CN107483466B - A method and device for user login verification in a web application - Google Patents

Abstract

The invention discloses a user login verification method and device in a Web application. When a session request of a user sent by a client is received, it firstly verifies whether the user is allowed to log in according to the verification data of the user stored in the client; If the verification data of the user stored in the client is consistent with the verification data of the user currently stored in the server, the user is allowed to log in; if they are inconsistent, the verification fails, and the verification number of the user stored in the client is further determined to be the same as the one currently stored in the server. Whether the verification number of the user is consistent, if not, return to the client the information requiring the user to enter the password for verification. The user login verification method and device in the web application of the present invention do not require the user to input a password every time he accesses, and the user's password is not stored in the client, thereby ensuring the security of the user's login information.

Description

A method and device for user login verification in a web application

technical field

The invention relates to the technical field of Web applications, in particular to a method and device for user login verification in Web applications.

Background technique

The user login function is a basic function in Web applications, but because the commonly used network protocols such as Hyper Text Transfer Protocol (HTTP) are stateless protocols, that is to say, this protocol cannot record the user's information. Access status, each request is independent and unrelated, and Web sites are designed as multiple pages. During the page jump process, the server needs to verify the user to verify whether the user is allowed to log in, so that the page jumps Only after the transfer will I know whether users can have permission to operate some functions or view some data.

Therefore, verifying whether the user is allowed to log in when the user accesses the page has become a problem to be faced in Web applications. In order to improve user experience, we cannot allow users to re-enter the user name and password every time they visit the page. In the prior art, the cache file of the browser is used to store the user's login information in the cache file of the client. When accessing the page, the user's login information is obtained from this cache file for verification, and it is verified whether the user can be allowed to log in. However, there are many hidden dangers in this method. First, the web application allows the browser to remember the user's password in the cache file, but the browser cache file has no security measures. Obviously, the password is easy to be stolen, and even if the password is encrypted and saved, However, if the thief copies the entire cache file away, he can also log in on other devices without entering a password.

It can be seen that the security of the authentication method for user login in the existing web application needs to be improved.

SUMMARY OF THE INVENTION

In view of this, the present invention provides a user login verification method and device in a Web application, which improves the security of user login information.

To achieve the above object, the present invention provides the following technical solutions:

A user login verification method in a Web application, comprising:

When receiving the session request of the user sent by the client, determine whether the verification data of the user stored in the client is consistent with the verification data of the user currently stored in the server;

If so, the verification is successful, the user is allowed to log in, and the verification data of the user stored in the client and the verification data of the user stored in the server are updated;

If not, the verification fails, and it is judged whether the verification number of the user stored in the client is consistent with the verification number of the user currently stored in the server;

If not, return information to the client that requires the user to input a password for verification. The verification number of the user stored in the client and the verification number of the user stored in the server are Password verification is successful and the user is allowed to log in to update.

Optionally, it also includes: judging whether the password input by the user provided by the client is correct;

If yes, then allow the user to log in, and update the verification number and verification data of the user stored in the client, and the verification number and verification data of the user stored in the server;

If not, the user is not allowed to log in.

Optionally, it also includes: if it is judged that the verification number of the user stored in the client is inconsistent with the verification number of the user currently stored by the server, then returning to the client information prompting the user to modify the password .

Optionally, the method further includes: periodically updating the verification data and verification number of the user stored in the server at the same time.

Optionally, the verification data and verification number of the user stored in the client are encrypted, and the verification data and verification number of the user stored in the server are encrypted.

A user login verification device in a Web application, comprising:

a first judging module, configured to judge whether the verification data of the user stored in the client is consistent with the verification data of the user currently stored in the server when receiving the session request of the user sent by the client;

A login module, used for if the verification data of the user stored in the client is consistent with the verification data of the user currently stored in the server, the verification is successful, allowing the user to log in, and updating the client The verification data of the user stored in the server and the verification data of the user stored in the server;

The second judgment module is configured to judge the verification number of the user stored in the client if the verification data of the user stored in the client is inconsistent with the verification data of the user currently stored in the server Whether it is consistent with the verification number of the user currently stored by the server;

The first prompting module is configured to return to the client to require the user to enter a password to perform a procedure if the verification number of the user stored in the client is inconsistent with the verification number of the user currently stored in the server. The verification information, the user's verification number stored in the client and the user's verification number stored in the server, are updated when the verification is successful according to the password input by the user and the user is allowed to log in.

Optionally, also include:

a third judging module for judging whether the password input by the user provided by the client is correct;

The login module is further configured to allow the user to log in if the password input by the user provided by the client is correct, and update the verification number and verification data of the user stored in the client, and the service The verification number and verification data of the user stored in the terminal; if not, the user is not allowed to log in.

Optionally, also include:

The second prompting module is configured to return to the client information prompting the user to change the password if it is determined that the verification number of the user stored in the client is inconsistent with the verification number of the user currently stored in the server .

Optionally, also include:

The updating module is used to periodically update the verification data and verification number of the user stored in the server at the same time.

Optionally, the verification data and verification number of the user stored in the client are encrypted, and the verification data and verification number of the user stored in the server are encrypted.

As can be seen from the above technical solutions, the method and device for user login verification in a Web application provided by the present invention, when receiving a user session request sent by a client, firstly verify the user according to the verification data of the user stored in the client. Whether the login is allowed; if the verification data of the user stored in the client is consistent with the verification data of the user currently stored in the server, the user is allowed to log in; if it is inconsistent, the verification fails, and the verification number of the user stored in the client is further judged Whether it is consistent with the verification number of the user currently stored by the server, and if not, returns information to the client that requires the user to enter a password for verification.

It can be seen that, the user login verification method and device in the web application of the present invention first authenticate the user through the verification data and verification number stored in the client, without requiring the user to enter a password every time he accesses, and does not need to enter a password in the client. The user's password needs to be stored to ensure the security of the user's login information.

Description of drawings

In order to explain the embodiments of the present invention or the technical solutions in the prior art more clearly, the following briefly introduces the accompanying drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are only These are some embodiments of the present invention. For those of ordinary skill in the art, other drawings can also be obtained according to these drawings without creative efforts.

1 is a flowchart of a user login verification method in a Web application provided by an embodiment of the present invention;

2 is a schematic diagram of a client and a server in a Web application in an embodiment of the present invention;

3 is a flowchart of a user login verification method in a Web application provided by another embodiment of the present invention;

4 is a schematic diagram of a user login verification device in a Web application provided by an embodiment of the present invention;

FIG. 5 is a schematic diagram of a user login verification device in a Web application according to another embodiment of the present invention.

Detailed ways

In order to make those skilled in the art better understand the technical solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described The embodiments are only some of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

Referring to FIG. 1, a method for user login verification in a Web application provided by an embodiment of the present invention includes steps:

S10: When receiving the user's session request sent by the client, determine whether the verification data of the user stored in the client is consistent with the verification data of the user currently stored in the server.

When a user accesses a Web page, the client sends a session request to the server to access the page.

In the method of this embodiment, please refer to FIG. 2 , the user name, verification data and verification number of the user are stored in the client 100 , and correspondingly, the user name, verification data and verification number of the user are also stored in the server 101 . The verification data stored in the client 100 and the verification data stored in the server 101 are updated each time the user initiates a session request, that is, the verification data updated each time is only valid in one login session. The verification number stored in the client 100 and the verification number stored in the server 101 are updated when the user enters a password, and the verification succeeds according to the password entered by the user and the user is allowed to log in.

In this step, when the session request sent by the client terminal 100 is received, it is determined whether the verification data of the user stored in the client terminal 100 is consistent with the verification data of the user currently stored in the server 101 .

If yes, go to step S11.

S11: The verification is successful, the user is allowed to log in, and the verification data of the user stored in the client and the verification data of the user stored in the server are updated.

The user is allowed to log in this time, and the user logs in successfully.

If not, go to step S12.

S12: The verification fails, and it is judged whether the verification number of the user stored in the client is consistent with the verification number of the user currently stored in the server.

If not, go to step S13.

S13: Return information to the client that requires the user to input a password for verification.

The verification number stored in the client 100 and the verification number stored in the server 101 are updated when the user enters the password, and the verification is successful according to the password entered by the user and the user is allowed to log in. The verification number is inconsistent with the verification number of the user currently stored in the server 101, indicating that there may be an abnormal login using the password for the user, and the user is required to re-enter the password for verification in this step.

It can be seen that, the user login verification method in the Web application of this embodiment first authenticates the user through the verification data and verification number stored in the client, and does not require the user to enter a password every time he accesses, and does not require a password in the client. By storing the user's password, the security of the user's login information is guaranteed, and compared with the prior art, the security of the user's login is improved.

Please refer to FIG. 3 , a method for user login verification in a Web application provided by another embodiment of the present invention includes steps:

S20: When receiving the session request of the user sent by the client, determine whether the verification data of the user stored in the client is consistent with the verification data of the user currently stored in the server.

When a user accesses a Web page, the client sends a session request to the server to access the page.

In the method of this embodiment, please refer to FIG. 2 , the user name, verification data and verification number of the user are stored in the client 100 , and correspondingly, the user name, verification data and verification number of the user are also stored in the server 101 . The verification data stored in the client 100 and the verification data stored in the server 101 are updated each time the user initiates a session request, that is, the verification data updated each time is only valid in one login session. The verification number stored in the client 100 and the verification number stored in the server 101 are updated when the user enters a password, and the verification succeeds according to the password entered by the user and the user is allowed to log in.

When the session request sent by the client terminal 100 is received, it is determined whether the verification data of the user stored in the client terminal 100 is consistent with the verification data of the user currently stored in the server terminal 101 .

If yes, go to step S21.

S21: The verification is successful, the user is allowed to log in, and the verification data of the user stored in the client and the verification data of the user stored in the server are updated.

The user authentication for this session is successful, and the user is allowed to log in.

If not, go to step S22.

S22: The verification fails, and it is judged whether the verification number of the user stored in the client is consistent with the verification number of the user currently stored in the server.

The verification data of the user stored in the client 100 is inconsistent with the verification data of the user currently stored in the server 101, indicating that the verification data stored in the server 101 has been changed, it may be the login information of the user stored in the client, Including username and authentication data is used to log in on other devices.

At this time, it is further determined whether the verification number of the user stored in the client 100 is consistent with the verification number of the user currently stored in the server 101 .

If no, go to step S23; if yes, go to step S24.

S23: Return information to the client that requires the user to input a password for verification.

Based on the verification number stored in the client 100 and the verification number stored in the server 101, when the user enters the password, and is updated according to the password entered by the user and the verification is successful and the user is allowed to log in, therefore, if the user stored in the client 100 The verification number of the user is inconsistent with the verification number of the user currently stored in the server 101, indicating that the user account has re-logged in by entering a password on other client devices. In this case, the user may log in again by entering the password on another device, or the user's password has been stolen. In this step, the user is required to enter the password for verification, and the user can determine whether to change the password according to the actual situation.

S25: Determine whether the password input by the user provided by the client is correct.

When the user inputs the password through the client terminal 100, it is verified whether the password input by the user is correct.

If yes, go to step S26; if no, go to step S27.

S26: Allow the user to log in, and update the verification number and verification data of the user stored in the client and the verification number and verification data of the user stored in the server.

The access verification is successful, and the user is allowed to log in.

S27: The user is not allowed to log in. User authentication failed for this visit.

S24: Return the information prompting the user to change the password to the client.

If the verification data of the user stored in the client 100 is inconsistent with the verification data of the user currently stored in the server 101, and the verification number of the user stored in the client 100 is consistent with the verification number of the user currently stored in the server 101, Indicates that the verification data stored in the server 101 has been changed, it may be that the verification data stored in the client 100 is used to log in on other client devices, and the verification data and verification number of the user on the client may have been stolen. In the case of , it will return information to the client to prompt the user to change the password. Therefore, the method can prompt the user in time when the login is abnormal, prompt the user to change the password in time, and improve the security.

Further, in the user login verification method in the Web application described in the above embodiments, preferably, the user's verification data and verification number stored in the client are encrypted, and the user's verification number stored in the server is encrypted. The verification data and verification number are encrypted. The user's verification data and verification number stored in the client and server are encrypted and stored to further improve the security of user login information. In specific implementation, optionally, a secure hash algorithm (Secure Hash Algorithm, SHA) can be used to encrypt the verification data and verification number, specifically SHA512. SHA512 is a hash algorithm that is very suitable for storing passwords and can balance the system. efficiency and safety. Hash is the extraction of information, usually its length is much smaller than the information, and it is a fixed length. A strong cryptographic hash is irreversible, which means that no part of the original information can be derived from the hash result, which can effectively improve the security of user login information.

Further, the user login verification method in the Web application described in the above embodiments further includes: periodically updating the verification data and verification number of the user stored in the server at the same time. In this method, the verification data and verification number of the user stored in the server are periodically updated at the same time, so as to prevent the user's login information from being cracked. When the user logs in with password authentication when logging in on the client, new verification data and verification number will be generated and stored in the client.

Correspondingly in the above-mentioned step S22, when it is judged that the verification data of the user stored in the client is inconsistent with the verification data of the user currently stored in the server, and the verification fails, it may also be that the server 101 regularly updates the stored login information (including the verification data). and verification number), the user is also required to enter a password for re-authentication through the subsequent process, so that the verification data and verification number in the client are updated.

Correspondingly, referring to FIG. 4 , an embodiment of the present invention further provides a user login verification device in a Web application, including:

The first judgment module 20 is used to judge whether the verification data of the user stored in the client is consistent with the verification data of the user currently stored in the server when receiving the session request of the user sent by the client;

The login module 21 is used for if the verification data of the user stored in the client is consistent with the verification data of the user currently stored in the server, the verification is successful, the user is allowed to log in, and the client is updated The verification data of the user stored in the terminal and the verification data of the user stored in the server;

The second judgment module 22 is configured to judge the authentication data of the user stored in the client if the authentication data of the user stored in the client is inconsistent with the authentication data of the user currently stored in the server Whether the number is consistent with the verification number of the user currently stored by the server;

The first prompting module 23 is configured to return to the client and request the user to input a password if the verification number of the user stored in the client is inconsistent with the verification number of the user currently stored in the server The verification information, the user's verification number stored in the client and the user's verification number stored in the server, are updated when the verification is successful according to the password input by the user and the user is allowed to log in.

It can be seen that, when the user login verification device in the web application of this embodiment receives the session request of the user sent by the client, the first judgment module firstly verifies whether the user is authenticated according to the verification data of the user stored in the client. Allow login; if the user's verification data stored in the client is consistent with the user's verification data currently stored in the server, the login module allows the user to log in, and updates the user's verification data stored in the client and the server. The verification data of the user; if it is inconsistent, the verification fails, and the second judgment module judges whether the verification number of the user stored in the client is consistent with the verification number of the user currently stored in the server. The client returns information that requires the user to enter a password for authentication.

The user login verification device in the Web application of this embodiment firstly verifies the user through the verification data and verification number stored in the client, without requiring the user to enter a password every time he accesses, and does not need to store the user's password in the client , the security of user login information is guaranteed, and the security of user login is improved compared with the prior art.

Further, please refer to FIG. 5 , in the user login verification device in the Web application of this embodiment, it also includes:

The third judgment module 24 is used for judging whether the password input by the user provided by the client is correct;

The login module 21 is further configured to allow the user to log in if the password input by the user provided by the client is correct, and update the verification number and verification data of the user stored in the client, and the The verification number and verification data of the user stored in the server; if not, the user is not allowed to log in.

When the user inputs the password through the client terminal 100, it is verified whether the password input by the user is correct. If the password is correct, the access verification is successful, the user is allowed to log in, and the user's verification number and verification data stored in the client and the user's verification number and verification data stored in the server are updated. If the password is incorrect, the login of the access user will fail.

In this embodiment, the user login verification device in the Web application further includes:

The second prompting module 25 is configured to return to the client a message prompting the user to change the password if it is determined that the verification number of the user stored in the client is inconsistent with the verification number of the user currently stored in the server information.

If the verification data of the user stored in the client 100 is inconsistent with the verification data of the user currently stored in the server 101, and the verification number of the user stored in the client 100 is consistent with the verification number of the user currently stored in the server 101, Indicates that the verification data stored in the server 101 has been changed. It may be that the verification data stored in the client 100 is used to log in on other client devices. There may be user login information on the client, including verification data and verification. If the number is stolen, it will return to the client a message prompting the user to change the password. Therefore, the device can prompt the user in time when the login is abnormal, prompt the user to change the password in time, and improve the security.

Further preferably, the user login verification device in the web application of this embodiment further includes: an update module for periodically updating the verification data and verification number of the user stored in the server at the same time. The device periodically updates the user's verification data and verification number stored in the server at the same time, so as to prevent the user's login information from being cracked. When the user logs in with password authentication when logging in on the client, new verification data and verification number will be generated and stored in the client.

Further preferably, in the device of this embodiment, the user's verification data and verification number stored in the client are encrypted, and the user's verification data and verification number stored in the server are encrypted. The user's verification data and verification number stored in the client and server are encrypted and stored to further improve the security of user login information. In specific implementation, optionally, a secure hash algorithm (Secure Hash Algorithm, SHA) can be used to encrypt the verification data and verification number, specifically SHA512. SHA512 is a hash algorithm that is very suitable for storing passwords and can balance the system. efficiency and safety. Hash is the extraction of information, usually its length is much smaller than the information, and it is a fixed length. A strong cryptographic hash is irreversible, which means that no part of the original information can be derived from the hash result, which can effectively improve the security of user login information.

The method and device for user login verification in a Web application provided by the present invention have been described above in detail. The principles and implementations of the present invention are described herein by using specific examples, and the descriptions of the above embodiments are only used to help understand the method and the core idea of the present invention. It should be pointed out that for those skilled in the art, without departing from the principle of the present invention, several improvements and modifications can also be made to the present invention, and these improvements and modifications also fall within the protection scope of the claims of the present invention.

Claims (10)

1. A user login verification method in a Web application is characterized by comprising the following steps:

when a session request of a user sent by a client is received, judging whether the verification data of the user stored in the client is consistent with the verification data of the user currently stored in a server;

if so, the authentication is successful, the user is allowed to log in, and the authentication data of the user stored in the client and the authentication data of the user stored in the server are updated;

if not, the verification fails, and whether the verification number of the user stored in the client is consistent with the verification number of the user currently stored in the server is judged;

if not, returning information for requiring the user to input the password for verification to the client, wherein the verification number of the user stored in the client and the verification number of the user stored in the server are updated when the verification is successful according to the password input by the user and the user is allowed to log in; and if so, returning information for prompting the user to modify the password to the client.

2. The method of claim 1, further comprising: judging whether the password input by the user provided by the client is correct or not;

if so, allowing the user to log in, and updating the authentication number and the authentication data of the user stored in the client, and the authentication number and the authentication data of the user stored in the server;

if not, the user is not allowed to log in.

3. The method of claim 1, further comprising: and if the verification number of the user stored in the client is judged to be inconsistent with the verification number of the user currently stored in the server, returning information for prompting the user to modify the password to the client.

4. The method of claim 1, further comprising: and updating the verification data and the verification number of the user stored in the server at the same time regularly.

5. The method according to any one of claims 1 to 4, wherein the authentication data and the authentication number of the user stored in the client are encrypted, and the authentication data and the authentication number of the user stored in the server are encrypted.

6. A user login authentication apparatus for a Web application, comprising:

the first judgment module is used for judging whether the verification data of the user stored in the client is consistent with the verification data of the user currently stored in the server or not when receiving a session request of the user sent by the client;

the login module is used for successfully verifying the user if the verification data of the user stored in the client is consistent with the verification data of the user currently stored in the server, allowing the user to login and updating the verification data of the user stored in the client and the verification data of the user stored in the server;

the second judgment module is used for judging whether the verification number of the user stored in the client side is consistent with the verification number of the user currently stored in the server side or not if the verification data of the user stored in the client side is inconsistent with the verification data of the user currently stored in the server side;

the first prompting module is used for returning information for requiring the user to input a password for verification to the client if the verification number of the user stored in the client is inconsistent with the verification number of the user currently stored in the server, and the verification number of the user stored in the client and the verification number of the user stored in the server are updated when the verification is successful according to the password input by the user and the user is allowed to log in; and if the authentication number of the user stored in the client is consistent with the authentication number of the user currently stored in the server, returning information for prompting the user to modify the password to the client.

7. The apparatus for authenticating user login in a Web application according to claim 6, further comprising:

the third judging module is used for judging whether the password input by the user and provided by the client is correct or not;

the login module is also used for allowing the user to log in if the password input by the user provided by the client is correct, updating the authentication number and the authentication data of the user stored in the client, and updating the authentication number and the authentication data of the user stored in the server; if not, the user is not allowed to log in.

8. The apparatus for authenticating user login in a Web application according to claim 6, further comprising:

and the second prompting module is used for returning information for prompting the user to modify the password to the client if the verification number of the user stored in the client is judged to be inconsistent with the verification number of the user currently stored in the server.

9. The apparatus for authenticating user login in a Web application according to claim 6, further comprising:

and the updating module is used for updating the verification data and the verification number of the user stored in the server at the same time regularly.

10. The apparatus according to any one of claims 6 to 9, wherein the authentication data and the authentication number of the user stored in the client are encrypted, and the authentication data and the authentication number of the user stored in the server are encrypted.

Images