WO2022057002A1 - 一种异常请求处理方法和装置 - Google Patents

一种异常请求处理方法和装置 Download PDF

Info

Publication number
WO2022057002A1
WO2022057002A1 PCT/CN2020/122549 CN2020122549W WO2022057002A1 WO 2022057002 A1 WO2022057002 A1 WO 2022057002A1 CN 2020122549 W CN2020122549 W CN 2020122549W WO 2022057002 A1 WO2022057002 A1 WO 2022057002A1
Authority
WO
WIPO (PCT)
Prior art keywords
target
path
access request
mapping table
proxy
Prior art date
Application number
PCT/CN2020/122549
Other languages
English (en)
French (fr)
Inventor
陈加伟
谢文伟
Original Assignee
厦门网宿有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 厦门网宿有限公司 filed Critical 厦门网宿有限公司
Publication of WO2022057002A1 publication Critical patent/WO2022057002A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0236—Filtering by address, protocol, port number or service, e.g. IP-address or URL
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H04L12/4633—Interconnection of networks using encapsulation techniques, e.g. tunneling
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H04L12/4641—Virtual LANs, VLANs, e.g. virtual private networks [VPN]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/16—Implementing security features at a particular protocol layer
    • H04L63/168—Implementing security features at a particular protocol layer above the transport layer

Definitions

  • the present application relates to the field of Internet technologies, and in particular, to a method and device for processing abnormal requests.
  • VPN Virtual Private Network
  • Web Virtual Private Network provides web-based intranet application access control, allowing users to access web applications that are only open to the internal network.
  • WebVPN does not require users to install client software or browser plug-ins. Users can directly access the login page through the browser for authentication, which greatly reduces the threshold for using VPN technology and improves user experience.
  • some improved WebVPN systems focus both the authentication management link and the proxy access link on the proxy server side.
  • the above improved WebVPN system has some restrictions on the access requests sent by users. If the access request cannot meet the restriction conditions, the WebVPN system will judge it as an abnormal access request, and the WebVPN system will not be able to perform authentication management and correct forwarding on it, resulting in user access failure.
  • the purpose of the present application is to provide an abnormal request processing method and device, which can improve the success rate of user access.
  • the present application provides an abnormal request processing method, the method is applied to a proxy server, and the proxy server stores a global path mapping table and a user path mapping table, and the method includes: receiving a target user The target access request sent, wherein the target access request carries the target cookie information; determine whether the target access request is abnormal, if it is abnormal, obtain the target real path in the target access request, and query the target access request and the target access request.
  • the target global path mapping table corresponding to the real path to determine whether to reconstruct the URL in the target access request based on the target global path mapping table; if the target access request is not reconstructed based on the target global path mapping table
  • the URL in the target user path mapping table corresponding to the target cookie information is queried to determine whether to reconstruct the URL in the target access request based on the target user path mapping table.
  • the present application also provides an abnormal request processing device, the device is applied to a proxy server, and stores a global path mapping table and a user path mapping table, the device includes: an information receiving module, with After receiving the target access request sent by the target user, the target access request carries the target cookie information; the information judgment module is used to judge whether the target access request is abnormal, and if it is abnormal, obtain the information in the target access request.
  • the information reconstruction module is used to obtain the first proxy path uniquely corresponding to the target real path in the target global path mapping table, and reconstruct the target access request based on the first proxy path. and obtain the second proxy path corresponding to the target real path value in the target user path mapping table, and reconstruct the URL in the target access request based on the second proxy path.
  • another aspect of the present application also provides an exception request processing device, the device includes a memory and a processor, the memory is used to store a computer program, when the computer program is executed by the processor, Implement the above exception request handling method.
  • the proxy server for an abnormal access request sent by a user without a proxy path, the proxy server firstly queries the global path mapping table according to the real path in the above access request, to determine whether there is a real path in it and the above The only corresponding proxy path for the path, if there is a unique corresponding proxy path in the global path mapping table, based on the proxy path, the above abnormal access request will be supplemented; if there is no unique corresponding proxy path in the global path mapping table, further The user path mapping table corresponding to the user is queried, and the proxy path corresponding to the real path stored in the user path mapping table is obtained, and the abnormal access request is supplemented based on the proxy path.
  • the proxy server can reconstruct the abnormal access request sent by the user into a normal access request, so that the WebVPN system can perform subsequent authentication management and forwarding operations based on the reconstructed normal access request, which improves the user's internal access. success rate of web services.
  • FIG. 1 is a schematic diagram of the architecture of a WebVPN system provided by an embodiment of the present application.
  • FIG. 2 is a schematic flowchart of a method for processing an abnormal request provided by an embodiment of the present application
  • FIG. 3 is a specific step diagram of a method for processing an abnormal request provided by an embodiment of the present application.
  • FIG. 4 is a schematic diagram of functional modules of an abnormal request processing apparatus provided by an embodiment of the present application.
  • FIG. 5 is a schematic structural diagram of an apparatus for processing an exception request provided by an embodiment of the present application.
  • VPN Virtual Private Network
  • Web Virtual Private Network belongs to one of the VPN technologies. It can provide web-based intranet application access control and allow users to access web applications that are only open to the internal network. Different from traditional VPN technology, WebVPN does not require users to install client software or browser plug-ins. Users can directly access the login page through the browser for authentication, which greatly reduces the threshold for using VPN technology and improves user experience. In order to improve the security of the WebVPN system, some improved WebVPN systems focus both the authentication management link and the proxy access link on the proxy server side, which requires replacing the real domain name of the intranet service to unify the real domain name to the proxy domain name. At the same time, different path values (ie proxy paths) are used to distinguish different intranet services.
  • proxy paths are used to distinguish different intranet services.
  • Cookies are used to store user state information to create a seamless connection with the web server. Cookies are often used to handle user preferences and track session variables for server-side use.
  • the cookie processing process can be understood as: the client sends a connection request to the server through the browser. After receiving the above request, the server will generate a Set-cookie according to the information provided by the client, and the server will store the generated Set-cookie in the hyperlink.
  • the text transfer protocol (Hyper Text Transfer Protocol, referred to as HTTP) response message is sent back to the client. After receiving the above HTTP response message, the client will extract the content of the Set-cookie from the HTTP response message. , and generate a cookie information based on the content of the Set-cookie, and the client will save the above cookie information locally, and then the browser will send the corresponding cookie information to the server for each HTTP request.
  • the browser After the browser receives the Set-cookie sent by the server, it will parse the above-mentioned Set-cookie to generate cookie information, and save the generated cookie information locally.
  • the browser stores a large number of different cookie information locally, and when the browser sends an HTTP request to the server, it will judge which cookie information to put based on the Uniform Resource Locator (URL) information in the HTTP request.
  • URL Uniform Resource Locator
  • the browser will use the domain name and path contained in the URL information in the HTTP request as the standard to filter the locally stored cookie information. If the domain field and path field in a cookie information meet the above Standard, the browser will put the cookie information into the header of the above HTTP request.
  • FIG. 1 is a schematic structural diagram of a WebVPN system according to an embodiment of the present application.
  • the authentication server is used to verify the user's login request
  • the origin site is responsible for providing intranet application services
  • the proxy server is equivalent to a VPN gateway
  • the proxy server can establish a communication connection with the intranet server through the VPN network
  • the VPN network can be implemented based on the wide area software-defined network (Software-Defined Wide Area Network, referred to as SD-WAN) architecture.
  • the proxy server can also collect the real domain names of each intranet application in the internal network, that is, the public domain name, and converge the above real domain names to the VPN proxy domain name according to the preset rules, and then establish the real domain name and the converged domain name. (namely, virtual domain names), and store the above-mentioned mapping relationship in the local mapping table.
  • the user when the user needs to log in to the internal network, the user can open the VPN login page through the browser, and then enter the account and password.
  • the browser will generate a login request based on the information entered by the user, and the login request will be forwarded to the proxy server to Authentication server, the authentication server verifies the login request received according to the pre-stored user information, and based on the verification result, feeds back key user information (such as verification information, user ID, authorized content, etc.) to the proxy server, and the proxy server is receiving After the above-mentioned key user information is obtained, the key user information can be stored locally.
  • key user information such as verification information, user ID, authorized content, etc.
  • the proxy server After the subsequent access request sent by the user reaches the proxy server, the proxy server will perform authentication and authentication management on it based on the stored key information of the user. After passing the authentication and authentication access request, the proxy server can send it to the corresponding intranet source site. In order to obtain resources, the proxy server will deny access to the internal network for access requests that do not pass authentication. The information fed back by the origin site of the intranet will be sent to the user through the proxy server, so that the user can finally access the intranet application.
  • the proxy server is responsible for the authentication and authentication link and the application access link, and the key user information fed back by the authentication server does not need to be stored on the client, thereby avoiding leakage of the user's key information.
  • FIG. 2 is a flowchart of an exception request processing method provided by an embodiment of the present application
  • FIG. 3 is a specific step diagram of the method. The above abnormal request processing method is applied to the proxy server.
  • S101 Receive a target access request sent by a target user, wherein the target access request carries target cookie information.
  • the target user can choose to access various intranet services in the intranet.
  • the target user can select a corresponding label on the webpage, so that the browser can generate a corresponding access request based on the selection of the target user (that is, the target service). target access request).
  • the browser selects the corresponding cookie information (that is, the target cookie information) from the locally stored multiple cookie information, and then puts the target cookie information into the HTTP request.
  • the header information that is, the target access request, will carry the target cookie information.
  • the domain name of the intranet application on the user side needs to be converted in advance.
  • the specific processing method is as follows: the proxy server can pre-establish a local mapping table and map it locally. The domain name mapping relationship is stored in the table.
  • the proxy server can establish a local mapping table in the following manner: first, obtain the real domain names of each intranet application, and establish each real domain name and the path value based on different path values under the proxy domain name The domain name mapping relationship between them; then, the domain name mapping relationship is stored in the local mapping table.
  • the proxy server may collect the real domain names of each intranet application in the internal network in advance, and then set a corresponding virtual domain name for each real domain name.
  • the proxy server can uniformly converge the above real domain names to the proxy server domain name (ie proxy domain name), and mark different real domain names by setting different path values (such as path1, path2, path3, etc.) under the proxy domain name domain name, thereby establishing a domain name mapping relationship between each real domain name and a virtual domain name, wherein the virtual domain name is a combination of the proxy domain name and the path value.
  • the proxy server can map a.baidu.com to wsvpn.cn/path1, map b.baidu.com to wsvpn.cn/path2, and map c.sina.com to wsvpn.cn/path3, thereby establishing the domain name mapping relationship between a.baidu.com and path1, b.
  • the domain name mapping relationship between baidu.com and path2 and the domain name mapping relationship between c.sina.com and path3.
  • the proxy server may store the above-mentioned domain name mapping relationship in the local storage device in the form of a database. By querying the local mapping table, the proxy server can find the corresponding proxy path according to the real domain name, or find the corresponding real domain name according to the proxy path.
  • the target user needs to first send a login request to the authentication server.
  • the target user can open the login page through the browser, and then enter the account number and password.
  • the browser will generate a login request based on the information input by the target user, and the login request will be forwarded to the authentication server through the proxy server.
  • the stored user information verifies the received login request, and generates authentication information based on the verification result.
  • the above authentication information contains key user information (such as verification information, user ID, authorized content, etc.), and then the authentication server will put the above authentication information.
  • the information is sent to the proxy server.
  • the proxy server can store the user key information locally, and generate response information and send it to the target user.
  • the authentication information generated by the authentication server includes at least the target authorized content, the target user identifier and the first operation page.
  • the target authorized content is used to limit which intranet services the above target users can access.
  • the target authorized content can be represented by the real domain name and/or URL of the accessible service, that is, the real URL domain name and/or write name of the intranet service that the target user can access.
  • the target user identification is used to represent the unique identification code of the target user, and the target user identification can be the unique identification code generated by the authentication server based on the account number and password input by the target user;
  • the first operation page is the target user's unique identification code;
  • the operation page, such as the index page of the intranet application, the target user can access different intranet applications by selecting different options on the first operation page, which is usually a Hyper Text Markup Language (Hyper Text Markup Language, referred to as HTML) page.
  • HTML Hyper Text Markup Language
  • the authentication information generated by the authentication server may further include a Set-cookie (for convenience of description, it is hereinafter referred to as the first cookie setting information).
  • the proxy server may generate target cookie information based on the target user ID and/or target authorization content, and bind the generated target cookie information with the target user ID, so that When the proxy server receives an access request carrying target cookie information, it can query the corresponding target user identifier according to the target cookie information, and then the proxy server can determine that the access request is sent by the target user.
  • the proxy server may further bind the target cookie information and the target authorized content, thereby establishing a target authorization mapping relationship between the target cookie information and the target authorized content.
  • the proxy server can find the corresponding target authorization content according to the target cookie information, so as to perform authentication management on the target access request according to the target authorization content.
  • the proxy server may store the target authorization mapping relationship in the authorization mapping table, and simultaneously store the target authorization content and the target user ID in a local storage device.
  • the generation of the target cookie information by the proxy server based on the target user identifier and/or the target authorization content can be implemented in the following manner: first, generating the target value based on the target user identifier and/or the target authorization content; then, encapsulating the target value as the target value The value of the cookie setting information to generate the target cookie information according to the target cookie setting information.
  • the proxy server may extract the target user identification and/or the information in the target authorized content, and then use an encryption algorithm (eg, Message-Digest Algorithm 5 (MD5 for short), secure hashing The first version of the algorithm (Secure Hash Algorithm 1, SHA1 for short), etc.) encrypts the extracted information to obtain a new string value (that is, the target value).
  • an encryption algorithm eg, Message-Digest Algorithm 5 (MD5 for short), secure hashing
  • the first version of the algorithm (Secure Hash Algorithm 1, SHA1 for short), etc.) encrypts the extracted information to obtain a new string value (that is, the target value).
  • the above-mentioned target value obtained by encrypting the extracted target user identifier and/or target authorized content information is only illustrative, not a limitation of this application.
  • the technical personnel of the cookie can also use other information to generate the target value, such as encrypting the target user ID and/or target authorization content and/or random number, or encrypting the value/all field information in the first cookie setting information, Thereby generating the target value.
  • the proxy server can use it as the value of a new Set-cookie (that is, target cookie setting information), and write it into the value field of the target cookie setting information (that is, encapsulate it as a target cookie). The value of the setting information), thereby generating the target cookie setting information.
  • the proxy server will generate a cookie text file (ie, target cookie information) according to the content in the target cookie setting information.
  • the proxy server can set the name value in the target cookie setting information to be the same and identifiable, then when the proxy server receives an access request from the browser, it can name value to determine whether the access request carries the target cookie information. If the target cookie information is carried, the authorized content can be further verified. If the target cookie information is not carried, it can be directly identified as illegal access. The server may return the login page to the browser to notify the user to log in again.
  • the authentication information fed back by the authentication server is different (that is, different users have different user IDs and authorization content), and the value in the first cookie setting information fed back by the authentication server is different.
  • the values are also different, so for different users, the cookie information generated by the proxy server based on the user ID and/or authorized content is also different, that is, each user has a unique corresponding cookie information, and each user has a unique cookie.
  • the mapping relationship between the information and the authorized content so that the corresponding user ID can be found through the generated cookie information, and at the same time, the mapping relationship between the cookie information and the authorized content can be used to perform authentication and authentication management for different users.
  • the authorization mapping table stores the mapping relationship between the cookie information of each user and the corresponding authorization content.
  • the authorization mapping table stores the value of the cookie information and the corresponding authorization content. In this way, the proxy server can query the authorization content in the authorization mapping table based on the value in the target cookie information.
  • the above target access request needs to carry the target cookie information, so that the proxy server Find the target user ID and target authorized content through the target cookie information. Since the browser will generate different cookie information after receiving different Set-cookies, and the browser selects the appropriate cookie information according to the domain name information and path information when sending an access request, so in order to ensure the access sent by the browser
  • the request can carry target cookie information, and it is necessary to set the target cookie setting information generated by the proxy server and the access request sent by the browser.
  • the proxy server can set the domain field in the target cookie setting information to be empty, and set the path field in the target cookie setting information to "/".
  • the browser will automatically carry the target cookie information when generating the access request for the intranet application.
  • the domain names of all intranet applications included in the first operation page are real domain names.
  • the domain name carried in the URL in the target access request is the proxy domain name, then the proxy server needs to reconstruct the first operation page to obtain a new operation page (that is, the second operation page), wherein the second operation page contains The domain names of all intranet applications are proxy domain names.
  • the proxy server reconstructs the first operation page into the second operation page according to the local mapping table. Find the proxy path corresponding to the real domain name, and modify the real domain name to a virtual domain name, where the virtual domain name is a combination of the proxy domain name and the proxy path.
  • the proxy server may parse the first operation page to obtain the real domain names of each intranet application contained in the first operation page. After obtaining each real domain name included in the first operation page, the proxy server can query the local mapping table, and then obtain the proxy path corresponding to the above-mentioned real domain name, and then the proxy server can use the combination of the proxy domain name and the proxy path (ie The virtual domain name) replaces the real domain name, so as to obtain a new operation page (ie the second operation page) containing the proxy domain name, based on this, the access request generated by the browser based on the second operation page can be received by the proxy server.
  • a.baidu.com corresponds to path1
  • b.baidu.com corresponds to path2
  • c.sina.com corresponds to path3
  • the proxy domain name is wsvpn.cn
  • the proxy server can use www.a. Replace baidu.com with www.wsvpn.cn/path1, replace www.b.baidu.com with www.wsvpn.cn/path2, and replace www.c.sina.com with www.wsvpn.cn/path3, based on
  • the proxy server can reconstruct the first operation page, so as to obtain the second operation page including the proxy domain name.
  • the proxy server will retain it during page reconstruction. For example, assuming that the URL of an intranet application in the first operation page is: www.a.baidu.com/index.html, then the proxy server will retain its real path (ie index.html) when refactoring the page ), its URL will be replaced with: www.wsvpn.cn/path1/index.html in the second operation page.
  • the proxy server can send the above-mentioned target cookie setting information and the second operation page to the browser as response information, so that the browser can
  • the cookie setting information generates target cookie information, and sends an access request based on the second operation page, and the sent access request may carry the target cookie information.
  • the access requests generated based on the second operation page will be parsed by DNS to the proxy server and then received by the proxy server.
  • the proxy server when the proxy server reconstructs the first operation page, an error may occur, so that when the browser sends an access request based on the second operation page, the information carried in the access request is incomplete.
  • the proxy server when the proxy server reconstructs the first operation page, it only replaces www.a.baidu.com with www.wsvpn.cn, which makes the browser send the There is no proxy path (ie path1) in the access request; or due to the setting of html coding rules, the proxy server cannot completely rewrite the URL in the first operation page, and only the proxy domain name is included, but the proxy path is not included. , which in turn leads to an error in the virtual domain name in the access request sent by the user through the browser. In this way, the proxy server cannot obtain the corresponding real domain name based on the virtual domain name, resulting in abnormal access.
  • the proxy server does not send key user information to the browser, but saves it in the local storage device, so that whether it is on the browser side or in the external network communication process In this case, even illegal interceptors cannot obtain key user information, thus ensuring that key user information will not be leaked.
  • the proxy server uniformly converges the real domain names of each intranet application under the proxy domain name, so that the browser will only need to manage the SSL certificate of the proxy server, which greatly reduces the overhead of the browser to manage the SSL certificate. .
  • the proxy server may also modify the first cookie setting information, for example, setting the domain field in the first cookie setting information to be empty, and setting the path field in the first cookie setting information to "/", Then, the modified first cookie setting information is sent to the browser, so that the browser can generate the first cookie information based on the modified first cookie setting information.
  • the browser sends an access request, it can carry the first cookie information in the above-mentioned access request, and when the user accesses the authentication server again (for example, requests to refresh the page), it can automatically carry the first cookie information.
  • S102 Determine whether the target access request is abnormal, and if it is abnormal, obtain the target real path in the target access request, and query the target global path mapping table corresponding to the target real path to determine whether the target access request is abnormal based on the The target global path mapping table reconstructs the URL in the target access request.
  • the proxy server may first determine whether the target access request is abnormal. Specifically, the proxy server can determine whether there is a proxy path (that is, a target proxy path) in the URL information of the target access request, and if there is a target proxy path in the target access request, the proxy server can determine that the above-mentioned target access request is normal; if the target access request If there is no target proxy path in the proxy server, the proxy server can judge that the above target access request is abnormal.
  • a proxy path that is, a target proxy path
  • the proxy server can find the corresponding target authorization content according to the target cookie information, so as to perform authentication management on the target access request according to the target authorization content.
  • the content of how the proxy server performs authentication management on the target access request according to the target authorization content will be described in detail later.
  • the proxy server will first determine whether there is a proxy path in the access request. If there is a proxy path in the access request, the proxy server will obtain the access request. The real path and the proxy path are established, and the path mapping relationship between the real path and the proxy path is established. By repeating the above operations, the proxy server can obtain the path mapping relationship between the real path and the proxy path in each access request, and then the proxy server can establish a global path mapping table marked with each real path based on the above path mapping relationship. and a user path mapping table marked with each user ID.
  • the proxy server receives four access requests in sequence, and the corresponding URL information is access request 1: https://www.wsvpn.cn/path1/index.html, and access request 2: https://www.wsvpn.cn/path1/info.html, access request 3: www.wsvpn.cn/path2/index.html, access request 4: www.wsvpn.cn/path2/index.html, wherein, Access request 1, access request 2, and access request 4 are sent by user A, and access request 3 is sent by user B.
  • the proxy server can determine that path1 corresponds to index.html, path1 corresponds to info.html, and path2 Corresponding to index.html, the proxy server can bind path1 and path2 under the real path index.html, and bind path1 under the real path info.html, so as to establish the global path mapping table of the real path index.html and the real path
  • the proxy server can also find the corresponding user ID according to the target cookie information carried in the above three access requests, thereby determining that access request 1, access request 2, and access request 4 are sent by user A, and access request 3 is sent by user B, In this way, the proxy server can establish user A's user path mapping table and user B's user path mapping table according to the order of the received access requests, that is, user A's user path mapping table contains info.html and path1.
  • info.html and path1 contains info.html and path1.
  • the mapping relationship, and the mapping relationship between index.html and path2 there is a mapping relationship between index.html and path2 in the user path mapping table of user B.
  • the proxy server will perform the above operation every time it receives an access request, the global path mapping table and the user path mapping table are dynamically changed. In practical applications, whenever the proxy server receives a normal access request, the proxy server will add the proxy path in the access request to the global path mapping table of the real path in the access request. There may be one or more corresponding proxy paths in the path mapping table.
  • the proxy server can establish the mapping relationship between the real path in the access request and the proxy path based on the newly received normal access request, and update the corresponding user path mapping table, so that any user ID corresponds to In the user path mapping table of , there is only one latest proxy path corresponding to a real path. It should be noted that there may be multiple mapping relationships between real paths and proxy paths in the user path mapping table corresponding to a certain user ID, but in each of the above mapping relationships, there is only one corresponding proxy path for the real path.
  • the proxy server can parse the target access request to obtain the real path (ie, the target real path) carried by the URL information in the target access request, and then the proxy server can The global path mapping table of each real path saved locally is searched, and then the global path mapping table of the target real path (ie, the target global path mapping table) is obtained. After the proxy server finds the target global path mapping table, the proxy server can determine whether to reconstruct the URL in the target access request based on the target global path mapping table.
  • the proxy server determines whether to reconstruct the URL in the target access request based on the target global path mapping table, which can be achieved in the following ways:
  • the proxy server can parse the above target global path mapping table, thereby judging whether there is a corresponding proxy path (that is, the target proxy path set) in the above target global path mapping table. , if the proxy server determines that there is a target proxy path set in the target global path mapping table, the proxy server can further judge whether the proxy path contained in the target proxy path set is unique, if the proxy path contained in the target proxy path set is unique, then The above-mentioned unique proxy path can be regarded as the missing information of the target access request, and the proxy server can reconstruct the URL in the target access request based on the target global path mapping table. At this time, the proxy server can proceed to step S103.
  • the proxy server may feed back an abnormal message to the target user.
  • the proxy server will not be able to determine the missing information of the target access request according to the target proxy path set, so the proxy server cannot The URL in the target access request is reconstructed based on the target global path mapping table, and in this case, the proxy server may proceed to step S104.
  • the proxy server can reconstruct the URL in the target access request based on the target global path mapping table. Specifically, the proxy server may add the above-mentioned unique proxy path (ie, the first proxy path) to the URL information of the target access request, thereby modifying the target access request into a normal access request that meets the requirements of the WebVPN system.
  • the proxy server may add the above-mentioned unique proxy path (ie, the first proxy path) to the URL information of the target access request, thereby modifying the target access request into a normal access request that meets the requirements of the WebVPN system.
  • the proxy server finds that there is a unique path mapping table by querying the global path mapping table of info.html If the proxy path is path1, the proxy server can add path1 to the original URL information and modify it to https://www.wsvpn.cn/path1/info.html, so that the original abnormal access request will be reconstructed to conform to Normal access requests required by the WebVPN system.
  • the proxy server may redirect the reconstructed URL to the target user, for example, by means of 307 jumping, to redirect the reconstructed URL to the target user.
  • the reconstructed URL is sent to the target user, so that the target user's browser can automatically generate a new target access request based on the reconstructed URL, and send the above-mentioned new target access request to the proxy server.
  • there is a proxy path in the reconstructed URL Therefore, after receiving the new target access request, the proxy server will determine that it is a normal access request, and the proxy server can perform authentication management on it.
  • the proxy server can search for the corresponding target user identifier through the target cookie information, and then according to the found target user identifier, The target user path mapping table corresponding to the target user identifier is queried, and then it is judged whether to reconstruct the URL in the target access request based on the target user path mapping table.
  • the proxy server can determine whether there is a proxy path (ie, a second proxy path) corresponding to the target real path value in the target user path mapping table, and if there is a second proxy path in the target user path mapping table, the proxy server can The above-mentioned second proxy path is added to the URL information of the target access request, so that the target access request is modified into a normal access request that meets the requirements of the WebVPN system; if the second proxy path does not exist in the target user path mapping table, the proxy server will not be able to. Determine an appropriate proxy path for the target access request, and the proxy server can feed back an exception message to the target user.
  • a proxy path ie, a second proxy path
  • the proxy server finds that there are two of them by querying the global path mapping table of index.html The proxy paths are path1 and path2. Therefore, the proxy server further queries the user path mapping table of user A and obtains the index.html corresponding to path2. Then the proxy server can add path2 to the original URL information and modify it to https:/ /www.wsvpn.cn/path2/index.html, so that the URL in the original abnormal access request is reconstructed into a normal form that meets the requirements of the WebVPN system.
  • the proxy server may redirect the above-mentioned reconstructed URL to the target user, for example, by means of 307 jump.
  • the URL of the target user is sent to the target user, so that the target user's browser can automatically generate a new target access request based on the reconstructed URL, and send the above-mentioned new target access request to the proxy server.
  • there is a proxy path in the above reconstructed URL so after receiving the above-mentioned new target access request, the proxy server will judge it as a normal access request, and the proxy server can perform authentication management on it.
  • the proxy server for an abnormal access request sent by a user without a proxy path, the proxy server firstly queries the global path mapping table according to the real path in the above access request, to determine whether there is a real path in it and the above The only corresponding proxy path for the path, if there is a unique corresponding proxy path in the global path mapping table, based on the proxy path, the above abnormal access request will be supplemented; if there is no unique corresponding proxy path in the global path mapping table, further The user path mapping table corresponding to the user is queried, and then the proxy path corresponding to the real path stored in the user path mapping table is obtained, and based on the proxy path, the URL in the abnormal access request is completed.
  • the proxy server can convert the abnormal access request sent by the user into a normal access request, so that the WebVPN system can perform subsequent authentication management and forwarding operations based on the normal access request, which improves the success of users accessing intranet services. Rate.
  • the proxy server may perform authentication management on the received target access request. Specifically, the proxy server can parse the HTTP request header information of the target access request to obtain the target cookie information. It is worth noting that, as mentioned above, the proxy server can determine the name value of the cookie information carried in the target access request. Whether the carried cookie information is the target cookie information, if not, it can be directly determined that the visit is unauthorized, and the proxy server can return the login page to the browser to notify the target user to log in again; if so, it means sending the target visit The target user of the request may have been authenticated and have access to intranet resources.
  • the proxy server can query the authorization mapping table, and then determine whether there is target authorization content corresponding to the target cookie information in the authorization mapping table, and if there is a target authorization corresponding to the target cookie information in the authorization mapping table content, it means that the target user has passed the authentication of the authentication server, and the above-mentioned target user has the authority to access intranet resources. It should be pointed out that, because the proxy server only needs to judge whether the target user has the authority to access intranet resources, and It is not determined whether the target user can access the target origin site pointed to by the above target access request, so the proxy server does not need to parse the queried target authorization content at this time.
  • the proxy server cannot query the target authorization content corresponding to the target cookie information, it means that the target user has not passed the authentication of the authentication server, the target cookie information may be forged, and the target user does not have the right to access intranet resources. Access to the target origin site pointed to by the target access request will be denied, and the proxy server may return the login page to the browser to notify the target user to log in again.
  • the proxy server may further determine whether the target user can access the target source site pointed to by the above-mentioned target access request. Specifically, the proxy server can parse the target access request to obtain the URL information in the target access request, and then the proxy server can parse the above URL information to obtain domain name information (ie, virtual domain name). When the proxy server obtains the virtual domain name Then, the proxy server can determine whether the above virtual domain name exists in the target authorized content.
  • domain name information ie, virtual domain name
  • the proxy server determines whether the virtual domain name exists in the target authorized content, which can be implemented in the following manner: first, according to the local mapping table, look up the real domain name corresponding to the virtual domain name carried in the target access request; then, determine the above real domain name Whether the domain name exists in the target authoritative content.
  • the target URL in the target access request carries the virtual domain name. domain name.
  • the proxy server can parse the target URL to obtain the virtual domain name carried in the target URL, and then search for the real domain name corresponding to the virtual domain name according to the local mapping table. After finding the above-mentioned corresponding real domain name, the proxy server may query the target authorized content stored in the local storage device to determine whether the above-mentioned real domain name exists in the target authorized content.
  • the proxy server can query www.wsvpn.cn/path1 according to the local mapping table Corresponding to www.a.baidu.com, the proxy server can then query the authorized content stored locally, compare www.a.baidu.com with the domain name information in the authorized content, and then judge www.a.baidu.com Whether it exists in the above authorized content, if it exists, it means that the target user can access https://www.wsvpn.cn/path1/info/9396/58chbdg3.htm; if it does not exist, it means that the target user cannot access https: //www.wsvpn.cn/path1/info/9396/58chbdg3.htm.
  • the authorized content may be further specified as a URL, and accordingly, the proxy server may first find the real domain name corresponding to the virtual domain name through the above method, and modify the virtual domain name of the URL in the target access request to the real domain name, and then Query authorized content based on the modified URL to determine if the target user has access.
  • the proxy server can initiate an access request to the target origin site pointed to by the target access request based on the above target access request; If the virtual domain name does not exist in the target authorized content, it means that the target user cannot access the page pointed to by the target access request, and the proxy server can return a 403 status code to the browser to notify the target user that the target user is not authorized to access the target origin site.
  • the proxy server uses the target cookie information for authentication and authentication, and can also solve the problem of different users logging in to the internal network at the same time with the same account and password.
  • user A and user B both obtain an account and password for logging in to the internal network
  • the authentication server will feed back a first cookie setting information (denoted as Set-cookie1) and authorization content to user A, and then the proxy server will generate the target cookie setting information (denoted as Set-cookie2) based on Set-cookie1 and/or random number ), and the proxy server will locally save the mapping relationship between the target cookie information (referred to as cookie2, generated based on Set-cookie2) and the authorized content.
  • the authentication server will feed back another first cookie setting information (referred to as Set-cookie3) and authorization content to user A, and then the proxy server will Generate another target cookie setting information (recorded as Set-cookie4) based on Set-cookie3 and/or random number, and the proxy server will locally save the new target cookie information (recorded as cookie4, generated based on Set-cookie4) and authorized content mapping relationship.
  • Set-cookie3 another first cookie setting information
  • the proxy server will Generate another target cookie setting information (recorded as Set-cookie4) based on Set-cookie3 and/or random number, and the proxy server will locally save the new target cookie information (recorded as cookie4, generated based on Set-cookie4) and authorized content mapping relationship.
  • Set-cookie1 is not the same as the value in Set-cookie3, and the two random numbers are also different.
  • Set-cookie2 and Set-cookie4 are also different.
  • cookie2 and cookie4 are also different.
  • the user's key information returned by the authentication server such as the user ID
  • cookie4 will overwrite cookie2, that is, the proxy server locally saves always the latest target The mapping relationship between cookie information and authorized content.
  • the access request sent by user A will carry cookie2. Since the proxy server locally stores the mapping relationship between cookie4 and the authorized content, the proxy server will not be able to query the corresponding authorized content through cookie2.
  • the proxy server will refuse to access the target origin site pointed to by the target access request. At this time, the proxy server can return the login page to user A, so that A Users will no longer be able to access the internal network.
  • the proxy server uses the target cookie information for authentication and authentication, so that different users cannot use the same account and password to access the internal network at the same time.
  • the proxy server cannot directly access the target origin site pointed to by the target access request through the target URL.
  • the proxy server may modify the virtual domain name carried in the target access request to the corresponding real domain name before accessing the above-mentioned target source site. Specifically, the proxy server may query the virtual domain name carried in the target URL according to the local mapping table. The real domain name corresponding to the virtual domain name, and then replace the virtual domain name in the target URL with the above real domain name, so as to obtain a new URL containing the above real domain name, and finally modify the target URL carried in the target access request to the above new URL , so that the proxy server can send a request to the target origin site based on the above new URL to access the target origin site.
  • the target origin site may feed back user response information to the request sender (ie, the proxy server), and the user response information may include third cookie setting information.
  • the information stored in the domain field in the third cookie setting information is usually the generic domain name of the target application.
  • the proxy server can parse the third cookie setting information to obtain the domain information, and the proxy server can generate the third cookie information according to the content of the above-mentioned third cookie setting information, to A mapping relationship between the domain information and the third cookie information is established, so that the proxy server can query the corresponding third cookie information through the pan-domain name.
  • the browser when the user selects another application under the same generic domain name, the browser can generate a corresponding access request (ie, the second target access request) based on the user's selection, and the second target access request will carry the target cookie information.
  • the proxy server receives the above-mentioned second target access request, it first authorizes and authenticates it based on the target cookie information, and after the authentication passes, according to the real domain name corresponding to the virtual domain name included in the second target access request, from the domain information In the mapping relationship with the third cookie information, the corresponding third cookie information is searched.
  • the proxy server After the proxy server finds the corresponding third cookie information, it can add the above third cookie information to the second target access request, and at the same time, the proxy server will replace the virtual domain name with the real domain name to repeat the second target access request. and then send the reconstructed second target access request to the intranet application pointed to by the second target access request to request corresponding resources.
  • the target source station may parse the information stored in the third cookie information. Based on the analysis result, the target source station can determine whether the above-mentioned second target access request is legal. If it is legal, the target source station can send a response resource to the proxy server; if it is not legal, the target source station can send a 403 status code to the proxy server.
  • the real domain name corresponding to application service 1 provided by the target origin site is a.baidu.com
  • the real domain name corresponding to application service 2 is b.baidu.com.
  • the proxy server will receive the third cookie setting information returned by application service 1, and then the proxy server will establish a mapping relationship between .baidu.com and the third cookie information, so that the proxy server can pass .baidu.com finds the third cookie information.
  • the access request (ie the second target access request) generated by the browser will carry the target cookie information, and the proxy The server may perform authorization verification on the second access request based on the target cookie information.
  • the proxy server searches the local mapping table according to the virtual domain name (ie, wsvpn.cn/path2) carried in the second target access request, obtains the corresponding real domain name b.baidu.com, and then obtains the corresponding generic domain name .baidu.com, and then find the corresponding third cookie information according to the mapping relationship between the domain information and the third cookie information, and then the proxy server can put the above third cookie information into the second target access request.
  • the proxy server can modify the virtual domain name to the corresponding real domain name, so as to realize the reconstruction of the second target access request, and send the reconstructed second target access request to the source station of the application service 2, so that the application Service 2 can directly perform user behavior correlation based on the third cookie information.
  • the proxy server may further reconstruct the third cookie setting information according to the local mapping table. Specifically, the proxy server can query the virtual domain name corresponding to the real domain name according to the real domain name of the domain field in the third cookie setting information, and then add the virtual domain name to the path field of the third cookie setting information. The server sets the domain field in the third cookie setting information to be empty.
  • the proxy server may send the reconstructed third cookie setting information to the browser.
  • the browser can carry the third cookie information (generated based on the reconstructed third cookie setting information) in the access request sent this time, so as to ensure the cookie mechanism. Normal operation, to avoid the browser not carrying the corresponding cookie information correctly when sending the request, resulting in inaccessibility.
  • the proxy server after the proxy server accesses application service 1, the proxy server will receive the third cookie setting information returned by application service 1. At this time, the proxy server can reconstruct the third cookie setting information, The domain field of the third cookie setting information is set to be empty, and wsvpn.cn/path1 is added to the path field of the third cookie setting information, and then the reconstructed third cookie setting information is sent to the browser. In this way, when the target user needs to access the resources provided by the application service 1, the access request sent by the browser will carry the third cookie information, which ensures the normal operation of the cookie mechanism, and the browser can access the application service 1 normally.
  • the user response information fed back by the target origin site further includes a user response page
  • the domain name included in the user response page is the real domain name corresponding to each intranet application
  • the access request sent by the browser carries the Virtual domain name
  • the proxy server needs to reconstruct the above user response page.
  • the proxy server can first obtain each real domain name contained in the user response page, and then look up the virtual domain name corresponding to each real domain name according to the local mapping table, and then modify the above real domain name to the corresponding virtual domain name, so as to complete the user Responsive page refactoring.
  • the proxy server can send the reconstructed user response page to the browser, so that the browser can render the user response page.
  • the technical solution provided by this application establishes a unique mapping relationship between user key information and target cookie information by binding the target cookie information with the authorized content, and then authenticates the user through the target cookie information.
  • the links are managed, so that the authentication and authentication links and the application access links are concentrated on the proxy server side, so that key user information does not need to be stored on the browser side, avoiding the leakage of key user information.
  • by updating the target cookie information different users can not use the same account and password to access the internal network at the same time, which further improves the security of the system.
  • this application establishes the mapping relationship between the third cookie information and the pan-domain name based on the third cookie setting information fed back by the website, so as to simplify user access, and also The third cookie setting information is reconstructed to ensure the normal operation of the cookie mechanism and avoid errors when the browser renders the web page.
  • the present application also provides an abnormal request processing device, the device is applied to a proxy server, and stores a global path mapping table and a user path mapping table, the device includes:
  • an information receiving module configured to receive a target access request sent by a target user, wherein the target access request carries target cookie information
  • the information judgment module is used to judge whether the target access request is abnormal, and if it is abnormal, obtain the target real path in the target access request, and query the target global path mapping table corresponding to the target real path to determine Whether to reconstruct the URL in the target access request based on the target global path mapping table, and when not reconstructing the URL in the target access request based on the target global path mapping table, query the target cookie information Corresponding target user path mapping table, to determine whether to reconstruct the URL in the target access request based on the target user path mapping table;
  • an information reconstruction module configured to obtain the first proxy path uniquely corresponding to the target real path in the target global path mapping table, and reconstruct the URL in the target access request based on the first proxy path, and Acquire a second proxy path corresponding to the target real path value in the target user path mapping table, and reconstruct the URL in the target access request based on the second proxy path.
  • determining whether the target access request is abnormal includes:
  • the target access request is abnormal.
  • determining whether to reconstruct the URL in the target access request based on the target global path mapping table includes:
  • the URL in the target access request is not reconstructed based on the target global path mapping table.
  • determining whether to reconstruct the URL in the target access request based on the target user path mapping table includes:
  • the apparatus further comprises:
  • a mapping table generation module configured to establish the global path mapping table marked with the real path based on the path mapping relationship, and the user path mapping table marked with the user ID;
  • the information judging module is further configured to judge whether there is a proxy path in each of the received access requests, and if so, obtain the path mapping relationship between the real path and the proxy path in each of the access requests.
  • the apparatus further comprises:
  • a redirection module configured to redirect the reconstructed URL to the target user, so that the target user generates a new target access request including the reconstructed URL, and accesses the new target sending the request to the proxy server;
  • the authentication judgment module is used for authenticating the reconstructed target access request.
  • the present application further provides an exception request processing apparatus, the apparatus includes a memory and a processor, and the memory is used for storing a computer program.
  • the apparatus may include a processor, an internal bus and a memory.
  • the memory may include internal memory as well as non-volatile memory.
  • the processor reads the corresponding computer program from the non-volatile memory into the memory and executes it.
  • FIG. 5 is only for illustration, and does not limit the structure of the above-mentioned device.
  • the apparatus may further include more or less components than those shown in FIG.
  • 5 may also include other processing hardware, such as a GPU (Graphics Processing Unit, image processor), or an external communication port and the like.
  • processing hardware such as a GPU (Graphics Processing Unit, image processor), or an external communication port and the like.
  • GPU Graphics Processing Unit, image processor
  • external communication port and the like.
  • the present application does not exclude other implementations, such as logic devices or a combination of software and hardware.
  • the processor may include a central processing unit (CPU) or a graphics processing unit (GPU), and of course, may also include other single-chip microcomputers, logic gate circuits, integrated circuits, etc. with logic processing capabilities, or their appropriate combination.
  • the memory described in this embodiment may be a memory device for storing information.
  • a device that can store binary data can be a memory; in an integrated circuit, a circuit with a storage function that does not have a physical form can also be a memory, such as RAM, FIFO, etc.; Equipment can also be called storage, etc.
  • the storage may also be implemented in a cloud storage manner, and the specific implementation manner is not limited in this specification.
  • each embodiment can be implemented by means of software plus a necessary general hardware platform, and certainly can also be implemented by hardware.
  • the above-mentioned technical solutions can be embodied in the form of software products in essence or the parts that make contributions to the prior art, and the computer software products can be stored in computer-readable storage media, such as ROM/RAM, magnetic A disc, an optical disc, etc., includes several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to perform the methods described in various embodiments or some parts of the embodiments.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Power Engineering (AREA)
  • Information Transfer Between Computers (AREA)

Abstract

本申请公开了一种异常请求处理方法，所述方法包括：接收目标用户发送的目标访问请求；判断所述目标访问请求是否异常，若异常，则获取所述目标访问请求中的目标真实路径，并查询与所述目标真实路径相对应的目标全局路径映射表，以判断是否基于所述目标全局路径映射表重构所述目标访问请求中的URL；若不基于所述目标全局路径映射表重构所述目标访问请求中的URL，则查与所述目标cookie信息相对应的目标用户路径映射表，以判断是否基于所述目标用户路径映射表重构所述目标访问请求中的URL。

Description

一种异常请求处理方法和装置
交叉引用
本申请要求于2020年09月16日递交的名称为“一种异常请求处理方法和装置”、申请号为202010973627.0的中国专利申请的优先权，其通过引用被全部并入本申请。
技术领域
本申请涉及互联网技术领域，特别涉及一种异常请求处理方法和装置。
背景技术
随着网络安全形势日益严峻，为了阻断来自外部网络的攻击，越来越多的企业和机构将业务限制在内部网络中，禁止来自外部网络的访问，然而很多时候机构内部人员又需要从外部网络访问内部应用，虚拟专用网络(Virtual Private Network，简称为VPN)技术便应运而生。
网页虚拟专用网络(Web Virtual Private Network，简称为WebVPN)提供基于web的内网应用访问控制，允许用户访问只对内部网络开放的web应用。区别于传统VPN技术，WebVPN无需用户安装客户端软件或者浏览器插件，用户可以直接通过浏览器访问登录页面进行身份验证，这大大降低了VPN技术的使用门槛，提升了用户体验。为提高WebVPN系统的安全性，一些改进的WebVPN系统将鉴权管理环节和代理访问环节都集中在代理服务器侧，但是上述改进的WebVPN系统对用户发送的访问请求存在一些限制条件，针对用户发送的不能满足限制条件的访问请求，WebVPN系统会判定其为异常访问请求，WebVPN系统将无法对其进行鉴权管理及正确转发，从而导致用户访问失败。
鉴于此，有必要提供一种新的异常请求处理方法和装置以解决上述不足。
发明内容
本申请的目的在于提供一种异常请求处理方法和装置，可以提高用户访问成功率。
为实现上述目的，本申请一方面提供一种异常请求处理方法，所述方法应用于代理服务器，所述代理服务器中储存有全局路径映射表和用户路径映射表，所述方法包括：接收目标用户发送的目标访问请求，其中，所述目标访问请求携带有目标cookie信息；判断所述目标访问请求是否异常，若异常，则获取所述目标访问请求中的目标真实路径，并查询与所述目标真实路径相对应的目标全局路径映射表，以判断是否基于所述目标全局路径映射表重构所述目标访问请求中的URL；若不基于所述目标全局路径映射表重构所述目标访问请求中的URL，则查询与所述目标cookie信息相对应的目标用户路径映射表，以判断是否基于所述目标用户路径映射表重构所述目标访问请求中的URL。
为实现上述目的，本申请另一方面还提供一种异常请求处理装置，所述装置应用于代理服务器，并储存有全局路径映射表和用户路径映射表，所述装置包括：信息接收模块，用于接收目标用户发送的目标访问请求，其中，所述目标访问请求携带有目标cookie信息；信息判断模块，用于判断所述目标访问请求是否异常，若异常，则获取所述目标访问请求中的目标真实路径，并查询与所述目标真实路径相对应的目标全局路径映射表，以判断是否基于所述目标全局路径映射表重构所述目标访问请求中的URL，以及在不基于所述目标全局路径映射表重构所述目标访问请求中的URL时，查询与所述目标cookie信息相对应的目标用户路径映射表，以判断是否基于所述目标用户路径映射表重构所述目标访问请求中的URL；信息重构模块，用于获取所述目标全局路径映射表中与所述目标真实路径唯一对应的第一代理路径，并基于所述第一代理路径重构所述目标访问请求中的URL，以及获取所述目标用户路径映射表中与所述目标真实路径值相对应的第二代理路径，并基于所述第二代理路径重构所述目标访问请求中的URL。
为实现上述目的，本申请另一方面还提供一种异常请求处理装置，所述装置包括存储器和处理器，所述存储器用于存储计算机程序，当所述计算机程序被所述处理器执行时，实现上述异常请求处理方法。
由此可见，本申请提供的技术方案，针对用户发送的未携带代理路径的异常访问请求，代理服务器首先根据上述访问请求中的真实路径，查询全局路径映射表，以判断其中是否存在与上述真实路径唯一对应的代理路径，如果全局路径映射表中存在唯一对应的代理路径，则基于该代理路径，将上述异常访问请求补充完整；如果全局路径映射表中不存在唯一对应的代理路径，则进一步查询该用户对应的用户路径映射表，进而获取上述用户路径映射表中保存的， 与上述真实路径相对应的代理路径，并基于该代理路径，将上述异常访问请求补充完整。通过上述方法，代理服务器可以将用户发送的异常访问请求重构为正常访问请求，从而使得WebVPN系统可以基于重构后的正常访问请求，进行后继的鉴权管理及转发操作，提高了用户访问内网服务的成功率。
附图说明
为了更清楚地说明本申请实施例中的技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本申请的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1是本申请实施例提供的一种WebVPN系统的架构示意图；
图2是本申请实施例提供的一种异常请求处理方法的流程示意图；
图3是本申请实施例提供的一种异常请求处理方法的具体步骤图；
图4是本申请实施例提供的异常请求处理装置的功能模块示意图；
图5是本申请实施例提供的异常请求处理装置的结构示意图。
具体实施方式
为使本申请的目的、技术方案和优点更加清楚，下面将结合附图对本申请实施例作详细描述。
随着网络安全形势日益严峻，为了阻断来自外部网络的攻击，越来越多的企业和机构将业务限制在内部网络中，禁止来自外部网络的访问，然而很多时候机构内部人员又需要从外部网络访问内部应用，虚拟专用网络(Virtual Private Network，简称为VPN)技术便应运而生。VPN技术可以利用公用网络架设专用网络，并通过对数据包的加密和数据包目标地址的转换实现用户的远程访问。
网页虚拟专用网络(Web Virtual Private Network，简称为WebVPN)属于VPN技术中的一种，它可以提供基于web的内网应用访问控制，允许用户访问只对内部网络开放的web应用。区别于传统VPN技术，WebVPN无需用户安装客户端软件或者浏览器插件，用户可以直接通过浏览器访问登录页面进行身份验证，这大大降低了VPN技术的使用门槛，提升了用户体验。为提高WebVPN系统的安全性，一些改进的WebVPN系统将鉴权管理环节和代理访问环节都集中在代理服务器侧，这就需要对内网服务的真实域名进行替换，以将真实域名 统一至代理域名下，同时利用不同的路径值(即代理路径)来区分不同的内网服务。但是在实际应用中，经常出现域名替换错误的问题，例如只是将真实域名替换为代理域名，但是没有添加代理路径，这就导致用户发送的访问请求携带的信息不完整，WebVPN系统会判定其为异常访问请求，WebVPN系统将无法对其进行鉴权管理及正确转发，从而导致用户访问失败。
因此，如何处理用户发送的异常访问请求，提高用户访问内网服务的成功率，便成为本领域亟需解决的课题。
本申请提供的技术方案可以解决上述不足。
为便于理解本申请中涉及到的cookie的内容，下面对其进行简要介绍。
cookie用于存储用户状态信息，以创建和web服务器无缝连接的效果，cookie通常用于处理用户的优先选择并跟踪会话变量，以方便服务器端使用。cookie的处理过程可以理解为：客户端通过浏览器向服务器发送连接请求，服务器在接收到上述请求后，将根据客户端提供的信息生成一个Set-cookie,服务器将生成的Set-cookie存放在超文本传输协议(Hyper Text Transfer Protocol，简称为HTTP)应答报文中并回传给客户端，客户端在接收到上述HTTP应答报文后，会将Set-cookie的内容从HTTP应答报文中取出，并基于Set-cookie的内容生成一个cookie信息，并且客户端会在本地保存上述cookie信息，之后每次HTTP请求浏览器都会将相应的cookie信息发送给服务器。
Set-cookie的格式如下：
Set-cookie:name＝value；domain＝DOMAIN_NAME；path＝PATH；expires＝DATE；secure其中，name字段用于定义cookie信息的名称，value字段用于存储cookie信息中的字符串值，domain字段用于定义cookie信息对于哪个域名是有效的，path字段用于定义cookie信息影响到的路径，expires字段用于定义cookie信息的失效时间，secure字段用于标记安全标志。需要指出的是，当domain字段为空时，浏览器只允许发布该cookie的主机进行访问。
当浏览器接收到服务器发送的Set-cookie后，将解析上述Set-cookie以生成cookie信息，并将生成的cookie信息保存在本地。通常浏览器本地储存有大量不同的cookie信息，而浏览器在向服务器发送HTTP请求时，会基于HTTP请求中的统一资源定位符(Uniform Resource Locator，简称为URL)信息来判断将哪个cookie信息放入HTTP报文中，具体的，浏览器将以HTTP请求中URL信息中包含的域名、路径为标准，对本地保存的cookie信息进行筛选，若某一个cookie信息中的domain字段和path字段符合上述标准，浏览器将把该cookie 信息放入上述HTTP请求的报文头部。
请参阅图1，为本申请实施例提供的一种WebVPN系统的架构示意图。
在本实施例中，鉴权服务器用于对用户的登录请求进行验证，源站负责提供内网应用服务，代理服务器相当于VPN网关，代理服务器可通过VPN网络与内网服务器建立通信连接，其中，VPN网络可基于广域软件定义网络(Software-Defined Wide Area Network，简称为SD-WAN)架构实现。同时代理服务器还可以收集内部网络中各个内网应用的真实域名，即公网域名，并按照预设规则将上述各个真实域名收敛至VPN的代理域名之下，然后建立真实域名和收敛后的域名(即虚拟域名)之间的映射关系，并将上述映射关系储存在本地映射表中。
在实际应用中，当用户需要登录内部网络时，用户可以通过浏览器打开VPN登录页面，然后输入账号及密码，浏览器将基于用户输入的信息生成登录请求，该登录请求将通过代理服务器转发至鉴权服务器，鉴权服务器根据预先储存的用户信息对接收到登录请求进行验证，并基于验证结果将用户关键信息(例如验证信息、用户ID、授权内容等)反馈给代理服务器，代理服务器在接收到上述用户关键信息后，可以将用户关键信息储存在本地。
用户后继发送的访问请求在到达代理服务器后，代理服务器将基于保存的用户关键信息对其进行认证鉴权管理，通过认证鉴权的访问请求，代理服务器可以将其发送至对应的内网源站以获取资源，未通过认证鉴权的访问请求，代理服务器将拒绝其访问内部网络。内网源站反馈的信息将通过代理服务器发送至用户，从而使得用户最终实现对内网应用的访问。
在本实施例中，代理服务器负责认证鉴权环节和应用访问环节，鉴权服务器反馈的用户关键信息无需保存在用户端，从而避免了用户关键信息的泄露。
请一并参阅图2和图3。图2为本申请实施例提供的一种异常请求处理方法的流程图，图3为该方法的具体步骤图。上述异常请求处理方法应用于代理服务器。
S101：接收目标用户发送的目标访问请求，其中，所述目标访问请求携带有目标cookie信息。
在本实施例中，当某一个用户(即目标用户)通过登录验证，获准通过VPN网络访问内网应用后，该目标用户便可以选择访问内部网络中的各种内网服务。具体而言，当上述目标用户需要访问某一个内网服务(即目标服务)时，该目标用户可以选择网页上相应的标签，以使得浏览器可以基于目标用户的选 择生成相应的访问请求(即目标访问请求)。同时，浏览器将基于目标访问请求中携带的域名信息和路径信息，从本地保存的多个cookie信息中选择出对应的cookie信息(即目标cookie信息)，然后将目标cookie信息放入HTTP请求的头部信息中，亦即目标访问请求中将携带目标cookie信息。
在本申请实施例中，为了使得目标访问请求可以被代理服务器接收，需要预先将用户侧的内网应用的域名进行转换，具体处理方式如下：代理服务器可以预先建立本地映射表，并在本地映射表中储存域名映射关系。
在一个实施例中，代理服务器建立本地映射表可以通过如下方式实现：首先，获取各个内网应用的真实域名，并基于代理域名下的不同路径值，建立各个所述真实域名与所述路径值之间的域名映射关系；然后，将所述域名映射关系储存于所述本地映射表中。
在一个实施例中，代理服务器可以预先收集内部网络中各个内网应用的真实域名，然后为各个真实域名设置对应的虚拟域名。具体的，代理服务器可以将上述各个真实域名统一收敛到代理服务器域名(即代理域名)之下，并通过在代理域名下设置不同的路径值(例如path1、path2、path3等)，标记不同的真实域名，从而建立各个真实域名与虚拟域名之间的域名映射关系，其中虚拟域名为代理域名和路径值的组合。
例如，假设代理服务器收集到如下三个真实域名a.baidu.com、b.baidu.com、c.sina.com，而代理域名为wsvpn.cn，那么代理服务器可以将a.baidu.com映射至wsvpn.cn/path1，将b.baidu.com映射至wsvpn.cn/path2，将c.sina.com映射至wsvpn.cn/path3，从而建立a.baidu.com与path1的域名映射关系，b.baidu.com与path2的域名映射关系，c.sina.com与path3的域名映射关系。
当代理服务器建立真实域名与代理路径之间的域名映射关系后，代理服务器可以将上述域名映射关系以数据库的形式保存在本地储存设备中。通过查询本地映射表，代理服务器可以根据真实域名查找到对应的代理路径，或者根据代理路径查找到对应的真实域名。
在实际应用中，目标用户在获准登录内部网络之前，目标用户需要首先向鉴权服务器发送登录请求。具体的，目标用户可以通过浏览器打开登录页面，然后输入账号及密码，浏览器将基于目标用户输入的信息生成登录请求，该登录请求将通过代理服务器转发至鉴权服务器，鉴权服务器根据预先储存的用户信息对接收到登录请求进行验证，并基于验证结果生成认证信息，上述认证信息中包含有用户关键信息(例如验证信息、用户ID、授权内容等)，然后鉴权 服务器将把上述认证信息发送至代理服务器，代理服务器在接收到上述认证信息后，可以将用户关键信息储存在本地，并生成响应信息发送给目标用户。
在一个实施例中，鉴权服务器生成的认证信息中至少包括目标授权内容、目标用户标识和第一操作页面。目标授权内容用于限定上述目标用户可以访问哪些内网服务，目标授权内容可以通过可访问服务的真实域名和/或URL体现，即将目标用户可以访问的内网服务的真实URL域名和/或写入上述目标授权内容中；目标用户标识用于表示目标用户的唯一识别码，目标用户标识可以是鉴权服务器基于目标用户输入的账号及密码生成的唯一标识码；第一操作页面为目标用户的操作页面，例如内网应用的索引页，目标用户可以通过选择第一操作页面上的不同选项访问不同的内网应用，其通常为超文本标记语言(Hyper Text Markup Language，简称为HTML)页面。
需要特别指出的是，鉴权服务器生成的认证信息中还可以包括一个Set-cookie(为便于叙述，下文将其称为第一cookie设置信息)。
在一个实施例中，当代理服务器接收到上述认证信息后，代理服务器可以基于目标用户标识和/或目标授权内容生成目标cookie信息，并将生成的目标cookie信息与目标用户标识进行绑定，这样当代理服务器接收到一个携带有目标cookie信息的访问请求时，便可以根据目标cookie信息查询到对应的目标用户标识，进而代理服务器便可以确定该访问请求是由目标用户发送的。
本实施例中，代理服务器还可以将目标cookie信息与目标授权内容进行绑定，从而建立目标cookie信息与目标授权内容之间的目标授权映射关系。通过上述目标授权映射关系，代理服务器可以根据目标cookie信息查找到对应的目标授权内容，从而根据目标授权内容对目标访问请求进行鉴权管理。在实际应用中，代理服务器可以将上述目标授权映射关系储存于授权映射表中，同时将上述目标授权内容和目标用户标识保存在本地储存设备中。
代理服务器基于目标用户标识和/或目标授权内容生成目标cookie信息可以通过如下方式实现：首先，基于目标用户标识和/或目标授权内容生成目标value值；然后，将所述目标value值封装为目标cookie设置信息的value值，以根据所述目标cookie设置信息生成所述目标cookie信息。
在一个实施例中，代理服务器可以提取目标用户标识和/或目标授权内容中的信息，然后利用加密算法(例如消息摘要算法第五版(Message-Digest Algorithm 5，简称为MD5)、安全哈希算法第一版(Secure Hash Algorithm 1，简称为SHA1)等)对提取到信息进行加密，从而得到一个新的字符串值(即目 标value值)。
需要特别指出的是，上述通过对提取到的目标用户标识和/或目标授权内容信息进行加密，从而得到目标value值只是示意性的，并不是对本申请的限制，基于本申请的思想，本领域的技术人员也可以利用其它信息生成目标value值，例如对目标用户标识和/或目标授权内容和/或随机数进行加密，或者对第一cookie设置信息中的value值/全部字段信息进行加密，从而生成目标value值。
当代理服务器生成目标value值后，代理服务器可以将其作为新的Set-cookie(即目标cookie设置信息)的value值，并将其写入目标cookie设置信息的value字段(即将其封装为目标cookie设置信息的value值)，从而生成目标cookie设置信息。当代理服务器生成目标cookie设置信息之后，代理服务器将根据上述目标cookie设置信息中的内容生成一个cookie文本文件(即目标cookie信息)。
在一个实施例中，代理服务器可将目标cookie设置信息中的name值设置为相同且可识别的，那么当代理服务器接收到浏览器的访问请求时，可先根据访问请求中携带的cookie信息中的name值来判断该访问请求中是否携带有目标cookie信息，若携带有目标cookie信息，则可以进一步对授权内容进行验证，若没有携带目标cookie信息，则可直接将其识别为非法访问，代理服务器可以向浏览器返回登录页面，以通知该用户重新进行登录。
需要特别指出的是，针对不同的用户，鉴权服务器反馈的认证信息是不同的(即不同的用户具有不同的用户标识和授权内容)，并且鉴权服务器反馈的第一cookie设置信息中的value值也是不同的，因此针对不同的用户，代理服务器基于用户标识和/或授权内容生成的cookie信息也是不同的，即每一个用户都存在唯一对应的cookie信息，同时每一个用户都存在唯一的cookie信息与授权内容的映射关系，如此便可以通过上述生成的cookie信息查找到对应的用户标识，同时利用cookie信息与授权内容之间的映射关系，对不同用户进行认证鉴权管理。需要指出的是，授权映射表中存储有各个用户的cookie信息与对应授权内容之间的映射关系，在一实施例中，授权映射表中存储有cookie信息的value值与对应授权内容之间的映射关系，如此一来，代理服务器可基于目标cookie信息中的value值查询到授权映射表中的授权内容。
需要特别指出的是，若要通过目标cookie信息查询到目标用户标识，以及通过代理服务器对浏览器发送的目标访问请求进行认证鉴权管理，则上述目标访问请求需要携带目标cookie信息，以便代理服务器通过目标cookie信息查 找到目标用户标识和目标授权内容。由于浏览器在接收到不同的Set-cookie后会生成不同的cookie信息，而浏览器在发送访问请求时是根据域名信息和路径信息来选择合适的cookie信息的，因此为保证浏览器发送的访问请求可以携带目标cookie信息，需要对代理服务器生成的目标cookie设置信息，以及浏览器发送的访问请求进行设置。
一方面，针对目标cookie设置信息，代理服务器可以将目标cookie设置信息中的domain字段设置为空，并将目标cookie设置信息中的path字段设置为“/”，这样，当目标访问请求中URL携带的域名包含代理域名时，浏览器在生成针对内网应用的访问请求时便会自动携带目标cookie信息。
另一方面，由于鉴权服务器反馈的第一操作页面是基于内网应用的真实域名产生的，因此第一操作页面中包含的所有内网应用的域名都是真实域名，若要使浏览器发送的目标访问请求中URL携带的域名为代理域名，则代理服务器需要对第一操作页面进行重构，以得到一个新的操作页面(即第二操作页面)，其中，第二操作页面中包含的所有内网应用的域名为代理域名。
代理服务器根据本地映射表将第一操作页面重构为第二操作页面，可以通过如下方式实现：首先，获取第一操作页面中包含的各个内网应用的真实域名；然后，根据本地映射表，查找与真实域名相对应的代理路径，并将真实域名修改为虚拟域名，其中，虚拟域名为代理域名和代理路径的组合。
在一个实施例中，代理服务器可以解析第一操作页面，以获取第一操作页面中包含的各个内网应用的真实域名。在获取到第一操作页面中包含的各个真实域名后，代理服务器可以查询本地映射表，进而获取到与上述真实域名相对应的代理路径，然后代理服务器可以使用代理域名和代理路径的组合(即虚拟域名)替换上述真实域名，从而得到一个包含有代理域名的新的操作页面(即第二操作页面)，基于此，浏览器基于第二操作页面生成的访问请求可被代理服务器接收。
继续以上文的举例进行说明，a.baidu.com与path1对应，b.baidu.com与path2对应，c.sina.com与path3对应，代理域名wsvpn.cn，则代理服务器可以将www.a.baidu.com替换为www.wsvpn.cn/path1，将www.b.baidu.com替换为www.wsvpn.cn/path2，将www.c.sina.com替换为www.wsvpn.cn/path3，基于新得到虚拟域名，代理服务器可以对第一操作页面进行重构，从而得到包含有代理域名的第二操作页面。
需要特别指出的是，针对内网应用原有的真实路径，代理服务器在进行 页面重构时会对其保留。例如，假设某一个内网应用在第一操作页面中的URL为：www.a.baidu.com/index.html，那么代理服务器在进行页面重构时，将保留其真实路径(即index.html)，在第二操作页面中其URL将被替换为：www.wsvpn.cn/path1/index.html。
在一个实施例中，当代理服务器生成目标cookie设置信息和第二操作页面后，代理服务器可以将上述目标cookie设置信息和第二操作页面作为响应信息发送至浏览器，从而使得浏览器可以基于目标cookie设置信息生成目标cookie信息，以及基于第二操作页面发送访问请求，并可以在发送的访问请求中携带目标cookie信息。同时，由于第二操作页面中的所有内网应用的域名已替换为虚拟域名，因此，基于第二操作页面产生的访问请求会被dns解析到代理服务器下，从而被代理服务器所接收。
需要指出的是，代理服务器在对第一操作页面进行重构时，可能出现错误，从而导致浏览器在基于第二操作页面发送访问请求时，访问请求中携带的信息不完整。例如，代理服务器在对第一操作页面进行重构时，仅将www.a.baidu.com替换为www.wsvpn.cn，这就使得用户在访问www.a.baidu.com时，浏览器发送的访问请求中并缺少代理路径(即path1)；或者由于html编码规则的设定，使得代理服务器无法对第一操作页面内的URL改写完全，出现仅包含代理域名，但不包含代理路径的情形，进而导致用户通过浏览器发出的访问请求中的虚拟域名存在错误，如此，代理服务器就无法基于虚拟域名获取到对应的真实域名，从而出现访问异常的情况。
需要特别指出的是，在鉴权过程中，代理服务器并不会将用户关键信息发送至浏览器，而是将其保存在本地储存设备中，这样不论在在浏览器侧，还是在外网通信过程中，非法拦截者都无法获取到用户关键信息，从而保证了用户关键信息不会被泄露。
需要特别指出的是，代理服务器将各个内网应用的真实域名统一收敛到代理域名之下，这样浏览器将只需要管理代理服务器的SSL证书，这极大的减少了浏览器管理SSL证书的开销。
在一个实施例中，代理服务器还可以对第一cookie设置信息修改，例如将第一cookie设置信息中的domain字段设置为空，并将第一cookie设置信息中的path字段设置为“/”，然后将修改后的第一cookie设置信息发送至浏览器，这样，浏览器便可以基于修改后的第一cookie设置信息生成第一cookie信息。当浏览器发送访问请求时，便可以在上述访问请求中携带第一cookie信息，而当 用户再次访问鉴权服务器时(例如请求刷新页面)，可自动携带第一cookie信息。
S102：判断所述目标访问请求是否异常，若异常，则获取所述目标访问请求中的目标真实路径，并查询与所述目标真实路径相对应的目标全局路径映射表，以判断是否基于所述目标全局路径映射表重构所述目标访问请求中的URL。
在本实施例中，当代理服务器接收到上述目标访问请求后，代理服务器可以首先判断上述目标访问请求是否异常。具体的，代理服务器可以判断目标访问请求的URL信息中是否存在代理路径(即目标代理路径)，如果目标访问请求中存在目标代理路径，则代理服务器可以判断上述目标访问请求正常；如果目标访问请求中不存在目标代理路径，则代理服务器可以判断上述目标访问请求异常。
在一个实施例中，当代理服务器判断上述目标访问请求正常后，代理服务器便可以根据目标cookie信息查找到对应的目标授权内容，从而根据目标授权内容对目标访问请求进行鉴权管理。关于代理服务器如何根据目标授权内容对目标访问请求进行鉴权管理的内容，将在后文进行详细叙述。
需要特别指出的是，针对代理服务器接收到的任意一个访问请求，代理服务器都将首先判断该访问请求中是否存在代理路径，如果该访问请求中存在代理路径，代理服务器将获取该访问请求中的真实路径和代理路径，并建立上述真实路径和代理路径之间的路径映射关系。通过不断重复上述操作，代理服务器便可以获取各个访问请求中真实路径和代理路径之间的路径映射关系，然后代理服务器可以基于上述路径映射关系，建立以各个真实路径为标记的全局路径映射表，以及以各个用户标识为标记的用户路径映射表。
继续以上文的举例进行说明，假设代理服务器依次接收到四个访问请求，其对应的URL信息分别为访问请求1：https://www.wsvpn.cn/path1/index.html，访问请求2：https://www.wsvpn.cn/path1/info.html，访问请求3：www.wsvpn.cn/path2/index.html，访问请求4：www.wsvpn.cn/path2/index.html，其中，访问请求1、访问请求2、访问请求4为用户A发送，访问请求3为用户B发送，那么代理服务器通过解析上述访问请求，可以确定path1与index.html对应，path1与info.html对应，path2与index.html对应，代理服务器便可以在真实路径index.html下绑定path1和path2，在真实路径info.html下绑定path1，从而建立真实路径index.html的全局路径映射表，以及真实路径info.html的全局路径映射表，即真 实路径index.html的全局路径映射表中存在两个代理路径path1和path2，真实路径info.html的全局路径映射表中存在一个代理路径path1。
代理服务器还可以根据上述三个访问请求中携带的目标cookie信息，查找到对应的用户标识，从而确定访问请求1、访问请求2、访问请求4为用户A发送，访问请求3为用户B发送，如此，代理服务器便可以根据接收到的访问请求的先后顺序，建立用户A的用户路径映射表，以及用户B的用户路径映射表，即用户A的用户路径映射表中存在info.html和path1的映射关系，以及index.html和path2的映射关系，用户B的用户路径映射表中存在index.html和path2的映射关系。
需要特别指出的是，由于代理服务器每接收到一个访问请求，都将进行上述操作，因此全局路径映射表和用户路径映射表是动态变化的。在实际应用中，每当代理服务器接收到一个正常的访问请求，代理服务器都会将该访问请求中的代理路径添加至该访问请求中真实路径的全局路径映射表中，因此某一个真实路径的全局路径映射表中可能存在一个或者多个对应的代理路径。
由于用户在一个时间段内访问的内网应用基本都是当前域名的资源，因此其发送的访问请求中，真实路径跟最新的代理路径大概率可直接关联。为提升访问成功率，代理服务器可以基于最新接收到的正常访问请求，建立该访问请求中的真实路径和代理路径之间的映射关系，并更新相应的用户路径映射表，这样任意一个用户标识对应的用户路径映射表中，一个真实路径只存在一个最新的代理路径与其对应。应当指出的是，某一个用户标识对应的用户路径映射表中，可能存在多条真实路径和代理路径的映射关系，但在上述每一条映射关系中，真实路径都只存在一个对应的代理路径。
在一个实施例中，当代理服务器判断上述目标访问请求异常后，代理服务器可以解析上述目标访问请求，以获取目标访问请求中的URL信息携带的真实路径(即目标真实路径)，然后代理服务器可以查找本地保存的各个真实路径的全局路径映射表，进而获取到目标真实路径的全局路径映射表(即目标全局路径映射表)。当代理服务器查找到目标全局路径映射表后，代理服务器便可以判断是否基于上述目标全局路径映射表重构目标访问请求中的URL。
代理服务器判断是否基于目标全局路径映射表重构目标访问请求中的URL，可以通过如下方式实现：
首先，判断目标全局路径映射表中是否存在目标代理路径集合，如果目标全局路径映射表中存在目标代理路径集合，则判断目标代理路径集合中包含 的代理路径是否唯一，如果目标代理路径集合中包含的代理路径唯一，则基于目标全局路径映射表重构目标访问请求中的URL；如果目标代理路径集合中包含的代理路径不唯一，则不基于目标全局路径映射表重构目标访问请求中的URL。
在实际应用中，当代理服务器查找到目标全局路径映射表后，代理服务器可以解析上述目标全局路径映射表，从而判断上述目标全局路径映射表中是否存在对应的代理路径(即目标代理路径集合)，如果代理服务器确定目标全局路径映射表中存在目标代理路径集合，则代理服务器可以进一步判断目标代理路径集合中包含的代理路径是否唯一，如果目标代理路径集合中包含的代理路径是唯一的，则可将上述唯一的代理路径视为目标访问请求所缺失的信息，代理服务器便可以基于目标全局路径映射表重构目标访问请求中的URL，此时，代理服务器可以进入步骤S103。
需要特别指出的是，如果代理服务器判断上述目标全局路径映射表中不存在目标代理路径集合，代理服务器可以向目标用户反馈异常消息。
如果目标全局路径映射表中存在目标代理路径集合，但是目标代理路径集合中包含的代理路径不是唯一的，那么代理服务器将无法根据目标代理路径集合确定目标访问请求所缺失的信息，因此代理服务器无法基于目标全局路径映射表重构目标访问请求中的URL，此时，代理服务器可以进入步骤S104。
S103：若基于所述目标全局路径映射表重构所述目标访问请求中的URL，则获取所述目标全局路径映射表中与所述目标真实路径唯一对应的第一代理路径，并基于所述第一代理路径重构所述目标访问请求中的URL。
在本实施例中，当代理服务器判断目标代理路径集合中存在唯一的代理路径后，代理服务器可以基于目标全局路径映射表重构目标访问请求中的URL。具体的，代理服务器可以将上述唯一的代理路径(即第一代理路径)添加到目标访问请求的URL信息中，从而将目标访问请求修改为符合WebVPN系统要求的正常访问请求。
继续以上文的举例进行说明，假设某一用户发送的异常访问请求为：https://www.wsvpn.cn/info.html，代理服务器通过查询info.html的全局路径映射表，发现其中存在唯一的代理路径path1，那么代理服务器可以将path1添加到原URL信息中，将其修改为https://www.wsvpn.cn/path1/info.html，这样原来的异常访问请求便被重构为符合WebVPN系统要求的正常访问请求。
在一个实施例中，当代理服务器完成目标访问请求中的URL的重构后， 代理服务器可以将上述重构后的URL通过重定向至目标用户，例如，通过307跳转的方式，将重构后的URL发送给目标用户，从而使得目标用户浏览器可以自动基于重构后的URL生成新的目标访问请求，并将上述新目标访问请求发送至代理服务器。此时，上述重构后的URL中存在代理路径，因此代理服务器在接收到上述新的目标访问请求后，将判断其为正常访问请求，代理服务器便可以对其进行鉴权管理。
S104：若不基于所述目标全局路径映射表重构所述目标访问请求中的URL，则查询与所述目标cookie信息相对应的目标用户路径映射表，以判断是否基于所述目标用户路径映射表重构所述目标访问请求中的URL。
在本实施例中，当代理服务器判断无法基于目标全局路径映射表重构目标访问请求中的URL后，代理服务器可以通过目标cookie信息查找对应的目标用户标识，然后根据查找到的目标用户标识，查询目标用户标识对应的目标用户路径映射表，进而判断是否基于目标用户路径映射表重构目标访问请求中的URL。具体的，代理服务器可以判断目标用户路径映射表中，是否存在与目标真实路径值相对应的代理路径(即第二代理路径)，如果目标用户路径映射表中存在第二代理路径，代理服务器可以将上述第二代理路径添加到目标访问请求的URL信息中，从而将目标访问请求修改为符合WebVPN系统要求的正常访问请求；如果目标用户路径映射表中不存在第二代理路径，代理服务器将无法为目标访问请求确定合适的代理路径，代理服务器可以向目标用户反馈异常消息。
继续以上文的举例进行说明，假设用户A发送的异常访问请求为：https://www.wsvpn.cn/index.html，代理服务器通过查询index.html的全局路径映射表，发现其中存在两个代理路径path1和path2，因此，代理服务器进一步查询用户A的用户路径映射表，获取到index.html和path2相对应，那么代理服务器可以将path2添加到原URL信息中，将其修改为https://www.wsvpn.cn/path2/index.html，这样原来的异常访问请求中的URL便被重构为符合WebVPN系统要求的正常形式。
在一个实施例中，当代理服务器完成目标访问请求中的URL的重构后，代理服务器可以将上述重构后URL通过重定向至目标用户，例如，通过307跳转的方式，将重构后的URL发送给目标用户，从而使得目标用户浏览器可以自动基于重构后的URL生成新的目标访问请求，并将上述新目标访问请求发送至代理服务器。此时，上述重构后的URL中存在代理路径，因此代理服务器在接 收到上述新的目标访问请求后，将判断其为正常访问请求，代理服务器便可以对其进行鉴权管理。
由此可见，本申请提供的技术方案，针对用户发送的未携带代理路径的异常访问请求，代理服务器首先根据上述访问请求中的真实路径，查询全局路径映射表，以判断其中是否存在与上述真实路径唯一对应的代理路径，如果全局路径映射表中存在唯一对应的代理路径，则基于该代理路径，将上述异常访问请求补充完整；如果全局路径映射表中不存在唯一对应的代理路径，则进一步查询该用户对应的用户路径映射表，进而获取上述用户路径映射表中保存的，与上述真实路径相对应的代理路径，并基于该代理路径，将上述异常访问请求中的URL补充完整。通过上述方法，代理服务器可以实现将用户发送的异常访问请求转换为正常访问请求，从而使得WebVPN系统可以基于正常访问请求，进行后继的鉴权管理及转发操作，提高了用户访问内网服务的成功率。
在一个实施例中，代理服务器可以对接收到的目标访问请求进行鉴权管理。具体的，代理服务器可以解析目标访问请求的HTTP请求头部信息，以获取目标cookie信息，值得注意的是，如上文所述，代理服务器可根据目标访问请求中携带的cookie信息的name值来确定携带的cookie信息是否为目标cookie信息，若不是，则可直接确定本次访问为无权访问，代理服务器可以向浏览器返回登录页面，以通知目标用户重新进行登录；若是，则表示发送目标访问请求的目标用户可能已通过授权认证，并具有访问内网资源的权限。
在获取到目标cookie信息后，代理服务器可以查询授权映射表，进而判断授权映射表中是否存在与目标cookie信息相对应的目标授权内容，如果授权映射表中存在与目标cookie信息相对应的目标授权内容，则说明目标用户已经通过鉴权服务器的认证，上述目标用户具有访问内网资源的权限，需要指出的是，由于此时代理服务器仅需判断目标用户是否具有访问内网资源的权限，并不判断目标用户是否可以访问上述目标访问请求指向的目标源站，因此代理服务器此时无需对查询到的目标授权内容进行解析。
如果代理服务器无法查询到与目标cookie信息相对应的目标授权内容，则说明目标用户没有通过鉴权服务器的认证，目标cookie信息可能是伪造的，目标用户不具有访问内网资源的权限，代理服务器将拒绝访问目标访问请求指向的目标源站，代理服务器可以向浏览器返回登录页面，以通知目标用户重新进行登录。
在一个实施例中，当代理服务器判断目标用户具有访问内网资源的权限 后，代理服务器可以进一步判断目标用户是否可以访问上述目标访问请求指向的目标源站。具体的，代理服务器可以解析目标访问请求，从而获取到目标访问请求中的URL信息，然后代理服务器可以对上述URL信息进行解析，从而得到域名信息(即虚拟域名)，当代理服务器获取到虚拟域名后，代理服务器便可以判断上述虚拟域名是否存在于目标授权内容中。
在一个实施例中，代理服务器判断虚拟域名是否存在于目标授权内容中，可以通过如下方式实现：首先，根据本地映射表，查找目标访问请求携带的虚拟域名对应的真实域名；然后，判断上述真实域名是否存在于目标授权内容中。
由于目标访问请求是基于第二操作页面发送的，而第二操作页面中包含的是代理域名和路径值的组合(即虚拟域名)，因此目标访问请求中的目标URL，其携带的域名为虚拟域名。在实际应用中，代理服务器可以对目标URL进行解析，以获取上述目标URL中携带的虚拟域名，然后根据本地映射表，查找与上述虚拟域名相对应的真实域名。在查找到上述对应的真实域名后，代理服务器便可以查询保存在本地储存设备中的目标授权内容，以判断上述真实域名是否存在于目标授权内容中。
继续以上文的举例进行说明，假设目标URL为https://www.wsvpn.cn/path1/info/9396/58chbdg3.htm，那么代理服务器可以根据本地映射表，查询到www.wsvpn.cn/path1对应于www.a.baidu.com，然后代理服务器可以查询保存在本地的授权内容，将www.a.baidu.com与授权内容中的域名信息进行比对，进而判断www.a.baidu.com是否存在于上述授权内容中，如果存在，则说明目标用户可以访问https://www.wsvpn.cn/path1/info/9396/58chbdg3.htm；如果不存在，则说明目标用户不可以访问https://www.wsvpn.cn/path1/info/9396/58chbdg3.htm。
在一个实施例中，授权内容可进一步具体到URL，相应的，代理服务器可先通过上述方式查找到虚拟域名对应的真实域名，并将目标访问请求中的URL的虚拟域名修改为真实域名，进而基于修改后的URL查询授权内容，以确定目标用户是否有访问权限。
如果上述虚拟域名存在于目标授权内容中，则说明目标用户可以访问上述目标访问请求指向的页面，代理服务器便可以基于上述目标访问请求，向目标访问请求指向的目标源站发起访问请求；如果上述虚拟域名不存在于目标授权内容中，则说明目标用户不可以访问上述目标访问请求指向的页面，代理服务器可以向浏览器返回403状态码，以通知目标用户无权访问目标源站。
需要特别指出的是，代理服务器利用目标cookie信息进行认证鉴权，还 可以解决不同的用户使用同一个账号和密码同时登录内部网络的问题。
在一个实施例中，假设如果两个不同的用户(为便于叙述，本申请将其称为A用户和B用户)都获取到一个登录内部网络的账号和密码，如果A用户首先登录了内部网络，那么鉴权服务器将向A用户反馈一个第一cookie设置信息(记为Set-cookie1)和授权内容，然后代理服务器基于Set-cookie1和/或随机数生成目标cookie设置信息(记为Set-cookie2)，同时代理服务器将在本地保存目标cookie信息(记为cookie2，基于Set-cookie2生成)与授权内容的映射关系。在之后的某一个时刻，B用户使用相同的账号和密码登录了内部网络，那么鉴权服务器将向A用户反馈另一个第一cookie设置信息(记为Set-cookie3)和授权内容，然后代理服务器基于Set-cookie3和/或随机数生成另一个目标cookie设置信息(记为Set-cookie4)，同时代理服务器将在本地保存新的目标cookie信息(记为cookie4，基于Set-cookie4生成)与授权内容的映射关系。
由于Set-cookie1中的value值与Set-cookie3中的value值并不相同，两次的随机数也是不同的，因此Set-cookie2与Set-cookie4也不相同，相应的，cookie2与cookie4也不相同，然而对于同一个账号，鉴权服务器反馈的用户关键信息，如用户ID是相同的，因此代理服务器在针对用户保存cookie信息时，cookie4将覆盖cookie2，即代理服务器本地保存的始终是最新的目标cookie信息与授权内容的映射关系。当A用户再次访问内部网络时，A用户发送的访问请求将携带cookie2，由于代理服务器此时本地保存的是cookie4与授权内容的映射关系，因此，代理服务器将无法通过cookie2查询到相应的授权内容(即无法在授权映射表中查询到与目标cookie信息相对应的目标授权内容)，代理服务器将拒绝访问目标访问请求指向的目标源站，此时代理服务器可以向A用户返回登录页面，这样A用户将无法再次访问内部网络。
如果A用户再次使用上述账号和密码登录内部网络，基于同样的原理，B用户将无法再次访问该内部网络。这样，代理服务器利用目标cookie信息进行认证鉴权，便可以使不同的用户无法使用同一个账号和密码同时访问内部网络。
在实际应用中，由于目标访问请求中的目标URL携带的域名为虚拟域名，因此代理服务器无法直接通过目标URL访问目标访问请求指向的目标源站。
在一个实施例中，代理服务器在访问上述目标源站之前可以将目标访问请求中携带的虚拟域名修改为对应的真实域名，具体的，代理服务器可以根据本地映射表，查询到与目标URL携带的虚拟域名相对应的真实域名，然后用上 述真实域名替换目标URL中的虚拟域名，从而得到一个包含有上述真实域名的新的URL，最后将目标访问请求中携带的目标URL修改为上述新的URL，这样代理服务器便可以基于上述新的URL向目标源站发送请求，以访问目标源站。
在一个实施例中，当代理服务器访问目标源站后，目标源站可以向请求发送方(即代理服务器)反馈用户响应信息，上述用户响应信息中可包括第三cookie设置信息，在实际应用中，上述第三cookie设置信息中的domain字段保存的信息通常为目标应用的泛域名。
当代理服务器接收到上述用户响应信息后，代理服务器可以对第三cookie设置信息进行解析，以获取其中的domain信息，并且代理服务器可以根据上述第三cookie设置信息的内容生成第三cookie信息，以建立domain信息与第三cookie信息的映射关系，这样，代理服务器通过泛域名便可以查询到对应的第三cookie信息。
在一个实施例中，当用户选择了同一泛域名下的其它应用时，浏览器可以基于用户的选择生成对应的访问请求(即第二目标访问请求)，第二目标访问请求中将携带目标cookie信息。当代理服务器接收到上述第二目标访问请求后，先基于目标cookie信息对其进行授权认证，并在认证通过后，根据第二目标访问请求中包含的虚拟域名所对应的真实域名，从domain信息与第三cookie信息的映射关系中，查找对应的第三cookie信息。当代理服务器查找到对应的第三cookie信息后，可以将上述第三cookie信息添加到第二目标访问请求中，同时，代理服务器将利用真实域名替换虚拟域名，以对第二目标访问请求进行重构，然后向第二目标访问请求指向的内网应用发送重构后的第二目标访问请求，以请求相应的资源。
当目标源站接收到上述重构后的第二目标访问请求后，可以对第三cookie信息中保存的信息进行解析。基于解析的结果，目标源站可以判断上述第二目标访问请求是否合法，若合法，目标源站便可以向代理服务器发送响应资源；若不合法，目标源站可以向代理服务器发送403状态码。
继续以上文的举例进行说明，假设目标源站提供的应用服务1对应的真实域名为a.baidu.com，应用服务2对应的真实域名为b.baidu.com，上述两个真实域名都位于泛域名.baidu.com之下。当用户通过代理服务器访问应用服务1后，代理服务器将接收到应用服务1返回的第三cookie设置信息，然后代理服务器将建立.baidu.com与第三cookie信息的映射关系，从而使得代理服务器通过.baidu.com查找到第三cookie信息。
当目标用户需要访问应用服务2时，由于目标cookie信息中的domain字段为空，path字段为“/”，因此浏览器生成的访问请求(即第二目标访问请求)将携带目标cookie信息，代理服务器可基于目标cookie信息对第二访问请求的进行授权验证。
本实施例中，代理服务器根据第二目标访问请求中携带的虚拟域名(即wsvpn.cn/path2)，查找本地映射表，获取对应的真实域名b.baidu.com，进而获取到对应的泛域名.baidu.com，然后根据domain信息与第三cookie信息的映射关系，查找到对应的第三cookie信息，之后代理服务器可以将上述第三cookie信息放入第二目标访问请求中。同时，代理服务器可将其中的虚拟域名修改为对应的真实域名，以实现对第二目标访问请求进行重构，并向应用服务2的源站发送重构后的第二目标访问请求，使得应用服务2可直接基于第三cookie信息进行用户行为关联。
在一个实施例中，代理服务器还可以根据所述本地映射表重构所述第三cookie设置信息。具体的，代理服务器可以根据第三cookie设置信息中domain字段的真实域名，查询与该真实域名相对应的虚拟域名，然后将上述虚拟域名添加到第三cookie设置信息的path字段中，同时，代理服务器将第三cookie设置信息中的domain字段设置为空。
代理服务器在完成第三cookie设置信息的重构后，可以将重构后的第三cookie设置信息发送至浏览器。这样，当目标用户需要再次访问该内网应用时，浏览器便可以在此次发送的访问请求中携带第三cookie信息(基于重构后的第三cookie设置信息生成)，从而保证cookie机制的正常运行，避免浏览器在发送请求时，没有正确携带对应的cookie信息，导致无法访问。
继续以上文的举例进行说明，当代理服务器访问应用服务1后，代理服务器将接收到应用服务1返回的第三cookie设置信息，此时代理服务器可以对第三cookie设置信息进行重构，将第三cookie设置信息的domain字段设置为空，并在第三cookie设置信息的path字段中添加wsvpn.cn/path1，然后将重构后的第三cookie设置信息发送至浏览器。这样，当目标用户需要访问应用服务1提供的资源时，浏览器发送的访问请求将携带第三cookie信息，这就保证了cookie机制的正常运行，浏览器便可以对应用服务1进行正常访问。
在一个实施例中，目标源站反馈的用户响应信息中还包括用户响应页面，该用户响应页面中包含的域名为各个内网应用对应的真实域名，而浏览器发送的访问请求中携带的是虚拟域名，因此代理服务器需要对上述用户响应页面进 行重构。具体的，代理服务器可以首先获取用户响应页面中包含的各个真实域名，然后根据本地映射表，查找与各个真实域名相对应的虚拟域名，之后将上述真实域名修改为对应的虚拟域名，从而完成用户响应页面的重构。在完成用户响应页面的重构后，代理服务器便可以将重构后的用户响应页面发送至浏览器，从而使得浏览器可以对用户响应页面进行渲染。
由此可见，本申请提供的技术方案，通过将目标cookie信息与授权内容进行绑定，从而建立用户关键信息与目标cookie信息之间的唯一映射关系，然后通过目标cookie信息对用户的认证鉴权环节进行管理，使得认证鉴权环节和应用访问环节都集中在代理服务器侧，这样用户关键信息便不需要保存在浏览器侧，避免了用户关键信息的泄露。同时通过对目标cookie信息的更新，可以使不同的用户无法使用同一个账号和密码同时访问内部网络，进一步提高了系统的安全性。针对某些网站利用cookie机制进行内部权限管理的情况，本申请基于网站反馈的第三cookie设置信息，建立第三cookie信息与泛域名之间的映射关系，以简化用户的访问，同时还可以对第三cookie设置信息进行重构，以保证cookie机制的正常运行，避免浏览器在渲染网页时出现错误。
请参阅图4，本申请还提供一种异常请求处理装置，所述装置应用于代理服务器，并储存有全局路径映射表和用户路径映射表，所述装置包括：
信息接收模块，用于接收目标用户发送的目标访问请求，其中，所述目标访问请求携带有目标cookie信息；
信息判断模块，用于判断所述目标访问请求是否异常，若异常，则获取所述目标访问请求中的目标真实路径，并查询与所述目标真实路径相对应的目标全局路径映射表，以判断是否基于所述目标全局路径映射表重构所述目标访问请求中的URL，以及在不基于所述目标全局路径映射表重构所述目标访问请求中的URL时，查询与所述目标cookie信息相对应的目标用户路径映射表，以判断是否基于所述目标用户路径映射表重构所述目标访问请求中的URL；
信息重构模块，用于获取所述目标全局路径映射表中与所述目标真实路径唯一对应的第一代理路径，并基于所述第一代理路径重构所述目标访问请求中的URL，以及获取所述目标用户路径映射表中与所述目标真实路径值相对应的第二代理路径，并基于所述第二代理路径重构所述目标访问请求中的URL。
在一个实施例中，判断所述目标访问请求是否异常包括：
判断所述目标访问请求中是否存在目标代理路径，若所述目标访问请求中存在所述目标代理路径，则所述目标访问请求正常；
若所述目标访问请求中不存在所述目标代理路径，则所述目标访问请求异常。
在一个实施例中，判断是否基于所述目标全局路径映射表重构所述目标访问请求中的URL包括：
判断所述目标全局路径映射表中是否存在与所述目标真实路径相对应的目标代理路径集合；
若存在，则判断所述目标代理路径集合中包含的代理路径是否唯一，若唯一，则基于所述目标全局路径映射表重构所述目标访问请求中的URL；
若不唯一，则不基于所述目标全局路径映射表重构所述目标访问请求中的URL。
在一个实施例中，判断是否基于所述目标用户路径映射表重构所述目标访问请求中的URL包括：
判断所述目标用户路径映射表中是否存在与所述目标真实路径值相对应的第二代理路径；
若存在所述第二代理路径，则基于所述第二代理路径重构所述目标访问请求中的URL；
若不存在所述第二代理路径，则向所述目标用户反馈异常消息。
在一个实施例中，所述装置还包括：
映射表生成模块，用于基于路径映射关系，建立以所述真实路径为标记的所述全局路径映射表，以及以用户标识为标记的所述用户路径映射表；
所述信息判断模块，还用于判断接收到的各个访问请求中是否存在代理路径，若存在，则获取所述各个访问请求中真实路径和所述代理路径的所述路径映射关系。
在一个实施例中，所述装置还包括：
重定向模块，用于将重构后的所述URL重定向至所述目标用户，以使得所述目标用户生成包含所述重构后的URL的新目标访问请求，并将所述新目标访问请求发送至所述代理服务器；
鉴权判断模块，用于对重构后的所述目标访问请求进行鉴权。
请参阅图5，本申请还提供一种异常请求处理装置，所述装置包括存储器和处理器，所述存储器用于存储计算机程序，当所述计算机程序被所述处理器执行时，可以实现如上述的异常请求处理方法。具体地，在硬件层面，该装置可以包括处理器、内部总线和存储器。所述存储器可以包括内存以及非易失性 存储器。处理器从非易失性存储器中读取对应的计算机程序到内存中然后运行。本领域普通技术人员可以理解，图5所示的结构仅为示意，其并不对上述装置的结构造成限定。例如，所述装置还可包括比图5中所示更多或者更少的组件，例如还可以包括其他的处理硬件，如GPU(Graphics Processing Unit，图像处理器)，或者对外通信端口等。当然，除了软件实现方式之外，本申请并不排除其他实现方式，比如逻辑器件抑或软硬件结合的方式等等。
本实施例中，所述的处理器可以包括中央处理器(CPU)或图形处理器(GPU)，当然也可以包括其他的具有逻辑处理能力的单片机、逻辑门电路、集成电路等，或其适当组合。本实施例所述的存储器可以是用于保存信息的记忆设备。在数字系统中，能保存二进制数据的设备可以是存储器；在集成电路中，一个没有实物形式的具有存储功能的电路也可以为存储器，如RAM、FIFO等；在系统中，具有实物形式的存储设备也可以叫存储器等。实现的时候，该存储器也可以采用云存储器的方式实现，具体实现方式，本说明书不做限定。
需要说明的是，本说明书中的异常请求处理装置，具体的实现方式可以参照方法实施例的描述，在此不作一一赘述。
通过以上的实施例的描述，本领域的技术人员可以清楚地了解到各实施例可借助软件加必需的通用硬件平台的方式来实现，当然也可以通过硬件来实现。基于这样的理解，上述技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品可以存储在计算机可读存储介质中，如ROM/RAM、磁碟、光盘等，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行各个实施例或者实施例的某些部分所述的方法。
以上所述仅为本申请的部分实施例，并不用以限制本申请，凡在本申请的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本申请的保护范围之内。

Claims (15)

  1. 一种异常请求处理方法，应用于代理服务器，所述代理服务器中储存有全局路径映射表和用户路径映射表，所述方法包括：
    接收目标用户发送的目标访问请求，其中，所述目标访问请求携带有目标cookie信息；
    判断所述目标访问请求是否异常，若异常，则获取所述目标访问请求中的目标真实路径，并查询与所述目标真实路径相对应的目标全局路径映射表，以判断是否基于所述目标全局路径映射表重构所述目标访问请求中的URL；
    若不基于所述目标全局路径映射表重构所述目标访问请求中的URL，则查询与所述目标cookie信息相对应的目标用户路径映射表，以判断是否基于所述目标用户路径映射表重构所述目标访问请求中的URL。
  2. 根据权利要求1所述的方法，其中，判断所述目标访问请求是否异常包括：
    判断所述目标访问请求中是否存在目标代理路径，若所述目标访问请求中存在所述目标代理路径，则所述目标访问请求正常；
    若所述目标访问请求中不存在所述目标代理路径，则所述目标访问请求异常。
  3. 根据权利要求1所述的方法，其中，判断是否基于所述目标全局路径映射表重构所述目标访问请求中的URL包括：
    判断所述目标全局路径映射表中是否存在与所述目标真实路径相对应的目标代理路径集合；
    若存在，则判断所述目标代理路径集合中包含的代理路径是否唯一，若唯一，则基于所述目标全局路径映射表重构所述目标访问请求中的URL；
    若不唯一，则不基于所述目标全局路径映射表重构所述目标访问请求中的URL。
  4. 根据权利要求3所述的方法，其中，基于所述目标全局路径映射表重构所述目标访问请求中的URL包括：
    获取所述目标全局路径映射表中与所述目标真实路径唯一对应的第一代理路径；
    基于所述第一代理路径重构所述目标访问请求中的URL。
  5. 根据权利要求1所述的方法，其中，判断是否基于所述目标用户路径映射表重构所述目标访问请求中的URL包括：
    判断所述目标用户路径映射表中是否存在与所述目标真实路径值相对应的第二代理路径；
    若存在所述第二代理路径，则基于所述第二代理路径重构所述目标访问请求中的URL；
    若不存在所述第二代理路径，则向所述目标用户反馈异常消息。
  6. 根据权利要求1所述的方法，其中，所述方法还包括：
    判断接收到的各个访问请求中是否存在代理路径，若存在，则获取所述各个访问请求中真实路径和所述代理路径的路径映射关系；
    基于所述路径映射关系，建立以所述真实路径为标记的所述全局路径映射表，以及以用户标识为标记的所述用户路径映射表。
  7. 根据权利要求4或5所述的方法，其中，在重构所述目标访问请求中的URL后，所述方法还包括：
    将重构后的所述URL重定向至所述目标用户，以使得所述目标用户生成包含所述重构后的URL的新目标访问请求，并将所述新目标访问请求发送至所述代理服务器。
  8. 根据权利要求1所述的方法，其中，所述方法包括：
    若所述目标访问请求正常，则对所述目标访问请求进行鉴权。
  9. 一种异常请求处理装置，应用于代理服务器，并储存有全局路径映射表和用户路径映射表，所述装置包括：
    信息接收模块，用于接收目标用户发送的目标访问请求，其中，所述目标访问请求携带有目标cookie信息；
    信息判断模块，用于判断所述目标访问请求是否异常，若异常，则获取所述目标访问请求中的目标真实路径，并查询与所述目标真实路径相对应的目标 全局路径映射表，以判断是否基于所述目标全局路径映射表重构所述目标访问请求中的URL，以及在不基于所述目标全局路径映射表重构所述目标访问请求中的URL时，查询与所述目标cookie信息相对应的目标用户路径映射表，以判断是否基于所述目标用户路径映射表重构所述目标访问请求中的URL；
    信息重构模块，用于获取所述目标全局路径映射表中与所述目标真实路径唯一对应的第一代理路径，并基于所述第一代理路径重构所述目标访问请求中的URL，以及获取所述目标用户路径映射表中与所述目标真实路径值相对应的第二代理路径，并基于所述第二代理路径重构所述目标访问请求中的URL。
  10. 根据权利要求9所述的装置，其中，判断所述目标访问请求是否异常包括：
    判断所述目标访问请求中是否存在目标代理路径，若所述目标访问请求中存在所述目标代理路径，则所述目标访问请求正常；
    若所述目标访问请求中不存在所述目标代理路径，则所述目标访问请求异常。
  11. 根据权利要求9所述的装置，其中，判断是否基于所述目标全局路径映射表重构所述目标访问请求中的URL包括：
    判断所述目标全局路径映射表中是否存在与所述目标真实路径相对应的目标代理路径集合；
    若存在，则判断所述目标代理路径集合中包含的代理路径是否唯一，若唯一，则基于所述目标全局路径映射表重构所述目标访问请求中的URL；
    若不唯一，则不基于所述目标全局路径映射表重构所述目标访问请求中的URL。
  12. 根据权利要求9所述的装置，其中，判断是否基于所述目标用户路径映射表重构所述目标访问请求中的URL包括：
    判断所述目标用户路径映射表中是否存在与所述目标真实路径值相对应的第二代理路径；
    若存在所述第二代理路径，则基于所述第二代理路径重构所述目标访问请求中的URL；
    若不存在所述第二代理路径，则向所述目标用户反馈异常消息。
  13. 根据权利要求9所述的装置，其中，所述装置还包括：
    映射表生成模块，用于基于路径映射关系，建立以所述真实路径为标记的所述全局路径映射表，以及以用户标识为标记的所述用户路径映射表；
    所述信息判断模块，还用于判断接收到的各个访问请求中是否存在代理路径，若存在，则获取所述各个访问请求中真实路径和所述代理路径的所述路径映射关系。
  14. 根据权利要求9所述的装置，其中，所述装置还包括：
    重定向模块，用于将重构后的所述URL重定向至所述目标用户，以使得所述目标用户生成包含所述重构后的URL的新目标访问请求，并将所述新目标访问请求发送至所述代理服务器。
  15. 一种异常请求处理装置，包括存储器和处理器，所述存储器用于存储计算机程序，当所述计算机程序被所述处理器执行时，实现如权利要求1至8中任一权利要求所述的方法。
PCT/CN2020/122549 2020-09-16 2020-10-21 一种异常请求处理方法和装置 WO2022057002A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010973627.0 2020-09-16
CN202010973627.0A CN112260988B (zh) 2020-09-16 2020-09-16 一种异常请求处理方法和装置

Publications (1)

Publication Number Publication Date
WO2022057002A1 true WO2022057002A1 (zh) 2022-03-24

Family

ID=74232529

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/122549 WO2022057002A1 (zh) 2020-09-16 2020-10-21 一种异常请求处理方法和装置

Country Status (2)

Country Link
CN (1) CN112260988B (zh)
WO (1) WO2022057002A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114900546A (zh) * 2022-07-08 2022-08-12 支付宝(杭州)信息技术有限公司 一种数据处理方法、装置、设备及可读存储介质

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112351009B (zh) * 2020-10-27 2022-07-22 杭州安恒信息技术股份有限公司 一种网络安全防护方法、装置、电子设备及可读存储介质
CN113392346B (zh) * 2021-06-16 2023-09-12 北京豆萌信息技术有限公司 资源文件的路径处理方法、装置、电子设备及存储介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108965203A (zh) * 2017-05-18 2018-12-07 腾讯科技（深圳）有限公司 一种资源访问方法及服务器
CN109040316A (zh) * 2018-09-19 2018-12-18 天津字节跳动科技有限公司 Http服务处理方法和装置
WO2019062420A1 (zh) * 2017-09-28 2019-04-04 华为技术有限公司 监控进程的方法和装置
US20200236187A1 (en) * 2019-01-17 2020-07-23 Servicenow, Inc. Discovery and service mapping of application programming interface proxies

Family Cites Families (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP4179535B2 (ja) * 2002-09-03 2008-11-12 インターナショナル・ビジネス・マシーンズ・コーポレーション ネットワークシステム、リバースプロキシ、コンピュータ装置、データ処理方法及びプログラム
CN101132420B (zh) * 2007-10-16 2012-03-14 杭州华三通信技术有限公司 一种基于ssl vpn的链接改写方法和设备
CN101136834B (zh) * 2007-10-19 2010-06-02 杭州华三通信技术有限公司 一种基于ssl vpn的链接改写方法和设备
US8438642B2 (en) * 2009-06-05 2013-05-07 At&T Intellectual Property I, L.P. Method of detecting potential phishing by analyzing universal resource locators
CN101977224B (zh) * 2010-10-28 2013-10-09 神州数码网络(北京)有限公司 一种基于SSL VPN设备的Web资源认证信息管理方法
CN103823883B (zh) * 2014-03-06 2015-06-10 焦点科技股份有限公司 一种网站用户访问路径的分析方法及系统
CN110417932B (zh) * 2019-07-30 2020-08-04 睿哲科技股份有限公司 基于IPv6外链资源升级装置、电子设备及计算机可读介质

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108965203A (zh) * 2017-05-18 2018-12-07 腾讯科技（深圳）有限公司 一种资源访问方法及服务器
WO2019062420A1 (zh) * 2017-09-28 2019-04-04 华为技术有限公司 监控进程的方法和装置
CN109040316A (zh) * 2018-09-19 2018-12-18 天津字节跳动科技有限公司 Http服务处理方法和装置
US20200236187A1 (en) * 2019-01-17 2020-07-23 Servicenow, Inc. Discovery and service mapping of application programming interface proxies

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114900546A (zh) * 2022-07-08 2022-08-12 支付宝(杭州)信息技术有限公司 一种数据处理方法、装置、设备及可读存储介质
CN114900546B (zh) * 2022-07-08 2022-09-16 支付宝(杭州)信息技术有限公司 一种数据处理方法、装置、设备及可读存储介质

Also Published As

Publication number Publication date
CN112260988B (zh) 2021-09-24
CN112260988A (zh) 2021-01-22

Similar Documents

Publication Publication Date Title
WO2022056996A1 (zh) 一种安全访问内网应用的方法和装置
US10212173B2 (en) Deterministic reproduction of client/server computer state or output sent to one or more client computers
WO2022057000A1 (zh) 一种数据代理方法、系统及代理服务器
US8850219B2 (en) Secure communications
WO2022057002A1 (zh) 一种异常请求处理方法和装置
US8448233B2 (en) Dealing with web attacks using cryptographically signed HTTP cookies
CA2775206C (en) System and method of handling requests in a multi-homed reverse proxy
US10554417B2 (en) Script verification using a hash
US20100100950A1 (en) Context-based adaptive authentication for data and services access in a network
US10333716B2 (en) Script verification using a digital signature
US20060288220A1 (en) In-line website securing system with HTML processor and link verification
CN112149105A (zh) 数据处理系统、方法、相关设备及存储介质
US10257171B2 (en) Server public key pinning by URL
US20080140841A1 (en) Method and apparatus for detecting the IP address of a computer, and location information associated therewith
WO2004107132A2 (en) Method, system and software for state signing of internet resources
CN103905395A (zh) 一种基于重定向的web访问控制方法及系统
US11616853B2 (en) Dynamic domain discovery and proxy configuration
US20200210584A1 (en) Deterministic Reproduction of Client/Server Computer State or Output Sent to One or More Client Computers
CN110730189B (zh) 一种通信认证方法、装置、设备及存储介质
CN113194099B (zh) 一种数据代理方法及代理服务器
CN112260991B (zh) 一种鉴权管理方法和装置
US20240080195A1 (en) Managing composite tokens for content access requests
CN115130116A (zh) 业务资源访问方法、装置、设备、可读存储介质及系统

Legal Events

Date Code Title Description
NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20953859

Country of ref document: EP

Kind code of ref document: A1