CN109246089B - Role-based front-end and back-end separation architecture access control system and method - Google Patents

Abstract

The invention provides a front-end and back-end separation architecture access control system and a method based on roles, wherein the system comprises the following steps: the system comprises an authority role correlation module, a routing authority role registration module, a routing system, an access control module, a routing monitoring module, an identity authentication module and a data access module; the authority role correlation module is respectively connected with the routing authority role registration module and the data access module, the routing authority role registration module is connected with the routing system, the identity authentication module is respectively connected with the data access module and the routing monitoring module, the routing monitoring module is respectively connected with the routing system and the access control module, and the access control module is respectively connected with the data access module and the routing system; the invention mainly solves the problem of front-end limited resource access control in a front-end and back-end separation framework, enhances the front-end authority control capability, limits illegal interface requests and perfects user interaction logic.

Description

A role-based front-end and back-end separation architecture access control system and method

technical field

The invention relates to front-end and back-end data interaction, front-end presentation layer rendering and user behavior control management issues in front-end and back-end architecture development SPA applications, in particular to a system and method for access control of front-end view components in front-end and back-end separation technology.

Background technique

The front-end and back-end separated applications deliver the rendering of the view components to the client browser for processing, and the back-end server is solely responsible for data processing. On the one hand, such an architecture realizes the decoupling of the data presentation layer, the user interaction layer and the business logic layer;

However, adopting the front-end and back-end separation architecture needs to face a series of permission control problems. In the traditional hybrid development mode, when using a back-end template engine to render a page, the back-end language can selectively render and send some restricted view elements according to user permissions. In the front-end and back-end separation architecture, the front-end view components are all loaded to the front-end when the application starts, the rendering is controlled by the front-end scripting language, and the data server does not render any view components. The front-end and back-end complete data interaction through a stateless REST interface. In this case, how to judge the user's authority to control the rendering of the front-end view module is the key element. Since all the views of the application have been loaded into the front-end memory, it is necessary to selectively render views to users with different permissions to prevent them from accessing restricted data resources.

Therefore, a complete front-end resource access control solution is needed to solve this problem, so that the front-end and back-end separated architecture applications can well determine the identity of the access user, and reasonably render the view resources within the scope of the user's legal authority, while limiting the illegality of the system resource interface. transfer.

SUMMARY OF THE INVENTION

In order to solve the defects of the prior art, the present invention implements a role-based front-end and back-end separation architecture access control scheme, and upgrades part of the authority authentication to the front end. Ensure the normal scheduling of background interfaces and reduce meaningless interface calls and malicious interface requests. Reduce background server request pressure and redundant authorization authentication. At the same time, it realizes the safe rendering of the application data display view and perfect user interaction to improve the user experience.

In order to achieve the above purpose, the technical scheme adopted in the present invention is:

A role-based front-end and back-end separation architecture access control system, comprising: a permission role association module, a routing permission role registration module, a routing system, an access control module, a routing monitoring module, an identity authentication module and a data access module;

The authority role association module is respectively connected with the routing authority role registration module and the data access module, the routing authority role registration module is connected with the routing system, the identity authentication module is respectively connected with the data access module and the routing monitoring module, and the routing monitoring module is respectively connected with the routing system connected with the access control module, and the access control module is respectively connected with the data access module and the routing system;

The authority-role association module is used for dividing the authority of the system resources according to the strategy specified by the system developer, and assigning authority with different roles, so as to realize the association relationship between the roles and the access authority of the system resources;

The permission role association module includes a permission role table storage module and a permission role update module; the permission role table storage module is used to select a relational database and store the permission role association table to ensure fast retrieval of the permission role association table; the permission role update The module is used to provide a flexible permission role configuration interface, including adding roles, adding and deleting related permissions for roles;

The permission role table storage module is connected with the routing permission role registration module,

The routing authority role registration module is used to add a front-end view and a controller corresponding to the routing in the routing system, and register a role with the routing resource access authority according to the authority role association table;

The routing system is used to control the association between the front-end views and the controller, and at the same time specify the jump interaction logic between the front-end views;

The access control module is used for judging the validity of the request according to the set access control policy middleware and taking corresponding actions;

The route monitoring module is registered in the application program startup phase, and is used for monitoring the route change, hijacking the user resource access request action, and triggering the execution of the access control module;

The identity authentication module is used to realize the identity authentication of the user of the access request in combination with the general JWT standard of RESTFUL interface programming, and obtain the relevant identity information of the user, and then re-render the front-end view according to the user identity information;

The data access module combines the front-end and back-end separation architecture development framework, encapsulates the global service component, provides storage interface, read interface and destruction interface of user information and authority role related information, and uses browser or local memory for information storage.

On the basis of the above scheme, the identity authentication module includes a user authentication module and an identity cancellation module;

The user authentication module is used to send the user identification information to the background for authentication, set the front-end global user identity, and trigger the front-end view to re-render and update the interface at the same time;

The identity cancellation module is used to destroy the front-end global user identity, and at the same time trigger the front-end view to re-render and update the interface.

On the basis of the above scheme, the data access module includes a data encryption module, a data sharing module and a data destruction module;

The data encryption module is used to encrypt and store relevant information such as user information, authority roles, etc.;

The data sharing module is used for sessionStorage storage data sharing under multiple tags;

The data destruction module is used for destroying specified or global storage information.

On the basis of the above scheme, the access control module includes a rights authentication module, an access control policy registration module and a policy response module;

The authority authentication module is used for judging whether the resource access requesting user has the resource access qualification;

The access control policy registration module is used to register various access control policy middleware;

The policy response module is used to implement relevant response policies according to the authority authentication result, including actions such as route redirection and request release.

A role-based front-end and back-end separation architecture access control method, applying the above-mentioned role-based front-end and back-end separation architecture access control system, comprising the following steps:

Step 1. When the application starts, obtain the permission role association table from the permission role association module, then send the permission role association table to the routing permission role registration module in the front-end architecture, and store the permission role association table in the data access module through the data access module. In the browser or local memory, the routing permission role registration module registers the front-end view corresponding to routing and routing, as well as the accessible role list and related permissions of the controller into the routing system to determine the corresponding relationship between routing and roles. The identity authentication module is registered in the application to complete user identity authentication and logout; the route monitoring module is used to monitor changes in the routing state; the access control module is used to configure a series of access control policies;

Step 2. When a user initiates an application resource access request, the identity authentication module first authenticates the user. For the authentication failure request, the subsequent access is rejected and redirected to the identity authentication module. For the authentication successful request, the identity authentication The module reads the user information and permission role association information from the data access module, and passes the user information, permission role association information and access request to the routing monitoring module. The routing monitoring module obtains the routing information to be accessed in the access request, and then from The routing system reads the list of accessible roles for the route, and sends the access request and the list of accessible roles to the access control module. The access control module first takes the intersection of user information, permission role related information and the list of accessible roles, if the result is If it is empty, execute the policy response module in the access control module, reject the access request and do subsequent processing. If the result is not empty, obtain further relevant permissions, and perform further request processing actions according to the access control policy in the access control module. , and then complete the legal request for resources through the request, and obtain the background data to complete the front-end view rendering.

On the basis of the above scheme, the specific process for the identity authentication module to authenticate the user is as follows: first, the user sends the user name and password to the server, the server verifies the user identity, encrypts the user identity information with a key, generates a token and returns it to the front end, and the front end follows up. When accessing the server, the token is used as an identity identifier. After the server verifies the token, the accessed resource is returned to the front end.

The beneficial effects of the present invention are as follows:

The technical scheme of the present invention provides a complete and efficient implementation scheme of resource access control, user identity authentication, and front-end interaction oriented to front-end and back-end separated architecture applications. The main features are reflected in the use of role-based access control, registering the routing monitoring module that hijacks user access actions in the application program, the access control module, the data access module and the comprehensive application of various technologies in various modules, which achieves the following beneficial effects :

(1) Front-end resource access control: use various modules to comprehensively work to ensure secure access to front-end resources.

(2) Flexible configuration: The middleware registration mode is adopted to flexibly configure and add various authorization authentication policies.

(3) Multi-tab data sharing: Use localStorage events to share sessionStorage across tabs.

(4) Legal access to the background interface: through the access control to the controller.

(5) Secure transmission: Front-end encryption ensures reliable data transmission and prevents middlemen from eavesdropping on sensitive data.

The technical solution described in the present invention can be used for technology companies that adopt a front-end and back-end separation structure to develop applications.

Description of drawings

The present invention has the following accompanying drawings:

FIG. 1 shows the overall architecture diagram provided by Embodiment 1.

Figure 2 shows a basic schematic diagram of identity authentication combined with JWT technology.

FIG. 3 shows an implementation flowchart of a role-based front-end and back-end separation architecture access control method provided in Embodiment 1. As shown in FIG.

Detailed ways

The present invention will be further described in detail below with reference to the accompanying drawings.

Example 1

As shown in FIG. 1 , a role-based front-end and back-end separation architecture access control system provided by this embodiment includes: a permission role association module, a routing permission role registration module, a routing system, an access control module, a routing monitoring module, and an identity authentication module. modules and data access modules;

The authority role association module is respectively connected with the routing authority role registration module and the data access module, the routing authority role registration module is connected with the routing system, the identity authentication module is respectively connected with the data access module and the routing monitoring module, and the routing monitoring module is respectively connected with the routing system connected with the access control module, and the access control module is respectively connected with the data access module and the routing system;

The permission role association module is used to divide the permissions of system resources according to the policy specified by the system developer, and assign different permissions of system roles to realize the association relationship between roles and system resource access permissions;

The permission role association module includes a permission role table storage module and a permission role update module; the permission role table storage module is used to select a relational database and store the permission role association table to ensure fast retrieval of the permission role association table; the permission role update The module is used to provide a flexible permission role configuration interface, including adding roles, adding and deleting related permissions for roles;

The permission role table storage module is connected with the routing permission role registration module,

The routing authority role registration module is used for adding a front-end view and a controller corresponding to a route in the routing system of the front-end and back-end separated applications, and registering a role with access authority to the routing resource according to the authority-role association table.

The routing system is used to control the association between the front-end views and the controller, and at the same time specify the jump interaction logic between the front-end views;

The identity authentication module is used to identify the user of the access request in combination with the general JWT standard of RESTFUL interface programming, and obtain the relevant identity information of the user, and then re-render the front-end view according to the user identity information;

Route monitoring module, registered in the application startup phase, used to monitor route changes, hijack user resource access request actions, and trigger the execution of the access control module;

The data access module, combined with the front-end and back-end separation architecture development framework, encapsulates the global service component, and is used to provide the storage interface, read interface and destruction interface of user information and permission role related information, and use the browser or local memory for information storage;

The access control module is used to judge the validity of the request according to the set access control policy middleware and take corresponding actions.

On the basis of the above scheme, the identity authentication module includes a user authentication module and an identity cancellation module,

The user authentication module sends the user identification information to the background for authentication, sets the front-end global user identity, and triggers the front-end view to re-render and update the interface;

Identity logout module: Destroy the front-end global user identity, and trigger the front-end view to re-render and update the interface.

On the basis of the above scheme, the data storage module includes a data encryption module, a data sharing module and a data destruction module,

The data encryption module encrypts and stores user information, permission roles and other related information;

Data sharing module for sessionStorage storage data sharing under multiple tags

Data destruction module, destroys specified or global storage information.

On the basis of the above scheme, the access control module includes an authority authentication module, an access control policy registration module and a policy response module;

The authority authentication module determines whether the resource access requesting user has the resource access qualification;

Access control policy registration module: register various access control policy middleware;

The policy response module implements relevant response policies according to the authority authentication result, including actions such as route redirection and request release.

in,

The workflow of each module is as follows: when the application starts, the permission role association table is obtained from the permission role association module, and then the permission role association table is sent to the routing permission role registration module in the front-end architecture, and the permission role is transferred through the data access module. The association table is stored in the browser or local memory, and the routing permission role registration module registers the front-end routing and the front-end view corresponding to the routing, as well as the accessible role list and related permissions of the controller accessing the back-end interface into the routing system to determine the routing. , the corresponding relationship of roles, and at the same time, the identity authentication module is registered in the application program to complete the user identity authentication and logout; the routing monitoring module, monitoring the change of routing status; the access control module, configuring a series of access control policies.

When a user initiates an application resource access request, the identity authentication module first authenticates the user. The JWT authentication process is as follows, as shown in Figure 2: First, the user sends the user name and password to the server, and the server verifies the user's identity. After encrypting with the key, a token is generated and returned to the front-end, and the front-end will carry the token as an identity when it subsequently accesses the server. After the server validates the token, it returns the accessed resource to the front end. For the authentication failure request, deny its subsequent access and redirect it to the identity authentication module. For the authentication successful request, the identity authentication module reads the user information and permission role association information from the data access module, and converts the user information, permission The role association information and access request are handed over to the routing monitoring module. The routing monitoring module obtains the routing information to be accessed in the access request, and then reads the accessible role list of the route from the routing system, and sends the access request and accessible role list to the Access control module, the access control module first intersects the user information, permission role related information and the list of accessible roles, if the result is empty, executes the policy response module in the access control module, rejects the access request and performs subsequent processing, If the result is not empty, further obtain relevant permissions, perform further request processing actions according to the access control policy in the access control module, and then complete the legal request for the resource through the request, and obtain the background data to complete the view rendering.

As shown in FIG. 3 , the workflow of a role-based front-end and back-end separation architecture access control method provided by this embodiment includes the following steps:

Step 1. Determine all roles in the system, determine the permissions of system resources, and establish the corresponding relationship between permissions and roles, and provide them to the front-end program;

Step 2. Register the route and the response view in the routing system, the controller correspondence, and the roles that can legally access the route;

Step 3. Design and complete the identity authentication module, and realize the user authentication and the acquisition of role permission information in combination with JWT;

Step 4. Complete the data access module interface writing, including the underlying API encapsulation, and the completion of the global general service component;

Step 5. Deploy the routing monitoring module;

Step 6. Deploy the access control module and configure related access control policies.

Take angularjs, a commonly used development framework for front-end separation, as an example to show the code of each of the above steps.

The step 1 includes sending an ajax request in app.run to obtain background-related role permission association information, app.constant defines the requested role constant, and calls the window.sessionStorage.setItem local storage interface of html5 to store the constant, the main code snippet:

The step 2, routing role registration module, code snippet

Described step 3, code fragment, judge user legitimacy according to user role information provided by userSession service

Described step 4, the code fragment, the user information after authentication is stored in the global service component, and the interface for reading and destroying is provided

The step 5, routing monitoring module code snippet

Step 6. Access control module code snippet

Obviously, the above-mentioned embodiments of the present invention are only examples for clearly illustrating the present invention, and are not intended to limit the embodiments of the present invention. Changes or changes in other different forms cannot be exhausted here, and all obvious changes or changes derived from the technical solutions of the present invention are still within the protection scope of the present invention.

Explanation of related terms

SPA applications: SPA applications are single-page applications. Different from traditional web applications, single-page applications complete all view rendering and data loading in one web page. When the application starts, all relevant resources are loaded to the front end, and all user interaction logic monitors the web routing hash changes through the scripting language, dynamically loads the view template and renders it.

JWT standard: the full name is a solution to user identity authentication in the front-end and back-end separation architecture of JSON WEB TOKEN. It mainly solves the cross-domain problems that may be caused by the front-end and back-end REST interface communication. Its composition mainly includes JWT header, payload and visa information three Partial composition.

Contents not described in detail in this specification belong to the prior art known to those skilled in the art.

Claims (3)

1. A role-based front-end and back-end separated architecture access control system, comprising: the system comprises an authority role correlation module, a routing authority role registration module, a routing system, an access control module, a routing monitoring module, an identity authentication module and a data access module;

the authority role correlation module is respectively connected with the routing authority role registration module and the data access module, the routing authority role registration module is connected with the routing system, the identity authentication module is respectively connected with the data access module and the routing monitoring module, the routing monitoring module is respectively connected with the routing system and the access control module, and the access control module is respectively connected with the data access module and the routing system;

the authority role association module is used for carrying out authority division on system resources according to a strategy designated by a system developer, distributing different authorities of roles and realizing the association relation between the roles and the access authorities of the system resources;

the authority role association module comprises an authority role table storage module and an authority role updating module; the authority role association table storage module is used for selecting a relational database, storing an authority role association table and ensuring the fast retrieval of the authority role association table; the authority role updating module is used for providing a flexible authority role configuration interface, including adding roles and adding and deleting related authorities for the roles;

the authority role table storage module is connected with the routing authority role registration module,

the routing authority role registration module is used for adding a front end view and a controller corresponding to a route in a routing system and registering a role with the access authority of the routing resource according to an authority role association table;

the routing system is used for controlling the incidence relation between the front end view and the controller and simultaneously appointing the jump interaction logic between the front end views;

the access control module is used for judging the request validity according to the set access control strategy middleware and generating corresponding actions;

the route monitoring module is registered at the starting stage of the application program and is used for monitoring route change, hijacking user resource access request actions and triggering the access control module to execute the route monitoring module;

the identity authentication module is used for carrying out identity authentication on the user with the access request by combining with a JWT standard universal for RESTFUL interface programming, acquiring the related identity information of the user and then re-rendering the front end view according to the identity information of the user;

the data access module is combined with a front-end and rear-end separation framework development framework, encapsulates a global service assembly, is used for providing a storage interface, a reading interface and a destruction interface of user information and authority role associated information, and utilizes a browser or a local memory to store information;

the identity authentication module comprises a user authentication module and an identity logout module;

the user authentication module is used for sending the user identification information to background authentication, setting a front end overall user identity, triggering a front end view to render again and updating an interface;

the identity logout module is used for destroying the global user identity at the front end, triggering the front end view to render again and updating the interface;

the data access module comprises a data encryption module, a data sharing module and a data destruction module;

the data encryption module is used for encrypting and storing user information and authority role related information;

the data sharing module is used for sharing sessionStorage storage data under multiple tags;

the data destruction module is used for destroying designated or global storage information;

the access control module comprises an authority authentication module, an access control strategy registration module and a strategy response module;

the authority authentication module is used for judging whether the resource access request user has the resource access qualification;

the access control strategy registration module is used for registering various access control strategy middleware;

the strategy response module is used for implementing relevant response strategies including route redirection and request releasing action according to the authority authentication result.

2. A role-based front-back end separation architecture access control method, to which the role-based front-back end separation architecture access control system of claim 1 is applied, comprising the steps of:

step 1, when an application program is started, acquiring a permission role association table from a permission role association module, then sending the permission role association table to a routing permission role registration module in a front-end framework, storing the permission role association table in a browser or a local memory through a data access module, registering a front end view corresponding to routing and routing, an accessible role list of a controller and related permissions into a routing system by the routing permission role registration module, and determining the corresponding relation between the routing and the roles, and meanwhile, registering an identity authentication module in the application program for finishing user identity authentication and logout; the route monitoring module is used for monitoring the change of the route state; the access control module is used for configuring an access control strategy;

step 2, when the user initiates the application program resource access request, firstly, the identity authentication module authenticates the user, refuses the subsequent access to the authentication failure request, and redirects the authentication to the identity authentication module, for the authentication success request, the identity authentication module reads the user information and the authority role associated information from the data access module, and hands the user information, the authority role associated information and the access request to the route monitoring module, the route monitoring module obtains the route information to be accessed in the access request, then reads the accessible role list of the route from the routing system, and sends the access request and the accessible role list to the access control module, the access control module firstly takes the intersection of the user information, the authority role associated information and the accessible role list, if the result is empty, the strategy response module in the access control module is executed, and refusing the access request and performing subsequent processing, if the result is not empty, further acquiring the related authority, performing further request processing action according to an access control strategy in the access control module, then completing legal request of resources through the request, and acquiring background data to complete front end view rendering.

3. The role-based front-back end separation architecture access control method according to claim 2, wherein the specific process of the identity authentication module for performing identity authentication on the user is as follows: firstly, a user sends a user name and a password to a server, the server encrypts user identity information by using a secret key after verifying the user identity to generate a token to be returned to the front end, the token is carried by the front end when the front end subsequently accesses the server to be used as an identity identifier, and the server returns accessed resources to the front end after verifying the token.

Images