CN108809957A - Method for preventing access request of wechat enterprise number from being forged - Google Patents

Abstract

The invention discloses a method for preventing a forged WeChat enterprise number access request, which comprises a first process chain and a second process chain; the first flow chain comprises the following steps: the front end logs in the server through the enterprise number, and obtains user ID information of the enterprise number based on OAUTH single sign-on; generating a temporary authorization instruction by using the user ID information; storing temporary authorization instructions to front-end local cookies; the second process chain comprises the following steps: the front end sends out the operation of requesting the data interface to the server through the enterprise number; judging whether temporary authorization instructions corresponding to the request operation exist in the cookies or not, if not, the front end has no operation authority, and if so, the corresponding data interface returns the service data to the enterprise number of the front end; the design is equivalent to encrypting the ID information of the user, and an attacker cannot acquire the ID information of the user, so that access requests of forged WeChat enterprise numbers are prevented, and the intrusiveness to the original service interface is low.

Description

A method to prevent forged WeChat enterprise account access requests

technical field

The invention relates to the technical field of network communication, in particular to a method for preventing forged WeChat enterprise account access requests.

Background technique

The enterprise account is the mobile application portal provided by WeChat for enterprise customers. Based on the OAUTH jump (OAUTH single sign-on), the user's information can be obtained from the message pushed by the enterprise account or the menu under the enterprise account application, such as the user's ID information, etc. Wait. The process of jumping to the H5 page of the business product triggered in the enterprise account can indeed ensure the reliability of user information through the OAUTH mechanism, but it is difficult to ensure the reliability of the H5 page after the jump and the jump and related interface requests in the H5 page. Reliable authenticity for end users. Generally, there are two processing methods in the market. First, by blocking the sharing operation of the H5 page, the information of the H5 page can indeed be hidden, but blocking the sharing operation of the H5 page is a native operation of the WeChat client, and there is a certain delay. When the user operates fast enough, it is still possible to copy the link. Second, obfuscating the H5 front-end code can weaken the readability of the front-end code to a certain extent, increase the attacker's analysis of the front-end code and data flow, and increase the cost of reading. , but it is often possible for an attacker to simulate user information through data simulation or packet capture tools, thereby achieving the purpose of the attack.

Contents of the invention

In order to solve the above-mentioned technical problems, the object of the present invention is to provide a method for preventing forged WeChat enterprise account access requests.

The technical scheme adopted in the present invention is:

A method for preventing forged WeChat enterprise account access requests, including a first process chain and a second process chain;

The first process chain includes the following steps:

The front end logs in to the server through the enterprise number, and obtains the user ID information of the enterprise number based on OAUTH single sign-on;

Generate temporary authorization instructions using user ID information;

Save the temporary authorization instruction to the front-end local cookies;

The second process chain includes the following steps:

The front end sends a request data interface operation to the server through the enterprise number;

Determine whether there is a temporary authorization instruction corresponding to the requested operation in the cookies,

If not, the front end has no operation authority,

If so, the corresponding data interface returns business data to the front-end enterprise number.

In the first process chain, while using the user ID information to generate the temporary authorization instruction, set the effective time of the temporary authorization instruction;

In the second process chain, if there is a temporary authorization instruction corresponding to the requested operation in the cookies, it is also necessary to judge whether the temporary authorization instruction has expired according to the effective time of the temporary authorization instruction.

If not, the corresponding data interface returns the business data to the front-end enterprise number,

If yes, return to the first process chain, and need the enterprise number to re-login to the server to regenerate the temporary authorization instruction.

In the second process chain, the front end jumps to the H5 page through the login of the enterprise number, and the H5 page requests a data interface from the server.

Beneficial effects of the present invention:

In the access request method of the present invention, in the first process chain, when the user logs in to the server through the enterprise number, the user ID information of the enterprise number is obtained based on OAUTH single sign-on, and the user ID information is generated into a temporary authorization instruction, and in the future In the access request, it is the second process chain, jumping to the H5 page, the front end sends the request data interface operation to the server through the enterprise number, and judges the temporary authorization instruction in the cookies, when there is a temporary authorization instruction corresponding to the requested operation , the corresponding data interface returns the business data to the front-end enterprise number, which is equivalent to encrypting the user’s ID information, and the attacker cannot obtain the user’s ID information, thereby preventing forged WeChat enterprise numbers from making access requests and affecting the original business The interface is less intrusive.

Description of drawings

The specific embodiments of the present invention will be further described below in conjunction with the accompanying drawings.

Fig. 1 is a schematic flowchart of the access request method of the present invention.

Detailed ways

As shown in Figure 1, the present invention includes a first process chain and a second process chain;

The first process chain includes the following steps:

The front end logs in to the server through the enterprise number, and obtains the user ID information of the enterprise number based on OAUTH single sign-on;

Generate temporary authorization instructions using user ID information;

Save the temporary authorization instruction to the front-end local cookies;

The second process chain includes the following steps:

The front end sends a request data interface operation to the server through the enterprise number;

Determine whether there is a temporary authorization instruction corresponding to the requested operation in the cookies,

If not, the front end has no operation authority, and correspondingly returns an error code 202 to the front end, marking that it has no authority to call the interface.

If so, the corresponding data interface returns business data to the front-end enterprise number.

Among them, OAUTH single sign-on provides a safe, open and simple standard for authorization of user resources. Any third party uses the OAUTH authentication service, and any service provider can implement its own OAUTH authentication service, so OAUTH is open. The industry provides multiple implementations of OAUTH such as PHP, JavaScript, Java, Ruby and other language development kits, which greatly saves programmers' time, so OAuth is simple. Many Internet services such as Open API, and many large companies such as Google, Yahoo, Microsoft, etc. provide OAUTH authentication services. Here, under the official account provided by WeChat, users can enter account numbers and passwords based on OAUTH to perform single sign-on. In this way, the user ID information is obtained, and the temporary authorization instruction is returned to the server, and the server does not directly obtain the user ID information.

In the second process chain, the front end jumps to the H5 page through the enterprise account login, and the H5 page requests the data interface from the server. Here, each interface method will be annotated through AOP (spring aspect method). The benefits of the AOP annotation are: No intrusion to the original interface.

Further, in the first process chain, while using the user ID information to generate the temporary authorization instruction, set the effective time of the temporary authorization instruction, where the effective time can be formulated by the developer;

In the second process chain, if there is a temporary authorization instruction corresponding to the requested operation in the cookies, it is also necessary to judge whether the temporary authorization instruction has expired according to the effective time of the temporary authorization instruction.

If not, the corresponding data interface returns the business data to the front-end enterprise number,

If so, return to the first process chain, and need to re-login the server with the enterprise number to regenerate the temporary authorization instruction, and return error code 203.

In the access request method of the present invention, in the first process chain, when the user logs in to the server through the enterprise number, the user ID information of the enterprise number is obtained based on OAUTH single sign-on, and the user ID information is generated into a temporary authorization instruction, and in the future In the access request, it is the second process chain, jumping to the H5 page, the front end sends the request data interface operation to the server through the enterprise number, and judges the temporary authorization instruction in the cookies, when there is a temporary authorization instruction corresponding to the requested operation , the corresponding data interface returns the business data to the front-end enterprise number, which is equivalent to encrypting the user’s ID information, and the attacker cannot obtain the user’s ID information, thereby preventing forged WeChat enterprise numbers from making access requests and affecting the original business The interface is less intrusive.

The above descriptions are only preferred implementations of the present invention, and the present invention is not limited to the above-mentioned implementations, as long as the technical solutions that achieve the purpose of the present invention by basically the same means fall within the protection scope of the present invention.

Claims (3)

1. a kind of method for preventing from forging wechat enterprise number access request, which is characterized in that including first pass chain and second Journey chain；

First pass chain includes the following steps：

Front end obtains user's id information of enterprise number based on OAUTH single-sign-ons by enterprise number login service end；

Temporary Authorization is generated using user's id information to instruct；

Temporary Authorization instruction is preserved to front-end local cookies；

Second procedure chain includes the following steps：

Front end sends out the operation of request data interface by enterprise number to server；

Judge to instruct with the presence or absence of the temporary Authorization of corresponding request operation in cookies,

If it is not, then front end without operating right,

If so, corresponding data-interface returns to business datum to the enterprise number of front end.

2. a kind of method for preventing from forging wechat enterprise number access request according to claim 1, it is characterised in that：? In one flow chain, while generating temporary Authorization instruction using user's id information, the effective time of setting temporary Authorization instruction；

It, will also be according to interim if there is the temporary Authorization instruction of corresponding request operation in cookies in second procedure chain The effective time of authorized order judges whether temporary Authorization instruction is expired,

If it is not, then corresponding data-interface return business datum to front end enterprise number,

If so, return first pass chain, and need enterprise number again login service end with regenerate temporary Authorization instruction.

3. a kind of method for preventing from forging wechat enterprise number access request according to claim 1, it is characterised in that：? In two flow chains, front end is redirected by enterprise number login into the H5 pages, and the H5 pages are to server request data interface.