JP2014119815A - Web server and control method thereof and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a mechanism for flexibly controlling a request by a Web page and suppressing an illegal input.SOLUTION: In a web server, response information is stored in a Web page to store and control the response information stored in the Web page, on the Web server. A request to the Web page is received from an information processing device to determine whether the received request is a request related to a partial post back. When it is determined that the request is a partial post back, transmission of a retrieval result in response to the request is performed without comparison of the response information. When it is determined that the request is a post back, response information for uniquely identifying a Web page included in the request is compared with the response information stored in the web server. When the response information is matched, processing corresponding to the request is performed.

Description

  The present invention relates to a Web server that controls a request for a Web page, a control method thereof, and a program.

In a Web application that uses session information, a cushion page is provided at the time of login in order to prevent the user from duplicating a window or moving a page by using a right-click menu, and Web is opened by OpenWindow of JavaScript (registered trademark) Controls that the application always runs in a window with the same name.
Further, the display of browser standard buttons, menus, right-click menus and the like is also restricted by JavaScript (registered trademark).

  Furthermore, as described in Patent Document 1, a mechanism is disclosed in which the time of a server is embedded in markup text and double input from a browser is prevented based on this time.

JP 2004-13353 A

  However, with the advancement of Web application technology, partial postbacks can be realized on the screen displayed by the browser. When the input from the browser is repeated within the screen, there is no problem. May be a problem. For example, when registering in a database, it is problematic that a plurality of screens are launched and registered twice, but there is a case where a search by partial postback does not affect the database and does not cause a problem. Therefore, flexible control has been demanded.

  Accordingly, an object of the present invention is to provide a mechanism for flexibly performing control on a request from a Web page and suppressing unauthorized input.

  In order to achieve the object of the present invention, a web server capable of communicating with an information processing apparatus that displays a web page including response information for uniquely identifying a web page, the response information being stored in the web page A storage control unit that stores and controls response information stored in the Web page in the Web server, a request reception unit that receives a request for the Web page from the information processing apparatus, and a request received by the request reception unit is a partial A request determination unit that determines whether or not the request is for a postback, and a search according to the request without comparing response information when the request determination unit determines that the request is a partial postback. If the result is sent and it is determined that the request is a postback, the Web page included in the request And response information for uniquely identifying, comparing the response information stored in the Web server, if the response information match, and executes processing according to the request.

  According to the present invention, it is possible to flexibly control a request from a Web page and suppress unauthorized input.

System configuration diagram in this embodiment Hardware configuration diagram of client terminal and Web server Flowchart explaining processing on login page Flowchart explaining the process on the resident registration page Flowchart explaining the process of the resident registration page or employee search page Figure showing an example of the login page A figure showing an example of a resident registration page Figure showing an example of the employee search page Diagram showing data table A figure showing an example of various data The figure which shows an example of the page information of each page

  Hereinafter, an example of an information processing system including an information processing apparatus that is a Web server and an information processing apparatus that is a client terminal according to an embodiment of the present invention will be described with reference to the drawings.

FIG. 1 is a system configuration diagram of an information processing system including an information processing apparatus (hereinafter referred to as a Web server) that is a Web server and an information processing apparatus (hereinafter referred to as a client terminal) that is a client terminal.
The client terminal 100 and the Web server 200 are connected via a network (LAN or WAN).

The client terminal 100 is installed with a browser and can display a screen obtained from the Web server via the browser. In addition, the Web server 200 includes. A Web application developed using NET Framework or the like is operating, and executes processing in response to a request from the client terminal 100. The Web server 200 includes a data database (hereinafter referred to as DB), and is configured to call data from the DB or register data in the DB according to a request from the client terminal 100.
Hereinafter, the hardware configuration of the information processing apparatus applicable to the client terminal and the Web server illustrated in FIG. 1 will be described with reference to FIG.
FIG. 2 is a block diagram showing a hardware configuration of an information processing apparatus applicable to the client terminal and the Web server shown in FIG.

  In FIG. 2, reference numeral 201 denotes a CPU that comprehensively controls each device and controller connected to the system bus 204. Further, the ROM 202 or the external memory 211 is necessary to realize a BIOS (Basic Input / Output System) or an operating system program (hereinafter referred to as an OS), which is a control program of the CPU 201, or a function executed by each server or each PC. Various programs to be described later are stored.

  A RAM 203 functions as a main memory, work area, and the like for the CPU 201. The CPU 201 implements various operations by loading a program or the like necessary for execution of processing from the ROM 202 or the external memory 211 into the RAM 203 and executing the loaded program.

  An input controller 205 controls input from a keyboard (KB) 209 or a pointing device such as a mouse (not shown). A video controller 206 controls display on a display device such as a CRT display (CRT) 210. In FIG. 2, although described as CRT 210, the display device is not limited to the CRT, but may be another display device such as a liquid crystal display. These are used by the administrator as needed.

  A memory controller 207 is connected to the hard disk (HD), flexible disk (FD), or PCMCIA card slot for storing a boot program, various applications, font data, user files, editing files, various data, etc. via an adapter. The access to the external memory 211 such as a compact flash (registered trademark) memory is controlled.

  A communication I / F controller 208 is connected to and communicates with an external device via a network (for example, the network shown in FIG. 1), and executes communication control processing in the network. For example, communication using TCP / IP is possible.

  Note that the CPU 201 enables display on the CRT 210 by executing outline font rasterization processing on a display information area in the RAM 203, for example. In addition, the CPU 201 enables a user instruction with a mouse cursor (not shown) on the CRT 210.

  Various programs to be described later for realizing the present invention are recorded in the external memory 211 and executed by the CPU 201 by being loaded into the RAM 203 as necessary. Furthermore, definition files and various information tables used when executing the program are also stored in the external memory 211, and a detailed description thereof will be described later.

Next, detailed processing of the present embodiment will be described with reference to FIGS. Each step in each figure is executed by the CPU of each device.
First, the processing on the login page will be described with reference to FIG. FIG. 4 is a flowchart for explaining processing in the login page.

  In step S301, the client terminal 100 starts a browser in response to a user operation. In step S302, the client terminal 100 accepts an input of a URL corresponding to the web server 200 having a web application to log in in response to a user operation.

  In step S303, the client terminal 100 transmits an access request to the Web server 200 according to the input URL. In other words, it is a process of transmitting a login page request.

  In step S304, the Web server 200 receives a login page request. In step S <b> 305, a login page for inputting login user information is acquired from the external memory of the Web server 200.

  In step S306, session information between the client terminal 100 and the Web server for each user is generated. 10 is a diagram illustrating an example of session information. This session information is stored and managed by the Web server 200.

Here, the login information is NULL, and the response information stores “login” in the page name according to the page information of FIG. Note that the page generation date / time (login page acquisition date / time) and the generation number (random number uniquely generated by the Web server) are NULL, but the page generation date / time and generation number may be stored. In addition, 1003 of FIG. 10 is a figure which shows an example of response information.

  In step S307, the Web server 200 transmits the login page acquired in step S305 to the client terminal 100 that requested it. When transmitting the login page, it is determined whether the login page is displayed in a dedicated window, a session is generated, postback, or partial postback is performed according to the page information of FIG. In the page property of the login page, a dedicated window display “Yes” and a session generation possible “No” are set corresponding to 1101 and 1102 in FIG. Response information is set. At least the page name is set in the response information of the page property of the login page.

  In step S308, the client terminal 100 receives the login page. In step S309, the login page of FIG. 6 is displayed using a browser.

  In step S <b> 310, the client terminal 100 transmits login information including an employee code and a password as a user name input according to a user operation to the Web server 200.

In step S311, login information is received. In step S312, the received login information is authenticated. Authentication is performed by searching for a user on an authentication server or an authentication table. If the authentication is successful, in step S313, the employee code and password are stored in the login information of the session information managed by the Web server 200.
In step S314, the page to be transmitted next to the client terminal 100 is specified from the page information of FIG. 11, and the room occupant registration page is acquired.

  In step S315, the system date and time managed by the Web server 200 is acquired. In step S316, a random number is generated and a generation number is acquired. In step S317, the page name is acquired from the page information of FIG.

  In step S318, the information acquired in steps S315 to S317 is stored in the page property of the room occupant registration page. Note that the page name of the page property may be stored in advance in the room occupant registration page.

  In step S319, the response information of the session information is updated. More specifically, the information acquired in steps S315 to S317 is stored. In step S320, a room occupant registration page is transmitted to the client terminal 100.

Next, processing on the room occupant registration page will be described with reference to FIG. FIG. 4 is a flowchart for explaining processing in the room occupant registration page.
In step S401, the user registration page is received. In step S402, the user registration page shown in FIG. 7 is displayed on the browser.

  In step S403, an operation action for the room occupant registration page is determined. If the operated instruction is an input of a room code, the process proceeds to step S404. If the operated instruction is a full screen update of the resident registration page, the process proceeds to step S405 to search for employees. If the button is pressed, the process proceeds to step S406.

In step S404, as shown in 700 of FIG. 7, when the input of the room code is detected in 701, a partial postback request including the input room code and page property information of the room occupant registration page is transmitted to the Web server 200. .
In step S405, a postback request for updating the entire page including the page property information of the room occupant registration page is transmitted to the Web server 200.

  In step S406, the employee search button is pressed, and a postback request for requesting the employee search page of the next page is transmitted. When the registration button in FIG. 7 is pressed, a registration postback request including the displayed room code, employee information, and page properties is transmitted.

  In the case of partial postback, a value is stored during the partial postback event of the page property 1002, and in the case of postback, a value is stored during the postback event of the page property 1002. By referring to the value in the postback event during this partial postback event, the Web server can determine whether a request for partial postback or a request for postback has been made.

  In response to the requests in steps S404 to S406, a flag in the postback event and partial postback event of the page property 1002 in FIG. 10 is set and managed.

  In step S407, various requests from the client terminal 100 are received. Information on the requested page is acquired from the page information of FIG. 11 according to the received request. In the case of step S404 and step S405, since it is a request for updating the room occupant registration page, the page information of the record of the room occupant registration page is acquired. In step S406, since the employee search button is pressed, the page information of the employee search page which is the next page is acquired. In addition, when the list output button is pressed with reference to FIG. 7, in order to receive the request for the room entry list, page information of the room entry list (PDF) in FIG. 11 is acquired.

In the case of a registration request, page information corresponding to the requested page property is acquired to determine whether the dedicated window is Yes (step S410), whether it is a partial postback (step S413), and step S418. Move processing to. Here, if it is a request to register instead of a postback request to update the entire flow page, the process proceeds to step S420. In addition, the processing of steps S420, S421, and S422 to be described is performed, and when the response information matches, the employee information is registered in the DB corresponding to the room code. If registered, the registration result is transmitted to the client terminal 100.
If it is determined that the response information does not match, an error is transmitted in step S411, assuming that there is a request to register data from an unauthorized page.

  In step S408, it is determined whether the dedicated window display of the acquired page information is Yes or No. If Yes, the process proceeds to step S410 to determine that the page is to be displayed in a dedicated window. On the other hand, in the case of No, in order to determine that the page is not displayed in the dedicated window, the process proceeds to step S409. In the present embodiment, when the dedicated window display is No, it is page information of the room occupant list (PDF). Therefore, in step S409, the employee corresponding to the room code is acquired from the data 901 in FIG. Generate. Then, the PDF is transmitted to the client terminal 100 and displayed.

  In step S410, it is determined whether or not the session information of the user requested by the Web server 200 is managed. If it is determined that there is a session, the process proceeds to step S413. If it is determined that there is no session, the process proceeds to step S411.

  In step S411, since it is determined that the session is not managed, an error is transmitted to the client terminal 100. In step S412, the error is received and the error is displayed on the browser.

  In step S413, it is determined whether the request received in step S407 is a partial postback. If it is determined that it is a partial postback, the process proceeds to step S414. If it is determined that it is not a partial postback, the process proceeds to step S418.

  In step S414, a search is performed according to the input request. In this embodiment, the room code table 902 in FIG. 9 is searched according to the input room code “R1001”, and “in-house system server room” is acquired as a search result. In the case of a partial postback request, since the DB is not updated due to unauthorized access, the search result can be returned without determining the response information. Thereby, it is possible to reduce the load on the Web server and perform flexible control in the Web system.

  In step S415, the search result is transmitted. In this embodiment, “in-house system server room” is transmitted to the client terminal 100 as a result of the partial postback request. In step S416, the search result is received.

  In step S417, the received search result is displayed as 710 in FIG. More specifically, only “711” is updated and “in-house system server room” is displayed.

  In step S418, it is determined whether the request received in step S407 is a postback request for updating the entire page. If it is determined that the request is a postback request for updating the entire page, the process proceeds to step S420. If it is determined that the request is not a postback request for updating the entire page, the process proceeds to step S419. In this embodiment, when it is determined that the request is not a postback request for updating the entire page, it is a case of a postback request for the employee search page, which is the next page. In step S419, an employee search page is acquired.

In step S420, response information managed by the Web server 200 is acquired. In step 422, it is determined whether or not the response information included in the request received in step S407 is matched. If it is determined in step S422 that the response information does not match, the process proceeds to step S411, and an error notification is transmitted to the client terminal 100. This makes it possible to reject requests from screens that are not managed by the Web server 200 by determining whether the response information matches, such as when there are duplicate inputs when the screen is activated twice. Access can be suppressed. If it is determined in step S422 that the response information matches, the request is found from the regular screen, and the process proceeds to step S423.
In step S423, since it is a postback request for updating the entire page, the same room occupant registration page as the screen displayed on the client terminal is acquired.

  Next, processing subsequent to FIG. 4 will be described with reference to FIG. FIG. 5 is a flowchart for explaining processing of the room occupant registration page or the employee search page.

  In step S501, the page generation date and time is acquired with reference to the system time managed by the Web server 200 in order to transmit the room occupant registration page or the employee search page. In step S502, a random number as a generation number is acquired. Also, the page name (registered person registration or employee search) is acquired from the page information of FIG.

In step S504, the response information of the page property response of the acquired room resident registration page or employee search page is updated according to the information acquired in steps S501 to S503.
The page name may be stored in advance in the page property of each page.
In step S505, the response information of the session information of the Web server 200 is updated with the information acquired in steps S501 to S503.
In step S <b> 506, the page with updated response information (the user registration page or employee search page) is transmitted to the client terminal 100.

  In step S507, a page is received from the Web server 200. In step S508, the received page is displayed on the browser as shown in FIG. 8 is an example of an employee search page displayed when the employee search button is pressed in FIG. In the employee search page, when a department code is input, a partial postback request is transmitted to the Web server 200. The Web server 200 acquires a user name corresponding to the department code (not shown) from 901 in FIG. The result corresponding to is transmitted to the client terminal 100. At this time, since it is a partial postback request, a result corresponding to the request is transmitted without comparing response information. This process is the same as the process described in steps S407 to S416.

  In step S509, it is determined whether there is an instruction to end display on the browser close button or the displayed page. If there is an instruction indicating the end, the display is terminated and the process is terminated. If there is another operation instruction instead of an instruction indicating termination, a request corresponding to the instruction is transmitted to the Web server 200 (step S510).

  For example, when the list output button is pressed, a request for a list of occupants as the next page is transmitted, and the process proceeds to step S407 described above. In step S409, the result is transmitted.

  As described above, according to the present embodiment, it is possible to flexibly control a request from a Web page and suppress unauthorized input.

  Further, as one aspect of the present embodiment, the Web server capable of communicating with an information processing apparatus as a client terminal that displays a Web page including response information for uniquely identifying the Web page responds to the Web page. Storing information, storing and controlling response information stored in the Web page in the Web server, receiving a request for the Web page from the information processing apparatus (request reception), and the received request is a request for partial postback If it is determined whether the request is a partial postback, the search result is transmitted according to the request without comparing the response information, and the request is determined to be a postback. Response information for uniquely identifying the Web page included in the request and the Web Comparing the response information stored in over server, if the response information match, and executes a process corresponding to the request (execution control).

  Further, if the response information does not match, an error is transmitted to the information processing apparatus. Further, it is determined whether or not the Web page determined by the received request is a Web page to be displayed in another window in the information processing apparatus, and when it is determined to be a Web page to be displayed in another window, response information is displayed. It is characterized by comparing.

If the received request is a request for data registration and the response information matches, the data included in the request is registered, and the received request is a request for data registration and the response information matches. If not, an error is transmitted as an illegal request to the requested information processing apparatus. Further, the response information includes date information, acquires date information (date information acquisition), and sets the acquired date information in the response information.
It should be noted that the configuration and contents of the various data described above are not limited to this, and it goes without saying that the various data and configurations are configured according to the application and purpose.

  Although one embodiment has been described above, the present invention can take an embodiment as, for example, a system, apparatus, method, program, or recording medium, and specifically includes a plurality of devices. The present invention may be applied to a system including a single device.

  The program according to the present invention is a program that allows a computer to execute the processing methods of the flowcharts shown in FIGS. 3 to 5, and the storage medium according to the present invention is a program that allows the computer to execute the processing method of FIGS. Is remembered. The program in the present invention may be a program for each processing method of each apparatus in FIGS.

  As described above, a recording medium that records a program that implements the functions of the above-described embodiments is supplied to a system or apparatus, and a computer (or CPU or MPU) of the system or apparatus stores the program stored in the recording medium. It goes without saying that the object of the present invention can also be achieved by executing the reading.

  In this case, the program itself read from the recording medium realizes the novel function of the present invention, and the recording medium storing the program constitutes the present invention.

  As a recording medium for supplying the program, for example, a flexible disk, hard disk, optical disk, magneto-optical disk, CD-ROM, CD-R, DVD-ROM, magnetic tape, nonvolatile memory card, ROM, EEPROM, silicon A disk, solid state drive, or the like can be used.

  Further, by executing the program read by the computer, not only the functions of the above-described embodiments are realized, but also an OS (operating system) operating on the computer based on an instruction of the program is actually It goes without saying that a case where the function of the above-described embodiment is realized by performing part or all of the processing and the processing is included.

  Furthermore, after the program read from the recording medium is written to the memory provided in the function expansion board inserted into the computer or the function expansion unit connected to the computer, the function expansion board is based on the instructions of the program code. It goes without saying that the case where the CPU or the like provided in the function expansion unit performs part or all of the actual processing and the functions of the above-described embodiments are realized by the processing.

  Further, the present invention may be applied to a system composed of a plurality of devices or an apparatus composed of a single device. Needless to say, the present invention can be applied to a case where the present invention is achieved by supplying a program to a system or apparatus. In this case, by reading a recording medium storing a program for achieving the present invention into the system or apparatus, the system or apparatus can enjoy the effects of the present invention.

Furthermore, by downloading and reading a program for achieving the present invention from a server, database, etc. on a network using a communication program, the system or apparatus can enjoy the effects of the present invention.
In addition, all the structures which combined each embodiment mentioned above and its modification are also included in this invention.

100 Client terminal 200 Web server 201 CPU
202 ROM
203 RAM

Claims (7)

A web server capable of communicating with an information processing apparatus that displays a web page including response information for uniquely identifying a web page,
Storage control means for storing response information in the Web page and storing and controlling response information stored in the Web page in the Web server;
Request receiving means for receiving a request for the Web page from the information processing apparatus;
Request determination means for determining whether the request received by the request reception means is a request for partial postback; and
When the request determination unit determines that the request is a partial postback, the search result is transmitted according to the request without comparing response information, and the request is determined to be a postback. The response information for uniquely identifying the Web page included in the request is compared with the response information stored in the Web server, and if the response information matches, the process according to the request is executed. An execution control means for performing the processing.   The Web server according to claim 1, wherein the execution control unit transmits an error to the information processing apparatus when the response information does not match. A display determination unit for determining whether the Web page determined by the request received by the request reception unit is a Web page to be displayed in another window in the information processing apparatus;
3. The Web server according to claim 1, wherein the execution control unit compares response information when the display determination unit determines that the Web page is displayed in another window. 4.   The execution control means is the request received by the request receiving means is a request for data registration, and if the response information matches, the request included in the request is registered and the request received by the request receiving means 4 is a request for data registration, and if the response information does not match, an error is transmitted to the information processing apparatus that requested the request as an illegal request. Web server as described in 2. The response information includes date and time information,
Date and time information acquisition means for acquiring date and time information;
6. The Web server according to claim 1, wherein the date and time information acquired by the date and time information acquiring unit is set in the response information. A control method in a Web server capable of communicating with an information processing apparatus that displays a Web page including response information for uniquely identifying a Web page,
A storage control step of storing response information in the Web page and storing and controlling response information stored in the Web page in the Web server;
A request receiving step of receiving a request for the Web page from the information processing apparatus;
A request determination step for determining whether the request received in the request reception step is a request for partial postback; and
When the request determination step determines that the request is a partial postback, the search result is transmitted according to the request without comparing the response information, and the request is determined to be a postback. The response information for uniquely identifying the Web page included in the request is compared with the response information stored in the Web server, and if the response information matches, the process according to the request is executed. And an execution control step. A program executed on a Web server that can communicate with an information processing apparatus that displays a Web page including response information for uniquely identifying a Web page,
The web server
Storage control means for storing response information in the Web page and storing and controlling response information stored in the Web page in the Web server;
Request receiving means for receiving a request for the Web page from the information processing apparatus;
Request determination means for determining whether the request received by the request reception means is a request for partial postback; and
When the request determination unit determines that the request is a partial postback, the search result is transmitted according to the request without comparing response information, and the request is determined to be a postback. The response information for uniquely identifying the Web page included in the request is compared with the response information stored in the Web server, and if the response information matches, the process according to the request is executed. A program characterized in that it functions as an execution control means.

Images