WO2022036833A1 - cookie管理方法、中间节点及WebVPN系统 - Google Patents

cookie管理方法、中间节点及WebVPN系统 Download PDF

Info

Publication number
WO2022036833A1
WO2022036833A1 PCT/CN2020/122266 CN2020122266W WO2022036833A1 WO 2022036833 A1 WO2022036833 A1 WO 2022036833A1 CN 2020122266 W CN2020122266 W CN 2020122266W WO 2022036833 A1 WO2022036833 A1 WO 2022036833A1
Authority
WO
WIPO (PCT)
Prior art keywords
cookie
intermediate node
browser
request message
response message
Prior art date
Application number
PCT/CN2020/122266
Other languages
English (en)
French (fr)
Inventor
林俊洪
Original Assignee
厦门网宿有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 厦门网宿有限公司 filed Critical 厦门网宿有限公司
Publication of WO2022036833A1 publication Critical patent/WO2022036833A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/50—Network services
    • H04L67/60—Scheduling or organising the servicing of application requests, e.g. requests for application data transmissions using the analysis and optimisation of the required network resources
    • H04L67/63—Routing a service request depending on the request content or context
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/90—Details of database functions independent of the retrieved data types
    • G06F16/95—Retrieval from the web
    • G06F16/958—Organisation or management of web site content, e.g. publishing, maintaining pages or automatic linking
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H04L12/4641—Virtual LANs, VLANs, e.g. virtual private networks [VPN]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/09—Mapping addresses
    • H04L61/10—Mapping addresses of different types
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/45—Network directories; Name-to-address mapping
    • H04L61/4505—Network directories; Name-to-address mapping using standardised directories; using standardised directory access protocols
    • H04L61/4511—Network directories; Name-to-address mapping using standardised directories; using standardised directory access protocols using domain name system [DNS]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/02—Protocols based on web technology, e.g. hypertext transfer protocol [HTTP]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/22—Parsing or analysis of headers

Definitions

  • the present application relates to the field of computer technology, and in particular, to a cookie management method, an intermediate node and a WebVPN system.
  • Cookie is the data stored on the user's local browser by the website in order to identify the user's identity and perform session tracking (session tracking). It consists of several other optional attributes used to control the validity period, security, and scope of use of cookies.
  • Web Virtual Private Network provides web-based intranet application access control, allowing authorized users to access web applications that are only open to the intranet, to achieve a similar virtual private network (Virtual Private Network, referred to as VPN) ) function.
  • VPN Virtual Private Network
  • the intranet source site has various web services such as Office Automation (OA), Enterprise Resource Planning (ERP), etc.
  • Users can access through the browser using WebVPN successively.
  • Set the name of the cookie as sessionId then when the user accesses the OA, the browser will add a cookie whose value is sessionId in the cookie domain name directory of the proxy domain name according to the set cookie command in the response.
  • the ERP service If the user accesses the ERP service at this time , the name of the cookie set by the ERP service is also sessionId, then the cookie corresponding to the ERP service added by the browser will overwrite the cookie corresponding to the OA service.
  • the carried cookie is not required by the OA service, resulting in abnormal access.
  • the embodiments of the present application provide a cookie management method, an intermediate node, and a WebVPN system, and the technical solutions are as follows.
  • an embodiment of the present application provides a cookie management method, the method comprising:
  • the intermediate node receives and parses the request message sent by the browser, and forwards the request message to the source station running the target service;
  • the intermediate node receives and parses the response message returned by the source station running the target service, if the response message contains a set-cookie field, rewrites the set-cookie field, and if the response message contains a set-cookie field cookie acquisition method, rewrite the cookie acquisition method, and send the rewritten response message to the browser.
  • the rewriting the set-cookie field is specifically rewriting the name attribute value of the cookie set in the set-cookie field.
  • the rewriting the name attribute value includes adding an identifier corresponding to the target service to the name attribute value according to a preset rule.
  • the rewriting the cookie obtaining method specifically includes injecting a script file into the HTML page header of the response message, wherein, after the script file is executed, the parameters of the cookie obtaining method are implemented. rewrite.
  • the cookie obtaining method parameter includes the name attribute value of the cookie
  • the rewriting of the cookie obtaining method parameter includes adding, according to a preset rule, the name attribute value corresponding to the target service logo.
  • the method includes: after the browser receives the response message, in the process of loading the HTML page, executing the script file, so as to rewrite the cookie acquisition method in the HTML page.
  • the intermediate node receives and parses the request message sent by the browser, and forwards the request message to the source station running the target service, including: judging whether the request message is in the request message based on the parsing result Include the cookie field; if not included, forward the request message; if included, filter out the target cookie corresponding to the target service from the cookie field, and rewrite the name attribute value of the target cookie, and generate a request message containing only the rewritten target cookie, and then forward the newly generated request message to the source site.
  • the rewriting the name attribute value of the target cookie includes deleting the identifier corresponding to the target service in the name attribute value according to a preset rule.
  • an embodiment of the present application further provides an intermediate node, where the intermediate node at least includes a memory and a processor, where the memory is used to store an agent program instruction; the processor is used to call and execute the memory in the memory Stored agent program instructions to implement the above cookie management method.
  • an embodiment of the present application further provides a WebVPN system, including the above-mentioned intermediate node, a browser installed on a user terminal, and at least one intranet source site, wherein the intermediate node performs processing on a request message of the browser.
  • the proxy enables the user to access the intranet origin site through the browser.
  • an embodiment of the present application further provides a computer-readable storage medium, where at least one instruction, at least one piece of program, code set or instruction set is stored in the storage medium, the at least one instruction, the at least one piece of program , the code set or instruction set is loaded and executed by the processor to implement the above-mentioned cookie management method.
  • the beneficial effects brought by the technical solutions provided by the embodiments of the present application are: on the one hand, when a user accesses the target service of the source site through the browser through the intermediate node, the intermediate node can receive the response message returned by the source station, and then rewrite the response by rewriting the response message.
  • the set-cookie field in the message realizes the classified management of cookies corresponding to different target services, and realizes the accurate acquisition of the rewritten cookie by rewriting the cookie acquisition method in the response message, avoiding the prior art.
  • the new cookie saved locally by the browser will overwrite the old cookie, resulting in abnormal access; on the other hand, when the intermediate node receives the request message sent by the browser, The cookie corresponding to the target service can be filtered out, encapsulated into the request message, and forwarded to the origin site running the target service, so that the cookie obtained by the origin site can be set to its value, thereby realizing normal access.
  • FIG. 1 is a schematic diagram of a WebVPN system provided by an embodiment of the present application.
  • FIG. 3 is a schematic structural diagram of the intermediate point node shown in FIG. 1 .
  • an embodiment of the present application provides a WebVPN system.
  • a browser is installed on a client such as a mobile phone and a computer, and the browser may be an IE (Internet Explorer) browser, a Google Chrome (Google Chrome) browser ), Firefox browser, etc.
  • the intermediate node may be a Web Virtual Private Network (Web Virtual Private Network, referred to as WebVPN) gateway or a WebVPN server.
  • Origin site 1 to origin site N are all in the intranet.
  • the origin site can be a server deployed with OA services, ERP services and other application services, or it can be deployed with multiple software as a service (Soft as a Service, referred to as SaaS) service server.
  • SaaS Soft as a Service
  • VPN virtual private network
  • external network users need to access the origin site of the internal network, they can connect to the intermediate node through a local browser. , and access the origin site of the intranet through the proxy service of the intermediate node to implement the browser-based WebVPN service, wherein the origin site service to be accessed by the user can be called the target service.
  • the intermediate node includes a transceiver module and a rewriting module.
  • the transceiver module of the intermediate node can receive and parse the request message.
  • the request message carries a cookie
  • the rewriting module will rewrite the name of the cookie in the request message.
  • the attribute value is rewritten, and then the transceiver module forwards the rewritten request message to the source station running the target service; when the source station sends a response message, the transceiver module can receive and parse the response message.
  • the rewriting module When it is judged that the response message contains the set-cookie field, the rewriting module rewrites the set-cookie field, and when the response message contains the cookie acquisition method, the rewriting module rewrites the cookie acquisition method, and then the transceiver module will rewrite The subsequent response message is sent to the user's browser.
  • each module is virtualized based on the functions implemented by the agent program running on the intermediate node.
  • the methods executed by each module are agent program.
  • the intermediate node in this embodiment of the present application includes at least a memory and a processor, and the memory is used for storing agent program instructions; the processor is used for calling and executing the agent program instructions stored in the memory, so as to realize this
  • the cookie management method provided by the application embodiment is provided.
  • FIG. 2 illustrates a cookie management method provided by an embodiment of the present application, which is applied to the WebVPN system shown in FIG. 1, and may specifically include the following steps.
  • a browser receives a request from a user to access a target service, and sends a request message to an intermediate node.
  • the web address of the intermediate node can be input through the address bar of the browser.
  • the browser After receiving the access web address, the browser will first query whether the cache of the browser and the operating system is stored with the access URL. The IP address of the intermediate node corresponding to the domain name (ie the proxy domain name). If the IP address of the intermediate node is cached, the browser can directly generate the corresponding request message based on the IP address; if there is no cache, the proxy domain name will be parsed first. Obtain the corresponding IP address and generate the corresponding request message.
  • the request message can be, for example, a Hyper Text Transfer Protocol (Hyper Text Transfer Protocol, referred to as HTTP) or a Hyper Text Transfer Protocol (Hyper Text Transfer Protocol over Secure Socket Layer, referred to as HTTPS) message.
  • HTTP Hyper Text Transfer Protocol
  • HTTPS Hyper Text Transfer Protocol over Secure Socket Layer
  • the intermediate node After receiving the request message, the intermediate node will first verify the user's identity. After the verification is passed, the Web access page containing the application service can be provided. Users view the list of accessible services on the web access page, such as OA services, ERP services, etc. Both OA services and ERP services run on the intranet origin site; the user selects the target service to be accessed on the web access page of the browser, The browser can generate a request message based on the user's selection and send it to the intermediate node.
  • the browser can search for all cookies corresponding to the proxy domain name stored locally, add these cookies in the generated request message, and send it to the intermediate node.
  • the intermediate node receives and parses the request message sent by the browser.
  • a request message can include three parts: a request line, a request header, and a request data.
  • the request line can include a request method, a Uniform Resource Locator (URL for short), HTTP The protocol version.
  • the request header can include fields such as accept, referer, host, and cookie.
  • the cookie field contains all cookies and their related attribute values.
  • the intermediate node can obtain the values of the URL and cookie fields by parsing the request message.
  • the intermediate node judges whether the request message sent by the browser contains a cookie, if it does not contain a cookie, go to step S205 directly; if it contains a cookie, go to step S204 first, and then go to step S205.
  • the intermediate node when the intermediate node obtains the cookie field by parsing the request message, it can be determined whether the request message contains a cookie by whether the field is empty.
  • the intermediate node selects a target cookie corresponding to the target service from the cookie, rewrites it, and generates a request message that only includes the rewritten target cookie.
  • the request message sent by the browser to the intermediate node may carry all cookies under the proxy domain name stored locally. Therefore, the intermediate node can determine the user request according to the URL in the request message the target service, and then filter out the target cookie corresponding to the target service from all cookies carried in the request message, rewrite it, restore the value of the name attribute of the target cookie to the value set by the target service, and then generate only The request message containing the rewritten target cookie.
  • the intermediate node forwards the request message to the source station running the target service.
  • the source station running the target service returns a response message to the intermediate node.
  • the response message may include three parts: status line, response header and response data, wherein the status line part may include HTTP protocol version, status code, and text description of the status code; the response header part may include Allow, Date, Location, Set-Cookie and other fields; the response data part may include the Hyper Text Markup Language (Hyper Text Markup Language, referred to as HTML) page that the user requests to access.
  • the origin station After receiving the request message sent by the intermediate node, the origin station can respond to it. According to the actual situation, the response message can contain the Set-Cookie instruction or HTML page data.
  • the intermediate node receives and parses the response message returned by the source station running the target service.
  • the intermediate node can learn the content contained in the response packet by parsing the response packet.
  • the intermediate node judges whether the response message sent by the source station running the target service contains the set-cookie field or the cookie acquisition method, if it does not contain the set-cookie field and the cookie acquisition method, go directly to step S210; if it contains the set-cookie field Or the cookie acquisition method, first enter step S209, and then enter step S210.
  • the intermediate node determines whether there is a set-cookie field in the response packet and whether there is a cookie obtaining method by identifying the response header and the response data, respectively.
  • the method for obtaining the cookie may be included in the HTML page.
  • the intermediate node rewrites the set-cookie field, and rewrites the cookie acquisition method.
  • overwriting the set-cookie field by the intermediate node may include overriding the value of the name attribute of the set-cookie field in the response header.
  • the intermediate node can set the value of the name attribute of the cookie set in the set-cookie before forwarding the response message to the browser. Add classification identifiers to distinguish different intranet services.
  • the intermediate node can rewrite the attribute value of the name set in the set-cookie according to the preset rules.
  • the attribute value of name in set-cookie can be rewritten to OA_SessionID or SessionID_OA to prevent other intranet services from using the same attribute value.
  • the name attribute value in the set-cookie returned by the origin site is also SessionID.
  • the intermediate node can rewrite the name attribute value to ERP_SessionID or SessionID_ERP. In this way, after rewriting the value of the name attribute, when the browser generates the corresponding cookie locally according to the set-cookie instruction responded by each target service, due to the repeated name value, the first generated cookie is overwritten by the later generated cookie. .
  • the intermediate node when it rewrites the target cookie in the request message, it may specifically include, according to preset rules, deleting the identifier in the name attribute value of the target cookie, so that the source of the target service is deleted.
  • the website can correctly recognize the cookie.
  • the method for obtaining the cookie rewritten by the intermediate node specifically includes that the intermediate node injects a script file into the header of the HTML page of the response message to rewrite the parameters of the method for obtaining the cookie.
  • the HTML page may contain the cookie acquisition method get(), which has instructed the browser to obtain the relevant attribute values of the cookie from the local, such as value (value), expiration date (Expires), etc., so as to complete the relevant Operations, such as page information loading, etc., because the corresponding parameter in the get() method is the name value of the cookie set by the target service, such as get(sessionId), however, because the name value of the cookie generated by the browser based on set-cookie has been Therefore, it is necessary to rewrite the parameters in the get() method to ensure that the browser can correctly obtain the corresponding cookie.
  • get() the cookie acquisition method get()
  • the cookie acquisition method in the response message needs to be rewritten.
  • a JS (JavaScript) script file can be injected into the header of the HTML page in the response data, and sent to the browser.
  • This script file is used to rewrite all cookie acquisition methods included in the HTML page, that is, to replace the parameter value in get(name) with the rewritten name value according to the preset rules, for example, rewrite get(sessionId) to get( OA_SessionID) or get(SessionID_OA).
  • the browser After the browser receives the response message, it will load the HTML page. During the loading process, the JS script file is executed, thereby realizing the rewriting of the cookie acquisition method.
  • the intermediate node determines whether to perform the corresponding rewriting step according to whether the response message contains set-cookie and cookie acquisition methods, that is, when the response message contains set-cookie, it needs to be The set-cookie is rewritten based on the above method.
  • the cookie acquisition method also needs to be rewritten based on the above method.
  • the intermediate node forwards the response message to the browser.
  • the browser after receiving the response message, the browser generates a corresponding cookie according to the rewritten set-cookie and saves it under the proxy domain name.
  • the cookie obtaining method needs to be executed, the corresponding cookie can be obtained from the local data based on the rewritten cookie obtaining method.
  • FIG. 3 is a schematic structural diagram of an intermediate node provided by an embodiment of the present application.
  • the intermediate node 1100 may vary greatly depending on configuration or performance, and may include one or more central processing units 1122 (eg, one or more processors) and memory 1132, one or more storage applications 1142 or Storage medium 1130 (eg, one or more mass storage devices) for data 1144 .
  • the memory 1132 and the storage medium 1130 may be short-term storage or persistent storage.
  • the program stored in the storage medium 1130 may include one or more modules (not shown in the figure), and each module may include a series of instruction operations in the intermediate node 1100 .
  • the central processing unit 1122 may be configured to communicate with the storage medium 1130, and execute a series of instruction operations in the storage medium 1130 on the intermediate node 1100.
  • Intermediate node 1100 may also include one or more power supplies 1129, one or more wired or wireless network interfaces 1150, one or more input/output interfaces 1158, one or more keyboards 1156, and/or, one or more operating systems 1141, such as Windows Server, Mac OS X, Unix, Linux, FreeBSD, etc.
  • one or more operating systems 1141 such as Windows Server, Mac OS X, Unix, Linux, FreeBSD, etc.
  • the intermediate node 1100 may include a memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, including for performing Directives for the above cookie management methods.
  • the intermediate node provided by the embodiment of the present application can achieve the same technical effect as the cookie management method shown in FIG. 3 , which is not repeated here.
  • the device embodiments described above are only illustrative, wherein the units described by the separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in a local, or it can be distributed over multiple network elements. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution in this embodiment. Those skilled in the art can understand and implement it without creative effort.
  • each embodiment can be implemented by means of software plus a necessary general hardware platform, and certainly can also be implemented by hardware.
  • the above-mentioned technical solutions can be embodied in the form of software products in essence or relative to the related technologies, and the computer software products can be stored in computer-readable storage media, such as ROM/RAM, magnetic A disc, an optical disc, etc., includes several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to perform the methods described in various embodiments or some parts of the embodiments.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Databases & Information Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Data Mining & Analysis (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Information Transfer Between Computers (AREA)

Abstract

本申请公开了一种cookie管理方法，所述方法包括：中间节点接收及解析浏览器发送的请求报文，并将请求报文转发至运行目标服务的源站；中间节点接收及解析运行目标服务的源站返回的响应报文，如果响应报文包含set-cookie字段，则改写set-cookie字段，以及如果响应报文包含cookie获取方法，则改写cookie获取方法，并将改写后的响应报文发送至浏览器。本申请还提供了一种中间节点、WebVPN系统，及计算机可读存储介质。

Description

cookie管理方法、中间节点及WebVPN系统
交叉引用
本申请要求于2020年08月18日递交的名称为“cookie管理方法、中间节点及webvpn系统”、申请号为202010833352.0的中国专利申请的优先权，其通过引用被全部并入本申请。
技术领域
本申请涉及计算机技术领域，特别涉及一种cookie管理方法、中间节点及WebVPN系统。
背景技术
Cookie是网站为了辨别用户身份，进行会话追踪(session tracking)而存储在用户本地浏览器上的数据，Cookie是一段不超过4KB的小型文本数据，由一个名称(Name)、一个值(Value)和其它几个用于控制Cookie有效期、安全性、使用范围的可选属性组成。
网页虚拟专用网络(Web Virtual Private Network，简称为WebVPN)提供基于web的内网应用访问控制，允许授权用户访问只对内网开放的web应用，实现类似虚拟专用网(Virtual Private Network，简称为VPN)的功能。
在WebVPN服务中，用户通过浏览器就能直接访问内网的web服务，内网的web服务都有各自的cookie数据，而由于浏览器访问该些web服务都需经过中间设备的代理，因此，保存在浏览器本地的所有cookie数据都会被挂到同一个域名之下，即代理服务的域名，在这种情况下，如果不同的web服务的cookie存在重复的name值，就会出现覆盖的问题，从而导致被代理网站访问异常。
例如内网源站有办公自动化(Office Automation，简称为OA)、企业资源计划(Enterprise Resource Planning，简称为ERP)等多种web服务，用户通过浏览器采用WebVPN的方式先后进行访问，如果OA服务设定cookie的name 为sessionId，那么当用户访问了OA，浏览器会根据响应中的set cookie指令在代理域名的cookie域名目录下新增一个值为sessionId的cookie，若此时用户访问了ERP服务，ERP服务设定cookie的name也为sessionId，那么浏览器新增的ERP服务对应的cookie就会把OA服务对应的cookie覆盖掉。导致用户再次访问OA服务时，携带的cookie不是OA服务所需的，进而导致访问异常。
发明内容
为了解决现有技术中的问题，本申请实施例提供了一种cookie管理方法、中间节点、WebVPN系统，所述技术方案如下。
第一方面，本申请实施例提供一种cookie管理方法，所述方法包括：
中间节点接收及解析浏览器发送的请求报文，并将所述请求报文转发至运行目标服务的源站；
所述中间节点接收及解析所述运行目标服务的源站返回的响应报文，如果所述响应报文包含set-cookie字段，则改写所述set-cookie字段，以及如果所述响应报文包含cookie获取方法，则改写所述cookie获取方法，并将改写后的响应报文发送至所述浏览器。
在一个实施例中，所述改写所述set-cookie字段具体为改写所述set-cookie字段中设定的cookie的name属性值。
在一个实施例中，所述改写所述name属性值包含根据预设规则，在所述name属性值中添加所述目标服务对应的标识。
在一个实施例中，所述改写所述cookie获取方法具体包含向所述响应报文的HTML页面头部注入脚本文件，其中，所述脚本文件被执行后，实现对所述cookie获取方法参数的改写。
在一个实施例中，所述cookie获取方法参数包含cookie的name属性值，所述对所述cookie获取方法参数的改写包含根据预设规则，在所述name属性值中添加所述目标服务对应的标识。
在一个实施例中，所述中间节点将改写后的响应报文发送至所述浏览器之后包括：浏览器在接收到响应报文以后，在加载所述HTML页面的过程中，执行所述脚本文件，以实现对所述HTML页面中的所述cookie获取方法进行改写。
在一个实施例中，所述中间节点接收及解析浏览器发送的请求报文，并将所述请求报文转发至运行目标服务的源站，包括：基于解析结果判断所述请求报文中是否包含cookie字段；如果不包含，则转发所述请求报文；如果包含，则从所述cookie字段中筛选出与所述目标服务对应的目标cookie，对所述目标cookie的name属性值进行改写，并生成仅包含所述改写后的目标cookie的请求报文，然后转发新生成的请求报文至所述源站。
在一个实施例中，所述对所述目标cookie的name属性值进行改写，包含根据预设规则删除所述name属性值中所述目标服务对应的标识。
第二方面，本申请实施例还提供一种中间节点，所述中间节点至少包含存储器和处理器，所述存储器用于存储代理程序指令；所述处理器，用于调用并执行所述存储器中存储的代理程序指令，实现上述cookie管理方法。
第三方面，本申请实施例还提供一种WebVPN系统，包括上述中间节点、安装于用户终端的浏览器、以及至少一内网源站，所述中间节点对所述浏览器的请求报文进行代理，使得用户能通过所述浏览器访问所述内网源站。
第四方面，本申请实施例还提供一种计算机可读存储介质，所述存储介质中存储有至少一条指令、至少一段程序、代码集或指令集，所述至少一条指令、所述至少一段程序、所述代码集或指令集由处理器加载并执行以实现上述的cookie管理方法。
本申请实施例提供的技术方案带来的有益效果是：一方面，在用户通过浏览器经由中间节点访问源站的目标服务时，中间节点可接收源站返回的响应报文后，通过改写响应报文中的set-cookie字段，实现对不同的目标服务所对应的cookie进行分类管理，以及通过改写响应报文中的cookie获取方法，实现对改写后的cookie进行准确获取，避免了现有技术中不同内网服务的cookie的name值相同时，浏览器本地保存新的cookie会覆盖旧的cookie，从而导致访问异常的问题；另一方面，中间节点接收到浏览器发送的请求报文时，可以筛选出目标服务所对应的cookie封装进请求报文，并转发给运行目标服务的源站，使得源站获取到的cookie为其设定的值，从而实现正常访问。
附图说明
为了更清楚地说明本申请实施例中的技术方案，下面将对实施例描述中 所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本申请的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1是本申请实施例提供的一种WebVPN系统的示意图；
图2是本申请实施例提供的一种cookie管理方法流程图；
图3是图1所示的中间点节点的结构示意图。
具体实施方式
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都属于本申请保护的范围。
请参阅图1，本申请实施例提供了一种WebVPN系统，本实施例中，浏览器安装于手机、电脑等客户端，浏览器可以是IE(Internet Explorer)浏览器、谷歌浏览器(Google Chrome)、火狐(Firefox)浏览器等。中间节点可以是网页虚拟专用网络(Web Virtual Private Network，简称为WebVPN)网关或者WebVPN服务器。源站1至源站N均处于内网中，源站可以是部署有OA服务、ERP服务等应用服务的服务器，也可以是部署有多个软件即服务(Soft as a Service，简称为SaaS)服务的服务器。中间节点部署于浏览器与源站之间，一般基于虚拟专用网络(Virtual Private Network，VPN)与源站进行通信，外网用户需要访问内网源站时，可通过本地浏览器连接到中间节点，并通过中间节点的代理服务访问内网的源站，以实现基于浏览器的WebVPN服务，其中，用户所要访问的源站服务则可以称为目标服务。
中间节点包括收发模块，以及改写模块。当用户通过浏览器向目标服务发送请求报文时，中间节点的收发模块可接收并解析该请求报文，当请求报文中携带有cookie时，由改写模块对请求报文中的cookie的name属性值进行改写，再由收发模块将改写后的请求报文转发至运行目标服务的源站；当源站发送响应报文时，收发模块可对响应报文进行接收和解析，当根据解析结果判断出响应报文包含set-cookie字段时，由改写模块，对set-cookie字段进行改写，以及当响应报文中包含cookie获取方法时，由改写模块改写cookie获取方法， 进而由收发模块将改写后的响应报文发送给用户浏览器。
值得注意的是，在本申请的实施例中，各模块是基于运行在中间节点上的代理程序所实现的功能而虚拟出来的，换言之，各模块所执行的方法均通过执行部署在中间节点的代理程序而实现。具体而言，本申请实施例的中间节点至少包含存储器和处理器，所述存储器用于存储代理程序指令；所述处理器，用于调用并执行所述存储器中存储的代理程序指令，实现本申请实施例所提供的cookie管理方法。
以下将结合图2对中间节点所实现的方法进行详细说明。
请参阅图2，图2绘示本申请实施例提供的一种cookie管理方法，应用于图1所示的WebVPN系统中，具体可以包括以下步骤。
S201，浏览器接收用户访问目标服务的请求，并向中间节点发出请求报文。
在一个实施例中，当用户首次请求目标服务时，可以通过浏览器的地址栏输入中间节点的网址，浏览器接收到访问网址后会首先查询浏览器和操作系统的缓存中是否存储有与访问域名(即代理域名)对应的中间节点的IP地址，若缓存有中间节点的IP地址，浏览器可直接基于该IP地址生成对应的请求报文；若无缓存，则先对代理域名进行解析，获得对应的IP地址，并生成对应的请求报文。其中，所述请求报文可以是，例如超文本传输协议(Hyper Text Transfer Protocol，简称为HTTP)或超文本传输安全协议(Hyper Text Transfer Protocol over Secure Socket Layer，简称为HTTPS)报文。
中间节点接收到请求报文后会先对用户身份进行验证，验证通过后，即可提供包含应用服务的Web访问页面。用户在Web访问页面上查看可以访问的服务列表，如OA服务、ERP服务等，OA服务或者ERP服务均运行于内网源站；用户在浏览器的Web访问页面上选择需要访问的目标服务，浏览器可基于用户的选择生成请求报文发送给中间节点。
在本实施例中，当用户在一个对话中，再次请求同一目标服务时，浏览器可查找本地保存的代理域名对应的所有cookie，并在生成的请求报文中添加该些cookie，发送给中间节点。
S202，中间节点接收并解析浏览器发送的请求报文。
一般而言，以HTTP报文为例，请求报文可包括请求行、请求头以及请 求数据三个部分，请求行可以包括请求方法、统一资源定位符(Uniform Resource Locator，简称为URL)、HTTP协议版本，请求头可以包括accept、referer、host、cookie等字段，cookie字段包含有所有cookie及其相关的属性值。中间节点可通过对请求报文的解析，获取到URL及cookie字段的值。
S203，中间节点判断浏览器发送的请求报文是否包含cookie，如果不包含cookie，直接进入步骤S205；如果包含cookie，先进入步骤S204，然后进入步骤S205。
在一个实施例中，当中间节点通过解析请求报文获取到cookie字段时，可通过该字段是否为空来判断请求报文中是否包含cookie。
S204，中间节点从cookie中筛选出与目标服务对应的目标cookie，对其进行改写，并生成仅包含改写后的目标cookie的请求报文。
在一个实施例中，如上文所述，浏览器向中间节点发送的请求报文中可能携带有本地保存的代理域名下的所有cookie，因此，中间节点可根据请求报文中的URL确定用户请求的目标服务，进而从请求报文中携带的所有cookie中筛选出与目标服务对应的目标cookie，并对其进行改写，将目标cookie的name属性值恢复为目标服务设定的值，然后生成仅包含与改写后的目标cookie的请求报文。
S205，中间节点将请求报文转发至运行目标服务的源站。
S206，运行目标服务的源站向中间节点返回响应报文。
在一个实施例中，响应报文可包括状态行、响应头以及响应数据三个部分，其中，状态行部分可包括HTTP协议版本、状态码、状态码的文本描述；响应头部分可包括Allow、Date、Location、Set-Cookie等字段；响应数据部分可包括用户请求访问的超文本标记语言(Hyper Text Markup Language，简称为HTML)页面。源站在接收到中间节点发送的请求报文后，可对其进行响应，根据实际情况，响应报文中可包含Set-Cookie指令、或HTML页面数据。
S207，中间节点接收及解析运行目标服务的源站返回的响应报文。
中间节点通过对响应报文的解析，可获知响应报文中所包含的内容。
S208，中间节点判断运行目标服务的源站发送的响应报文是否包含set-cookie字段或cookie获取方法，如果不包含set-cookie字段和cookie获取方法，直接进入步骤S210；如果包含set-cookie字段或cookie获取方法，先进入 步骤S209，然后进入步骤S210。
在一个实施例中，中间节点通过识别响应头以及响应数据，分别判断响应报文中是否存在set-cookie字段以及是否存在cookie获取方法。其中，cookie的获取方法可包含在HTML页面中。
S209，中间节点改写set-cookie字段，并改写cookie获取方法。
在一个实施例中，中间节点改写set-cookie字段可包含改写响应头中的set-cookie字段的name属性值。
具体而言，若响应报文中包含set-cookie，为了便于管理cookie及防止cookie冲突，中间节点可在将响应报文转发至浏览器之前，为set-cookie中设定的cookie的name属性值添加分类标识，以区分不同的内网服务。
例如，用户请求访问源站的OA服务时，如果源站响应报文中包含set-cookie字段，且set-cookie字段中设定的cookie的name属性值为SessionID，为了防止其他内网服务也使用SessionID来设定name值，中间节点可根据预设规则，对set-cookie中设定的name的属性值进行改写，例如，可通过在设定值中添加标识，以区分不同的内网服务，在本示例中，可将set-cookie中name的属性值改写为OA_SessionID或者SessionID_OA，以防止其他内网服务使用同样的属性值。例如，如果该用户请求访问源站的ERP服务时，源站返回的set-cookie中name属性值也为SessionID，根据预设规则，中间节点可改写该name属性值为ERP_SessionID或者SessionID_ERP。这样，通过对name属性值进行改写以后，便防止浏览器根据各目标服务响应的set-cookie指令在本地生成对应的cookie时，由于name值重复，先生成的cookie被后生成的cookie覆盖的问题。相应的，在上述步骤204中，中间节点在对请求报文中的目标cookie进行改写时，具体可包含，根据预设规则，将目标cookie的name属性值中的标识删除，使得目标服务的源站可正确识别该cookie。
在一个实施例中，中间节点改写cookie的获取方法具体包含，中间节点通过向响应报文的HTML页面头部注入脚本文件，实现重写cookie获取方法的参数。
具体而言，响应报文中，HTML页面可能包含cookie的获取方法get()，已指示浏览器从本地获取cookie的相关属性值，如值(value)、有效期(Expires)等，从而完成相关的操作，如页面信息加载等，由于get()方法中对应参数为 目标服务设定的cookie的name值，如get(sessionId)，然而，由于浏览器基于set-cookie生成的cookie的name值已被改写，因此，需要将get()方法中的参数进行改写，才能保证浏览器正确获取到对应的cookie。
因此，在中间节点将源站返回响应报文转发至浏览器之前，需改写响应报文中的cookie获取方法，例如，可以向响应数据中HTML页面的头部注入JS(JavaScript)脚本文件，并发送给浏览器。该脚本文件用于重写HTML页面中包含的所有cookie获取方法，即将get(name)中的参数值，替换为根据预设规则改写后的name值，例如，将get(sessionId)改写为get(OA_SessionID)或者get(SessionID_OA)。
浏览器接收到响应报文后，会对HTML页面进行加载，在加载过程中，JS脚本文件被执行，从而实现cookie获取方法的改写。
值得注意的是，在本步骤中，中间节点根据响应报文中是否包含set-cookie和cookie获取方法，来确定是否执行对应的改写步骤，即当响应报文中包含set-cookie时，就需要基于上述方法对set-cookie进行改写，当响应报文中包含HTML页面数据时，也需要基于上述方法实现对cookie获取方法的改写。
S210，中间节点将响应报文转发至浏览器。
在一个实施例中，浏览器在接收到响应报文以后，根据改写后的set-cookie生成对应的cookie并保存在代理域名下。当需要执行cookie获取方法时，可基于改写后的cookie获取方法从本地数据中获取到对应的cookie。
基于上述方法，通过中间节点对请求报文和响应报文中的cookie、set-cookie和cookie获取方法的改写，可避免浏览器上指向不同目标服务的cookie，由于name值重复的问题，发生覆盖，进而导致访问异常的问题。
图3是本申请实施例提供的中间节点的结构示意图。该中间节点1100可因配置或性能不同而产生比较大的差异，可以包括一个或一个以上中央处理器1122(例如，一个或一个以上处理器)和存储器1132，一个或一个以上存储应用程序1142或数据1144的存储介质1130(例如一个或一个以上海量存储设备)。其中，存储器1132和存储介质1130可以是短暂存储或持久存储。存储在存储介质1130的程序可以包括一个或一个以上模块(图示没标出)，每个模块可以包括对中间节点1100中的一系列指令操作。在本实施例中，中央处理器1122可以设置为与存储介质1130通信，在中间节点1100上执行存储介质1130中的 一系列指令操作。
中间节点1100还可以包括一个或一个以上电源1129，一个或一个以上有线或无线网络接口1150，一个或一个以上输入输出接口1158，一个或一个以上键盘1156，和/或，一个或一个以上操作系统1141，例如Windows Server，Mac OS X，Unix，Linux，FreeBSD等。
中间节点1100可以包括有存储器，以及一个或者一个以上的程序，其中一个或者一个以上程序存储于存储器中，且经配置以由一个或者一个以上处理器执行所述一个或者一个以上程序包含用于进行上述cookie管理方法的指令。
本申请实施例提供的中间节点可以实现如图3所示的cookie管理方法相同的技术效果，在此不再赘述。
以上所描述的装置实施例仅仅是示意性的，其中所述分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部模块来实现本实施例方案的目的。本领域技术人员在不付出创造性劳动的情况下，即可以理解并实施。
通过以上实施例的描述，本领域的技术人员可以清楚地了解到各实施例可借助软件加必需的通用硬件平台的方式来实现，当然也可以通过硬件。基于这样的理解，上述技术方案本质上或者说相对于相关技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品可以存储在计算机可读存储介质中，如ROM/RAM、磁碟、光盘等，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行各个实施例或者实施例的某些部分所述的方法。
以上所述仅为本申请的部分实施例，并不用以限制本发明，凡在本申请的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本申请的保护范围之内。

Claims (11)

  1. 一种cookie管理方法，包括：
    中间节点接收及解析浏览器发送的请求报文，并将所述请求报文转发至运行目标服务的源站；
    所述中间节点接收及解析所述运行目标服务的源站返回的响应报文，如果所述响应报文包含set-cookie字段，则改写所述set-cookie字段，以及如果所述响应报文包含cookie获取方法，则改写所述cookie获取方法，并将改写后的响应报文发送至所述浏览器。
  2. 根据权利要求1所述的方法，其中，所述改写所述set-cookie字段具体为改写所述set-cookie字段中设定的cookie的name属性值。
  3. 根据权利要求2所述的方法，其中，所述改写所述name属性值包含根据预设规则，在所述name属性值中添加所述目标服务对应的标识。
  4. 根据权利要求1所述的方法，其中，所述改写所述cookie获取方法具体包含向所述响应报文的HTML页面头部注入脚本文件，其中，所述脚本文件被执行后，实现对所述cookie获取方法参数的改写。
  5. 根据权利要求4所述的方法，其中，所述cookie获取方法参数包含cookie的name属性值，所述对所述cookie获取方法参数的改写包含根据预设规则，在所述name属性值中添加所述目标服务对应的标识。
  6. 根据权利要求4所述的方法，其中，所述中间节点将改写后的响应报文发送至所述浏览器之后包括：
    浏览器在接收到响应报文以后，在加载所述HTML页面的过程中，执行所述脚本文件，以实现对所述HTML页面中的所述cookie获取方法进行改写。
  7. 根据权利要求1所述的方法，其中，所述中间节点接收及解析浏览器发送的请求报文，并将所述请求报文转发至运行目标服务的源站，包括：
    基于解析结果判断所述请求报文中是否包含cookie字段；
    如果不包含，则转发所述请求报文；
    如果包含，则从所述cookie字段中筛选出与所述目标服务对应的目标cookie，对所述目标cookie的name属性值进行改写，并生成仅包含所述改写后的目标cookie的请求报文，然后转发新生成的请求报文至所述源站。
  8. 根据权利要求7所述的方法，其中，所述对所述目标cookie的name属 性值进行改写，包含根据预设规则删除所述name属性值中所述目标服务对应的标识。
  9. 一种中间节点，所述中间节点至少包含存储器和处理器，所述存储器用于存储代理程序指令；所述处理器，用于调用并执行所述存储器中存储的代理程序指令，实现如权利要求1至8任一项所述的cookie管理方法。
  10. 一种WebVPN系统，包括如权利要求9所述的中间节点、安装于用户终端的浏览器、以及至少一内网源站，所述中间节点对所述浏览器的请求报文进行代理，使得用户能通过所述浏览器访问所述内网源站。
  11. 一种计算机可读存储介质，所述存储介质中存储有至少一条指令、至少一段程序、代码集或指令集，所述至少一条指令、所述至少一段程序、所述代码集或指令集由处理器加载并执行以实现如权利要求1至8任一项所述的cookie管理方法。
PCT/CN2020/122266 2020-08-18 2020-10-20 cookie管理方法、中间节点及WebVPN系统 WO2022036833A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010833352.0A CN112104703A (zh) 2020-08-18 2020-08-18 cookie管理方法、中间节点及webvpn系统
CN202010833352.0 2020-08-18

Publications (1)

Publication Number Publication Date
WO2022036833A1 true WO2022036833A1 (zh) 2022-02-24

Family

ID=73753951

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/122266 WO2022036833A1 (zh) 2020-08-18 2020-10-20 cookie管理方法、中间节点及WebVPN系统

Country Status (2)

Country Link
CN (1) CN112104703A (zh)
WO (1) WO2022036833A1 (zh)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112668048B (zh) * 2020-12-28 2023-01-31 上海掌门科技有限公司 一种在浏览器中显示网页的方法与设备
CN113204730B (zh) * 2021-05-19 2024-06-07 网宿科技股份有限公司 资源获取方法、webvpn代理服务器、系统及服务器

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20070136477A1 (en) * 2005-12-12 2007-06-14 Bryce Daniel J HTTP header intermediary for enabling session-based dynamic site searches
CN101984778A (zh) * 2008-01-26 2011-03-09 思杰系统有限公司 用于细粒度策略驱动的cookie代理的系统和方法
CN103154895A (zh) * 2010-08-05 2013-06-12 思杰系统有限公司 用于在多核系统中的核上管理cookie代理的系统和方法
CN104462242A (zh) * 2014-11-18 2015-03-25 北京国双科技有限公司 网页回流量统计方法及装置
CN105808731A (zh) * 2016-03-09 2016-07-27 北京小米移动软件有限公司 数据存储方法及装置
CN110191041A (zh) * 2019-05-05 2019-08-30 杭州迪普科技股份有限公司 局域网的设备的管理方法和装置

Family Cites Families (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20040228799A1 (en) * 1997-10-06 2004-11-18 Cynthia Armstrong Dysphagia diagnostic kit and materials
CN101251858B (zh) * 2008-03-12 2010-04-14 腾讯科技（深圳）有限公司 多页面浏览器中数据管理的方法及浏览器
GB0904559D0 (en) * 2009-03-17 2009-04-29 British Telecomm Web application access
CN102088465B (zh) * 2011-03-16 2014-04-16 中国科学院软件研究所 一种基于前置网关的HTTPCookie保护方法
CN103870671B (zh) * 2012-12-18 2017-05-31 秒针信息技术有限公司 一种从Cookie中提取用户样本的方法及装置
CN104468790B (zh) * 2014-12-09 2018-09-11 北京奇虎科技有限公司 cookie数据的处理方法与客户端
CN109657493A (zh) * 2018-12-17 2019-04-19 郑州云海信息技术有限公司 一种信息处理方法和装置
CN109933367A (zh) * 2019-02-03 2019-06-25 广州视源电子科技股份有限公司 小程序的Cookie实现方法、装置和计算机设备

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20070136477A1 (en) * 2005-12-12 2007-06-14 Bryce Daniel J HTTP header intermediary for enabling session-based dynamic site searches
CN101984778A (zh) * 2008-01-26 2011-03-09 思杰系统有限公司 用于细粒度策略驱动的cookie代理的系统和方法
CN103154895A (zh) * 2010-08-05 2013-06-12 思杰系统有限公司 用于在多核系统中的核上管理cookie代理的系统和方法
CN104462242A (zh) * 2014-11-18 2015-03-25 北京国双科技有限公司 网页回流量统计方法及装置
CN105808731A (zh) * 2016-03-09 2016-07-27 北京小米移动软件有限公司 数据存储方法及装置
CN110191041A (zh) * 2019-05-05 2019-08-30 杭州迪普科技股份有限公司 局域网的设备的管理方法和装置

Also Published As

Publication number Publication date
CN112104703A (zh) 2020-12-18

Similar Documents

Publication Publication Date Title
US10110695B1 (en) Key resource prefetching using front-end optimization (FEO) configuration
EP2976709B1 (en) Systems and methods for intercepting, processing, and protecting user data through web application pattern detection
US9292467B2 (en) Mobile resource accelerator
US8793347B2 (en) System and method for providing virtual web access
US8738711B2 (en) System and method for redirecting client-side storage operations
JP2018530090A (ja) 可変ブラウザ識別子のセッションベースのマッチング
US20110231482A1 (en) Automated Optimization Based On Determination Of Website Usage Scenario
CN107025234A (zh) 一种信息推送方法及缓存服务器
US11799849B2 (en) Secure web application delivery platform
CN110351283A (zh) 一种数据传输方法、装置、设备及存储介质
WO2022036833A1 (zh) cookie管理方法、中间节点及WebVPN系统
CN106656920B (zh) Http服务的处理方法、装置、存储介质及处理器
EP2901302B1 (en) Session-server affinity for clients that lack session identifiers
WO2019085074A1 (zh) 网站漏洞扫描方法、装置、计算机设备及存储介质
US20180205705A1 (en) Network request proxy system and method
CN109819033A (zh) 一种资源文件加载方法及系统
CN113452780B (zh) 针对客户端的访问请求处理方法、装置、设备及介质
CN111586201A (zh) 域名解析系统、方法、设备及存储介质
CN110674435A (zh) 页面访问方法、服务器、终端、电子设备及可读存储介质
CN109040072A (zh) 一种客户端授权登录网页的方法、系统、服务器及存储介质
US10860351B1 (en) Browser hooks on objects in web pages
US11200367B2 (en) Secure inter-frame communication
CN110633432A (zh) 一种获取数据的方法、装置、终端设备及介质
CN115484045A (zh) 一种基于api网关的统一身份认证方法及系统
EP3502925A1 (en) Computer system and method for extracting dynamic content from websites

Legal Events

Date Code Title Description
NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20950037

Country of ref document: EP

Kind code of ref document: A1