CN112039913A - Server API calling method, device and storage medium - Google Patents

Abstract

The invention relates to a method, a device and a storage medium for calling a server API (application program interface), wherein the method comprises the following steps: the client sends an API access request; the server receives the API access request and analyzes the API access request to obtain corresponding analysis data; judging whether a repeated calling event exists or not according to the analyzed data, if so, terminating the API calling process and outputting corresponding warning information to the client; otherwise, setting API calling information based on the expiration time in the configuration file so as to call the API of the server side and return a calling result to the client side. Compared with the prior art, the method and the device adopt a mode of combining the redis transaction with the lua script to carry out idempotent verification on the API, can effectively prevent malicious repeated operation of an attacker, and ensure the safety of data.

Description

Server API calling method, device and storage medium

Technical Field

The invention relates to the technical field of Internet API security, in particular to a server side API calling method, a server side API calling device and a storage medium.

Background

Kong is an API gateway that forwards API communications between clients and (micro) services, primarily extending functionality through plug-ins, and has two main components:

1. kong Server, a nginx based Server, is used to receive API requests.

2. Apache Cassandra-used to store operational data.

In practical applications, a user can horizontally expand Kong services through multiple KongServer machines and distribute requests to these machines through a load balancer placed in front, and two Cassandra nodes are sufficient to support most cases, and it is considered appropriate to add more nodes unless the network is very congested.

One of the most attractive features of Kong for an open source community is that existing functions can be extended by plug-ins that are executed during the life of the API request response loop, which are written in Lua, and Kong can also have several basic functions: http basic authentication, key authentication, CORS, TCP, UDP, file logging, API request throttling, request forwarding, and nginx monitoring. In order to ensure the security of API call, at present, a signature process is usually performed on a message by means of the HAMC technology of Kong to prevent the message from being modified by a person during the transmission process, and specifically, the process is to perform a MAC algorithm on the message to obtain a digest string, then perform the same calculation after the message is obtained by a receiver, and finally compare whether the MAC strings are consistent to ensure the security of data and prevent replay attack. However, in practical applications, if an attacker obtains the client request information, the attacker can repeatedly invoke the interface within a certain time, which causes a potential safety hazard in the API invoking process.

Disclosure of Invention

The present invention is directed to overcome the above-mentioned drawbacks of the prior art, and provides a method, an apparatus, and a storage medium for calling a server API, which can prevent malicious repetitive operations of an attacker and provide security for data.

The purpose of the invention can be realized by the following technical scheme: a service side API calling method comprises the following steps:

s1, the client sends an API access request;

s2, the server receives the API access request and analyzes the API access request to obtain corresponding analysis data;

s3, judging whether a repeated calling event exists according to the analysis data, if so, executing a step S4, otherwise, executing a step S5;

s4, terminating the API calling process and outputting corresponding warning information to the client;

and S5, setting API calling information based on the expiration time in the configuration file to call the API of the server side, and returning the calling result to the client side.

Further, the specific process of step S1 is as follows: the client sends an API access request and sets a unique value in the request header.

Further, the step S2 specifically includes the following steps:

s21, the server receives the API access request;

and S22, analyzing the API access request to obtain the unique value in the request header, namely the analyzed data.

Further, the step S3 is to check the idempotency to determine whether there is a repeat call event.

Further, the step S3 specifically includes the following steps:

s31, judging whether a unique value exists in the redis transaction in a lua script mode;

s32, if yes, indicating that the repeated calling event exists, and then executing a step S4;

s33, if not, indicating that no repeated calling event exists, and then executing step S5.

Further, the warning message in step S4 is specifically "do not need to be repeatedly submitted".

Further, the step S5 specifically includes the following steps:

s51, acquiring the expiration time in the configuration file;

s52, setting corresponding API call information in the redis transaction according to the expiration time;

and S53, calling the API from the server side according to the set API calling information, and returning the calling result to the client side.

Further, the API call information includes a unique value and its survival time.

A server API calling apparatus, comprising:

the receiving module is used for receiving an API access request sent by a client;

the analysis module is used for analyzing the received API access request to acquire analysis data;

the processing module is used for judging whether a repeated calling event exists according to the analysis data and setting corresponding API calling information according to the expiration time in the configuration file;

and the calling module is used for calling the corresponding API from the server side according to the API calling information.

A storage medium having stored thereon a computer program which, when executed by a processor, implements a server API calling method as claimed in any one of the preceding claims.

Compared with the prior art, the unique value is set in the API access request header sent by the client, the unique value is judged whether to exist in the redis transaction or not in a mode of combining the redis transaction with the lua script, so that the idempotency verification of the API is realized, even if an attacker obtains the request information of the client, the repeated calling attack of the interface cannot be carried out, namely, the malicious repeated operation of the attacker can be prevented, the repeated calling attack of the interface is avoided, and the safety of data is effectively ensured.

Drawings

FIG. 1 is a schematic flow diagram of the process of the present invention;

FIG. 2 is a schematic flow chart of an embodiment;

FIG. 3 is a schematic structural diagram of an API call apparatus according to the present invention;

the notation in the figure is: 201. the device comprises a receiving module 202, an analyzing module 203, a processing module 204 and a calling module.

Detailed Description

The invention is described in detail below with reference to the figures and specific embodiments.

Examples

As shown in fig. 1, a method for calling a service API includes the following steps:

s1, the client sends an API access request, and a unique value is set in the API access request head;

s2, the server receives the API access request and analyzes the API access request to obtain corresponding analysis data, wherein the analysis data is the unique value in the API access request header;

s3, according to the analysis data, by checking idempotent, judging whether a repeated calling event exists, if so, executing a step S4, otherwise, executing a step S5, specifically:

judging whether a unique value exists in the redis transaction in a lua script mode;

if yes, indicating that the repeated calling event exists, and then executing the step S4;

if not, indicating that no repeated calling event exists, and then executing the step S5;

s4, terminating the API call process, and outputting corresponding warning information to the client, in this embodiment, the warning information is set as "don't repeat submission";

s5, based on the expiration time in the configuration file, API call information is set in the redis transaction to call the API of the server side, and a call result is returned to the client side, wherein the API call information comprises a unique value and the survival time of the unique value.

The embodiment applies the method, and the specific application flow is shown in fig. 2:

the client transmits a unique value key at a request head;

the server obtains the unique value key in the request header and then checks the idempotency of the redis transaction using lua: judging whether the unique value key exists in the redis transaction or not in the lua script, and if so, returning a request of no repeated submission to the client;

if the unique value key does not exist, acquiring the expiration time in the configuration file to set the unique value key and the survival time in the redis transaction, then calling the API of the server side, and returning the calling result to the client side.

The embodiment of the invention also provides a server API calling device, which comprises a receiving module 201, an analysis module 202, a processing module 203 and a calling module 204 which are connected in sequence, wherein the input end of the receiving module 201 is connected with the client, and the output end of the calling module 204 is connected with the client, specifically, the receiving module 201 is used for receiving an API access request sent by the client;

the analysis module 202 is configured to analyze the received API access request to obtain analysis data;

the processing module 203 is configured to determine whether a repeated calling event exists according to the analysis data, and set corresponding API calling information according to expiration time in the configuration file;

and the calling module 204 is used for calling the corresponding API from the server according to the API calling information.

Another embodiment of the present invention also provides a storage medium storing computer-readable instructions, which when executed by one or more processors, enable the one or more processors to execute the above-mentioned server API calling method.

In summary, the present invention adopts redis + lua to ensure the idempotency of API, and can provide security assurance for data, and effectively prevent malicious repeated operations of an attacker, for example, when a user needs to perform a refund operation, a unique value is set in a request header sent by a client, a server checks whether the unique value exists in a redis transaction, that is, performs the idempotency verification of the refund API, if the verification is successful, that is, the unique value does not exist in the redis transaction, a subsequent refund flow is executed, and if the verification fails, that is, the unique value exists in the redis transaction, it indicates that repeated calling has occurred, so that repeated calling attack of the attacker can be prevented, and the security of API calling is improved.

Claims (10)

1. A server side API calling method is characterized by comprising the following steps:

s1, the client sends an API access request;

s2, the server receives the API access request and analyzes the API access request to obtain corresponding analysis data;

s3, judging whether a repeated calling event exists according to the analysis data, if so, executing a step S4, otherwise, executing a step S5;

s4, terminating the API calling process and outputting corresponding warning information to the client;

and S5, setting API calling information based on the expiration time in the configuration file to call the API of the server side, and returning the calling result to the client side.

2. The method for calling the API of the server according to claim 1, wherein the specific process of step S1 is as follows: the client sends an API access request and sets a unique value in the request header.

3. The method for calling the API of the server according to claim 2, wherein the step S2 specifically includes the following steps:

s21, the server receives the API access request;

and S22, analyzing the API access request to obtain the unique value in the request header, namely the analyzed data.

4. The method as claimed in claim 3, wherein the step S3 is implemented by checking idempotent to determine whether there is a repeat call event.

5. The server API calling method according to claim 4, wherein the step S3 specifically includes the following steps:

s31, judging whether a unique value exists in the redis transaction in a lua script mode;

s32, if yes, indicating that the repeated calling event exists, and then executing a step S4;

s33, if not, indicating that no repeated calling event exists, and then executing step S5.

6. The method as claimed in claim 1, wherein the warning message in step S4 is "don't repeat submission".

7. The method for calling the API of the server according to claim 2, wherein the step S5 specifically includes the following steps:

s51, acquiring the expiration time in the configuration file;

s52, setting corresponding API call information in the redis transaction according to the expiration time;

and S53, calling the API from the server side according to the set API calling information, and returning the calling result to the client side.

8. The server-side API calling method of claim 2, wherein the API call information includes a unique value and its time-to-live.

9. A server API calling apparatus, comprising:

a receiving module 201, configured to receive an API access request sent by a client;

the analysis module 202 is configured to analyze the received API access request to obtain analysis data;

the processing module 203 is configured to determine whether a repeated calling event exists according to the analysis data, and set corresponding API calling information according to expiration time in the configuration file;

and the calling module 204 is used for calling the corresponding API from the server according to the API calling information.

10. A storage medium having stored thereon a computer program, characterized in that the computer program, when executed by a processor, implements the server API calling method according to any of claims 1 to 8.

Images