JP5053040B2 - Information processing apparatus and client server system - Google Patents

Description

  The present invention relates to a technique for session management, and more particularly to a technique for session management without using Cookie.

  Conventionally, in communication using HTTP (Hypertext Transfer Protocol), communication is disconnected for each access. Therefore, the concept of session is introduced in order for the client and the server to communicate continuously using HTTP. A session ID for identifying each session is exchanged between the client and the server using Cookie.

On the other hand, when a device having hardware resources such as a mobile phone is used as a user terminal, it may be preferable that Cookie cannot be used or that Cookie is not used. As a session management method in such a case, URL (Uniform Resource Locator) rewrite and the method of Patent Document 1 are known.
JP 2003-58498 A

  However, in URL rewrite, the server performs an HTML (Hyper Text Markup Language) rewrite process, which places a load on the server. In addition, URL rewrite may not be correctly converted to HTML.

  In the technique of Patent Document 1, a table in which a fictitious directory name and a real directory name are associated with each other one by one is prepared, and the fictitious directory name is replaced with a real directory name. For this reason, in order to implement the technique of Patent Document 1, it is necessary to install a number of dedicated modules (handlers in the case of Apache) for replacing a fictitious directory name with a real directory name on the Web server. The web server module being used cannot be used. If a Web server module that has been used in the past can be used, the mounting is easy, and the costs associated with the mounting can be reduced.

  Therefore, an object of the present invention is to provide a technique for performing session management simply and reliably without using Cookie.

  An information processing apparatus according to an embodiment of the present invention includes a request processing unit that receives a request from a user terminal device and processes the received request. If the received request includes an absolute path URI (Uniform Resource Identifier) having an apparent absolute path including an authentication key in the received request, the absolute path with the authentication key is included. The authentication key is extracted from the URI, and the absolute path URI with the authentication key is converted into a normal absolute path URI having an absolute path not including the authentication key, and the converted normal absolute is converted together with the extracted authentication key. An authentication key extracting means for issuing a request including a path URI to the request processing means; and if the authentication key is included in the received request together with the normal absolute path URI, the authentication key is used to Normally, access to contents related to absolute path URI is permitted. Authentication processing means for determining whether or not to permit, and processing execution means for executing processing according to the content of the request based on the content related to the normal absolute path URI permitted to be accessed by the authentication processing means; Is provided.

  In a preferred embodiment, a login authentication unit that receives a login request from the user terminal device and performs authentication, and if authentication by the login authentication unit is successful, an authentication key is used as identification information for identifying a session related to the authentication The authentication key included in the absolute path URI with the authentication key may be an authentication key generated by the authentication key generation unit.

  In a preferred embodiment, the processing execution means may be any one or more of a means for generating a web page, a means for performing a CGI process, and a means for outputting a file.

  In a system including a client and a server according to an embodiment of the present invention, the client generates an absolute path URI (Uniform Resource Identifier) with an authentication key having an apparent absolute path including an authentication key. And a means for issuing a request for a URI with an authentication key generated by the generating means. The server includes request processing means for receiving a request from the client and processing the received request. The request processing means extracts the authentication key from the absolute path URI with an authentication key if the received request includes the absolute path URI with the authentication key, and the absolute path URI with the authentication key. Is extracted into a normal absolute path URI having an absolute path not including an authentication key, and a request including the extracted normal absolute path URI is issued to the request processing means together with the extracted authentication key. And, if the received request includes the authentication key together with the normal absolute path URI, the authentication key is used to determine whether to permit access to the content related to the normal absolute path URI. Authentication processing means for performing access, and the normal absolute password to which access is permitted by the authentication processing means. Based on the content of the URI, and a process execution means for executing processing corresponding to the contents of the request.

  Hereinafter, a client server system according to an embodiment of the present invention will be described with reference to the drawings.

  FIG. 1 is an overall configuration diagram of the present system. In this system, one or more clients 10 and a server 30 are connected via a network 9.

  The client 10 functions as a user terminal device operated by a user, and may be a general-purpose computer system such as a personal computer, or may be a portable communication device such as a mobile phone or a personal digital assistant. Individual components or functions in the client 10 described below are realized by executing a computer program, for example.

  The client 10 has a web browser 12.

  The Web browser 12 includes a storage unit 14 and has a function of analyzing a document described by a script such as HTML and displaying the document. Further, when a hyperlink is selected by the user, the Web browser 12 transmits an access request to the URI (Uniform Resource Identifier) designated by the hyperlink to the server 30. Further, when the Web browser 12 receives an HTML file or the like from the server 30, if there is a URI with an absolute path designation, the entire Web browser 12 stores the URI in the storage unit 14.

  Here, the additional data will be described. FIG. 2A shows an example of a URI including additional data. The URI in the figure is an absolute path designation URI. However, the URI shown in the figure includes a character string “ninsho / xxxx /” that is unrelated to the actual absolute path, which is an apparent absolute path designation. The actual absolute path is the URI shown in FIG. 2B excluding “ninsho / xxxx /”. Here, “ninsho /” and the character string up to the next “/”, that is, “ninsho / xxxx /” in this example are additional data. Here, “ninsho” included in the additional data is an identifier indicating that it is additional data, and “xxxx” is an authentication key for identifying a session established between the client 10 and the server 30. Yes (details will be described later). In other words, in the present embodiment, the additional data is embedded in a URI with an absolute path designation.

  Returning to the description of the Web browser 12, as described above, when the HTML file received from the server 30 includes an absolute path designation URI including additional data, the Web browser 12 determines that the entire URI, additional data, or additional data is added. The character string of the authentication key included in the data is stored in the storage unit 14.

  Furthermore, if the HTML file received from the server 30 has a relative path designation URI that does not include additional data, the Web browser 12 adds additional data including the authentication key stored in the storage unit 14 to the URI. Then, an absolute path designation URI including the authentication key is generated. Then, an absolute path designation URI including additional data is sent to the server 30.

  The URI including the additional data is an apparent absolute path designation, and the predetermined content cannot be accessed as it is. Therefore, as will be described later, the server 30 that has received the URI including the additional data removes the additional data from the URI, converts it to a normal absolute path URI, and then sends the request as an internal request with the normal absolute path. Reprocess.

  The server 30 is configured by a general-purpose computer system, for example, and individual components or functions in the server 30 described below are realized by executing a computer program, for example.

  The server 30 includes a user information storage unit 31, a login processing unit 32, an authentication information storage unit 34, and a web server 36.

  The user information storage unit 31 stores information related to a user registered in advance as a regular user of the system. The user information storage unit 31 stores, for example, information for login authentication such as the user ID and password of each user, and information regarding access authority indicating the range of data that can be accessed by each user.

  The login processing unit 32 receives a login request from the client 10 and refers to the user information storage unit 31 to determine whether or not to permit the login request. For example, when the login processing unit 32 permits login, the login processing unit 32 generates an authentication key for identifying a session with the client 10 related to the login request. The login processing unit 32 further acquires, from the user information storage unit 31, access authority information of a user who has permitted login. The login processing unit 32 stores the generated authentication key and access authority information of the user who uses the client 10 permitted to log in in the authentication information storage unit 34.

  The authentication information storage unit 34 stores information related to the access authority of a user who is permitted to log in and an authentication key for the client 10 used by the user in association with each other.

  Here, the access authority information will be described. In this embodiment, the setting of whether or not each user can access can be performed in units of locations. That is, in the present embodiment, access control can be performed using either a real directory or a URI path. For example, as a URI path, an insubstantial object such as a Web application such as Servlet or a PROXY function capable of returning a request from an external server can be designated.

  The Web server 36 receives a request from the client 10 permitted to log in by the login processing unit 32, executes a predetermined process, and returns the result as a response. For example, when HTTP is used as a protocol, Apache can be used as the Web server 36. In the following embodiment, a case where Apache is used as the Web server 36 will be described as an example.

  As an internal function of the Web server 36, an authentication key extraction unit 38, an authentication processing unit 40, a Web page generation unit 42, a CGI processing unit 44, and a file output unit 46 are realized. When Apache is used as the Web server 36, the authentication key extraction unit 38, the authentication processing unit 40, the Web page generation unit 42, the CGI processing unit 44, and the file output unit 46 are each implemented as a handler.

  When the request received from the client 10 includes an absolute path designation URI including additional data, the authentication key extraction unit 38 extracts an authentication key included in the additional data of the URI. For example, the authentication key extracting unit 38 cuts the additional data from the absolute path designation URI including the additional data (see FIG. 2A), and generates a normal absolute path designation URI not including the additional data (see FIG. 2B). At the same time, the authentication key is extracted from the additional data. The authentication key extraction unit 38 generates a normal absolute path designation URI that does not include additional data from an absolute path designation URI that includes additional data, and then adds the extracted authentication key to the normal absolute path designation URI. A request is issued to the Web server 36 (internal redirect). This request issued by the authentication key extraction unit 38 is processed by the Web server 36 in the same manner as a request from the client 10 for which login authentication has been performed. On the other hand, the authentication key extraction unit 38 performs no processing when the request received from the client 10 or the request that the internal key of the authentication key itself contains does not include an absolute path designation URI including additional data. First, DECLINED is issued and the process is terminated.

  In the Apache handler phase, if any of the handlers outputs something other than DECLINED, the processing for the request is terminated. For example, if one of the handlers ends the process normally and outputs a return value indicating normal end that is not DECLINE, Apache ends the process.

  The authentication processing unit 40 performs an authentication process on the request issued by the authentication key extraction unit 38 for DECLINED. For example, if the request when the authentication key extraction unit 38 issues DECLINED is a request in which an authentication key is added to a URI, authentication is performed based on the added authentication key (herein referred to as a target authentication key). Do. For example, the authentication processing unit 40 determines whether or not the target authentication key is stored in the authentication information storage unit 34. When the target authentication key is not stored in the authentication information storage unit 34, the authentication processing unit 40 does not permit a response to the request related to the target authentication key, and outputs a return value indicating abnormal termination. The process ends. On the other hand, when the target authentication key is stored in the authentication information storage unit 34, the authentication processing unit 40 acquires access authority information associated with the target authentication key from the authentication information storage unit 34. Then, the authentication processing unit 40 permits the request if the access destination of the normal absolute path designation URI to which the target authentication key is attached is within the range of the acquired access authority information, and issues a DECLINED to process it. Exit.

  If the request issued by the authentication processing unit 40 for DECLINED is a Web page generation request, the Web page generation unit 42 generates a Web page according to the request based on the content indicated by the URI. When Java (registered trademark) is used, the Web page generation unit 42 may perform JSP (Java Server Pages) processing. When the Web page is generated, the Web page generation unit 42 outputs a return value indicating normal end. On the other hand, when the request for which DECLINED is issued by the authentication processing unit 40 is not a Web page generation request, the Web page generation unit 42 does not perform any processing, issues DECLINED, and ends the processing.

  The CGI processing unit 44 performs the CGI processing according to the request based on the content indicated by the URI when the request issued by the Web page generating unit 42 requests the CGI processing. When the CGI processing unit 44 ends the CGI process, a return value indicating normal end is output. On the other hand, if the request for which DECLINED is issued by the Web page generation unit 42 is not a request for CGI processing, the CGI processing unit 44 does not perform any processing, issues DECLINED, and ends the processing.

  The file output unit 46 outputs a file according to the request based on the content indicated by the URI, when the request issued by the CGI processing unit 44 requests the output of a file such as HTML. When the file output unit 46 ends the file output process, it outputs a return value indicating normal end.

  The request received by the Web server 36 is processed by one of the processing units 38 to 46 in the Web server 36. The priority for executing the processing is from the highest priority, the authentication key extracting unit 38, The authentication processing unit 40, the web page generation unit 42, the CGI processing unit 44, and the file output unit 46 may be used.

  Here, in the present embodiment, by providing the authentication key extraction unit 38, it is possible to perform session management simpler and more accurate than before without using a cookie. That is, the authentication key extraction unit 38 extracts the authentication key embedded in the absolute path designation URI, re-synthesizes the normal absolute path designation URI that does not include the authentication key, and re-synthesizes the authentication key to the re-synthesized URI. Is attached to the Web server 36, so that the Web server 36 can handle the request equivalent to a request using Cookie. Accordingly, the authentication processing unit 40, the Web page generation unit 42, the CGI processing unit 44, and the file output unit 46 may all be general Apache handlers.

  Next, the processing procedure of the Web server 36 according to the present embodiment will be described using the flowcharts of FIGS. 3 and 4.

  First, when the Web server 36 receives a request (S10), the authentication key extraction unit 38 determines whether or not the URI included in the request is an absolute path designation URI including additional data (S12). When the URI included in the request is an absolute path designation URI including additional data (S12: Yes), the authentication key extracting unit 38 extracts an authentication key from the additional data (S14). The authentication key extraction unit 38 further cuts the additional data from the absolute path designation URI including the additional data, re-synthesizes the normal absolute path designation URI, and extracts the re-synthesized normal absolute path designation URI. The authentication key thus added is added, and an internal redirect for issuing a new request to the Web server 36 is performed (S16).

  On the other hand, if the URI included in the request is not an absolute path-specified URI including additional data (S12: No), the authentication key extraction unit 38 issues DELINED and ends the process (S18).

  Next, the authentication processing unit 40 performs an authentication process on the request that has become DECLINED by the authentication key extraction unit 38 (S20). As described above, this authentication process authenticates the access authority together with the session authentication using the authentication key. If the authentication is unsuccessful (S22: No), error information such as an error screen is output and the process as the Web server 36 is terminated (S24). On the other hand, if the authentication is successful (S22: Yes), the authentication processing unit 40 issues DELINED and ends the process (S26).

  Next, the Web page generation unit 42 determines whether or not the request that has become DECLINE by the authentication processing unit 40 is a request related to Web page generation (S28). Here, when the request is a request related to Web page generation (S28: Yes), the Web page generation unit 42 performs Web page generation processing, and when this processing is completed, the Web page generation unit 42 ends the processing ( S30). On the other hand, when the request is not a request related to Web page generation (S28: No), the Web page generation unit 42 issues DECLLINED and ends the processing (S32).

  Next, the CGI processing unit 44 determines whether or not the request that has been determined by the Web page generation unit 42 is a request related to the CGI processing (S34). Here, when the request is a request related to the CGI processing (S34: Yes), the CGI processing unit 44 performs the CGI processing, and when this processing is completed, the CGI processing unit 44 ends the processing (S36). On the other hand, when the request is not a request related to the CGI process (S34: No), the CGI processing unit 44 issues DELINED and ends the process (S38).

  Finally, the file output unit 46 performs file output processing (S40).

  When the processes in steps S24, S30, S36, and S40 are finished, the web server 36 finishes the process.

  Next, an outline of operations and display screen examples of the entire client server system according to the present embodiment will be described with reference to sequence diagrams shown in FIGS.

  First, when a login screen acquisition request is issued from the client 10 to the server (S110), the server 30 transmits an HTML file 200 corresponding to this request to the client 10 (S112).

  In the client 10, the Web browser 12 analyzes the HTML 200 and displays a login screen 300. The Web browser 12 transmits a login request including the user ID and password input by the user to the login screen 300 to the server 30 (S114).

  In the server 30, the login processing unit 32 performs login processing based on this login request. When login is permitted, the login processing unit 32 generates an authentication key, the Web server 36 generates an absolute path designation URI including additional data, and transmits an HTML file 210 including this URI to the client 10. (S116).

  In the client 10, the Web browser 12 analyzes the HTML 210 and displays the interface screen 310. At the same time, the Web browser 12 stores an absolute path designation URI including additional data in the HTML 210 in the storage unit 14. Here, when the user selects “To Top Screen” displayed on the screen 310 and set with a hyperlink, an absolute path designation URI acquisition request including additional data is transmitted to the server 30 (S118). ).

  In the server 30, the Web server 36 cuts out the additional data from the absolute path designation URI including the additional data by the processing procedure as described above. Then, after the Web server 36 resynthesizes a normal absolute path designation URI, the request is issued again by internal redirection. The Web server 36 also performs authentication using the authentication key included in the additional data, and then acquires the HTML file 220 indicated by the re-synthesized URI and transmits it to the client 10 (S120). At this time, the URI in the HTML file 220 is not an absolute path designation URI including additional data but a normal relative path designation URI.

  In the client 10, the Web browser 12 analyzes the HTML 220 and displays the interface screen 320. Here, when the user selects “next screen” displayed on the screen 320 and set with a hyperlink, the Web browser 12 acquires the authentication key from the storage unit 14 and is described in the HTML 220. An absolute path designation URI including additional data is generated based on the relative path URI. Then, the Web browser 12 transmits an absolute path designation URI acquisition request including the additional data generated here to the server 30 (S122).

  In the server 30, similarly to this request, the Web server 36 cuts the additional data from the absolute path designation URI including the additional data, re-synthesizes the normal absolute path designation URI, and then again by internal redirection. Issue a request. Furthermore, the Web server 36 also performs authentication using the authentication key included in the additional data, and then acquires the HTML file 230 of the desired URI and transmits it to the client 10 (S124). At this time, the URI in the HTML file 240 is not an absolute path designation URI including additional data but a normal relative path designation URI as in the HTML file 220.

  In the client 10, the Web browser 12 analyzes the HTML 230 and displays the interface screen 330. Here, when the user selects “to another directory” displayed on the screen 330 and set with a hyperlink, the Web browser 12 similarly acquires the authentication key from the storage unit 14, Based on the relative path URI described in HTML 240, an absolute path designation URI including additional data is generated. Then, the web browser 12 transmits an acquisition request for an absolute path designation URI including the additional data generated here to the server 30 (S126). Thereafter, the same processing as described above is performed.

  Thereby, session management can be performed easily and reliably without using Cookie. Furthermore, when Apache is used, a conventional general handler can be used.

  The above-described embodiments of the present invention are examples for explaining the present invention, and are not intended to limit the scope of the present invention only to those embodiments. Those skilled in the art can implement the present invention in various other modes without departing from the gist of the present invention.

1 is a configuration diagram of a client-server system according to an embodiment of the present invention. FIG. It is an example of URI including additional data and URI not including. It is a flowchart which shows the process sequence of the Web server 36 which concerns on this embodiment. It is a flowchart which shows the process sequence of the Web server 36 which concerns on this embodiment. The operation | movement outline | summary of the whole client server system which concerns on this embodiment, and the example of a display screen are shown. The operation | movement outline | summary of the whole client server system which concerns on this embodiment, and the example of a display screen are shown.

Explanation of symbols

10 Client 12 Web Browser 14 Authentication Key Storage Unit 30 Server 31 User Information Storage Unit 32 Login Processing Unit 34 Authentication Information Storage Unit 36 Web Server 38 Authentication Key Extraction Unit 40 Authentication Processing Unit 42 Web Page Generation Unit 44 CGI Processing Unit 46 File Output Part

Claims (6)

A request processing means for receiving a request from a user terminal device and processing the received request;
The request processing means includes:
If the received request includes an absolute path URI (Uniform Resource Identifier) with an authentication key having an apparent absolute path including the authentication key, the authentication key is extracted from the absolute path URI with the authentication key. The absolute path URI with an authentication key is converted into a normal absolute path URI having an absolute path that does not include an authentication key, and the converted normal absolute path URI in the same format as when Cookie is used, and the an authentication key extracting means for issuing a request including the extracted authentication key to the request processing unit,
If the received request includes the normal absolute path URI and the authentication key in the same format as when using Cookie , the authentication key is used to access the content related to the normal absolute path URI. Authentication processing means for determining whether to permit,
An information processing apparatus comprising: a process executing unit that executes a process according to the content of the request based on the content related to the normal absolute path URI permitted to be accessed by the authentication processing unit. Login authentication means for receiving and authenticating a login request from the user terminal device;
Means for generating an authentication key as identification information for identifying a session related to the authentication when authentication by the login authentication means is successful,
The information processing apparatus according to claim 1, wherein the authentication key included in the absolute path URI with the authentication key is an authentication key generated by the authentication key generation unit. The process execution means includes
3. The information processing apparatus according to claim 1, wherein the information processing apparatus is at least one of a means for generating a Web page, a means for performing a CGI process, and a means for outputting a file. In an information processing apparatus having a request processing unit that receives a request from a user terminal device and processes the received request, the request processing unit processes a request from a user terminal device,
If the received request includes an absolute path URI (Uniform Resource Identifier) with an authentication key having an apparent absolute path including the authentication key, the authentication key is extracted from the absolute path URI with the authentication key. The absolute path URI with an authentication key is converted into a normal absolute path URI having an absolute path that does not include an authentication key, and the converted normal absolute path URI in the same format as when Cookie is used, and the a process of issuing to the request processing unit requests comprising the extracted authentication key,
If the received request includes the normal absolute path URI and the authentication key in the same format as when using Cookie , the authentication key is used to access the content related to the normal absolute path URI. A process for determining whether to permit,
And a process of executing a process according to the content of the request based on the content related to the normal absolute path URI permitted to be accessed by the authentication processing means. A computer program for realizing a request processing means for receiving a request from a user terminal device and processing the received request in an information processing device,
The request processing means includes:
If the received request includes an absolute path URI (Uniform Resource Identifier) with an authentication key having an apparent absolute path including the authentication key, the authentication key is extracted from the absolute path URI with the authentication key. The absolute path URI with an authentication key is converted into a normal absolute path URI having an absolute path that does not include an authentication key, and the converted normal absolute path URI in the same format as when Cookie is used, and the a process of issuing to the request processing unit requests comprising the extracted authentication key,
If the received request includes the normal absolute path URI and the authentication key in the same format as when using Cookie , the authentication key is used to access the content related to the normal absolute path URI. A process for determining whether to permit,
A computer program that performs processing according to the content of the request based on content related to the normal absolute path URI permitted to be accessed by the authentication processing means. In a system with a client and a server,
The client
Means for generating an absolute path URI (Uniform Resource Identifier) with an authentication key having an apparent absolute path containing the authentication key;
Issuing a request for a URI with an authentication key generated by the generating means,
The server
A request processing means for receiving a request from the client and processing the received request;
The request processing means includes:
If the received request includes the absolute path URI with the authentication key, the authentication key is extracted from the absolute path URI with the authentication key, and the absolute path URI with the authentication key is converted to normal absolute path URI having the path, and issues a request including the converted authentication key which usually is an absolute path URI and the extraction of the same form as when using Cookie to the request processing unit An authentication key extraction means;
If the received request includes the normal absolute path URI and the authentication key in the same format as when using Cookie , the authentication key is used to access the content related to the normal absolute path URI. Authentication processing means for determining whether to permit,
A client server system comprising: a process execution unit that executes a process according to the content of the request based on the content related to the normal absolute path URI permitted to be accessed by the authentication processing unit.

Images