

After obtaining the account number and password, the access between the client and the browser adopts the short link method. Specifically, for example, the Tmall website may include links to multiple network resources, such as clothing details links, business information links, etc. The characteristic of the link method is that every time the user clicks a link (equivalent to initiating a data request), a session must be established with the server, and when the data request corresponding to this link ends, the session will be released; When the cat website clicks on the next link (equivalent to initiating another data request), another session needs to be established. These multiple session establishments are all the user's access operations to the Tmall website after logging in to Tmall. That is to say, from the time the user logs in to Tmall to exiting the access to Tmall, multiple data requests may be made to the server in the middle. Establish multiple sessions.

For the above access process, the server side will record the access. The recording method is to assign a session ID for the entire access process from logging in to Tmall to logging out of Tmall. The same session ID, so that the server can determine accordingly that the multiple session accesses correspond to one access to Tmall by the same user. That is, when a user logs in to Tmall, the server assigns a session ID to it. During the process of accessing Tmall, the session ID is carried with each data request to create a session. The process association record belongs to a visit to Tmall by the same user.

The session access method in this embodiment of the present application is applied to the server side determining whether the user has access rights according to the session access method in this embodiment every time a session is created after the user logs in to Tmall. Figure 2 illustrates the session access method performed by the server, including:

201. Receive a service access request sent by the client, where the service access request includes first terminal information of the terminal where the client is located, and a session identifier used to identify the client access service session;

202. Acquire pre-stored second terminal information corresponding to the session identifier, and when it is determined that the first terminal information is the same as the second terminal information, return service access content to the client.

The service access request in 201, for example, is that the user clicks a resource link on the website after logging in to Tmall, and sends the service access request to the server 12. The client can carry the terminal information of the terminal where the client is located, for example, the terminal where the client is located is the terminal 13 shown in FIG. 1, and the client Tmall website is running on the browser of the terminal 13; the terminal The information is, for example, network connection attribute information such as IP address and MAC address, which is difficult to replicate. The client also carries a session identifier in the service access request, and the session identifier may be the session ID allocated by the server for the user's current access when the user logs in to the Tmall website for the first time.

In 202, the server 12 may compare the terminal information carried in the service access request with the terminal information corresponding to the session ID pre-stored this time, and may refer to the terminal information carried in the service access request as the first terminal information, The locally stored terminal information is called second terminal information, and the second terminal information may be recorded by the server when assigning a session ID to the user. If the information of the first terminal is the same as the information of the second terminal, it can be determined that the access is initiated by the same terminal, and the service access content, such as data resources linked to the corresponding website, can be returned to the client.

Through the session access method shown in FIG. 2 , the server can ensure the consistency of the terminals accessing the application, and prevent the occurrence of duplication of session IDs between different terminals. For example, when the user logs in to Tmall on the terminal 13, the server assigns the session ID of the access session. If the user accesses Tmall on another terminal, even if the user is still the same user corresponding to the same account and password, the server usually changes the Terminate the authorization of this access, and if the above-mentioned other terminal also carries the session ID, the server side only judges whether the user has the access right according to the session ID, it is easy to cause the access after the terminal is replaced, and this kind of random access increases the security. hidden danger. According to not only the session ID but also the terminal information, the server in this embodiment allows continued access only when the terminal that initiates the current session is the same as the terminal when the session was authorized, thereby ensuring access security.

Fig. 3 illustrates another flowchart of processing session access on the server side, as shown in Fig. 3, including:

301. Receive a session authorization request sent by the client;

For example, the user can enter the account number and password on the Tmall website, and submit it to the server for verification in the session authorization request. The session authorization request may further include terminal information of the terminal where the client is located, which may be referred to as second terminal information, such as the IP address of the terminal.

302. Store the correspondence between the session identifier and the second terminal information;

For example, after receiving the session authorization request in 301, the server verifies the account and password, and after the verification is passed, assigns a session identifier to the user's current access, and stores the session identifier and the second terminal carried in the session authorization request. Correspondence of information.

303. Return the authorized session identifier to the client;

For example, the server returns the session ID assigned to the user to the client in this step.

304. Receive a service access request sent by the client;

For example, after logging in to Tmall, the user clicks the resource link of the website to initiate a service access request. The request carries the session ID allocated in 303 above, and also carries the terminal information of the terminal where the client is located, which may be referred to as the first terminal information.

305. Obtain pre-stored second terminal information corresponding to the session identifier, and determine that the first terminal information is the same as the second terminal information;

For example, the server obtains the second terminal information corresponding to the session ID according to the session ID in 304, and determines whether the second terminal information is the same as the first terminal information. If it is different, it indicates that the terminal accessed this time is not the terminal when the server authorizes the session ID, and the access is rejected; otherwise, the process continues to 306, and the access content is returned to the user.

306. Return the service access content to the client.

In order to implement the above session access method, an embodiment of the present application further provides a session access device, which is applied to the server side. As shown in FIG. 4 , the device may include: a request receiving module 41 and a content feedback module 42; wherein,

The request receiving module 41 is configured to receive a service access request sent by the client, where the service access request includes first terminal information of the terminal where the client is located, and a session identifier for identifying the client access service session;

For example, the terminal information may include: network connection attribute information of the terminal. The network connection attribute information includes, for example, an IP address or a MAC address of the terminal.

The content feedback module 42 is configured to acquire pre-stored second terminal information corresponding to the session identifier, and return service access content to the client when it is determined that the first terminal information is the same as the second terminal information.

Further, the request receiving module 41 is further configured to receive a session authorization request sent by the client before receiving the service access request sent by the client, where the session authorization request includes the second terminal information;

The content feedback module 42 is further configured to return the authorized session identifier to the client, and store the correspondence between the session identifier and the second terminal information.

The above descriptions are only preferred embodiments of the present application, and are not intended to limit the present application. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application shall be included in the present application. within the scope of protection.

Claims (4)

1. A session access method, comprising:

receiving a service access request sent by a client after logging in, wherein the service access request comprises first terminal information of a terminal where the client is located and a session identifier for identifying a service session accessed by the client; the service access of the client adopts a short link mode; the session identifier is a session identifier allocated for the current access;

acquiring second terminal information which is stored in advance and corresponds to the session identifier, and returning service access content to the client when the first terminal information and the second terminal information are determined to be the same;

before the receiving of the service access request sent by the client, the method further includes:

receiving a session authorization request sent by the client, wherein the session authorization request comprises the second terminal information;

returning the authorized session identifier to the client, and storing the corresponding relation between the session identifier and the second terminal information;

the terminal information includes: network connection attribute information of the terminal.

2. The method of claim 1, wherein the network connection attribute information comprises: IP address or MAC address of the terminal.

3. A session access apparatus, comprising:

the client comprises a request receiving module, a service access request sending after logging in, and a service access request sending after logging in, wherein the service access request comprises first terminal information of a terminal where the client is located and a session identifier for identifying a service session accessed by the client; the service access of the client adopts a short link mode; the session identifier is a session identifier allocated for the current access; the terminal information includes: network connection attribute information of the terminal;

the content feedback module is used for acquiring prestored second terminal information corresponding to the session identifier and returning service access content to the client when the first terminal information is determined to be the same as the second terminal information;

the request receiving module is further configured to receive a session authorization request sent by a client before receiving a service access request sent by the client, where the session authorization request includes the second terminal information;

the content feedback module is further configured to return the authorized session identifier to the client, and store a corresponding relationship between the session identifier and the second terminal information.

4. The apparatus of claim 3, wherein the network connection attribute information comprises: IP address or MAC address of the terminal.

Images