Authentication and authorization method and system applied to client platform

Abstract

The invention discloses an authentication and authorization method and an authentication and authorization system applied to a client platform. The method and the system are modified on the basis of a protocol in a way that the client platform provides a Javascript (JS) interface for an access application party for user login, authorization and authentication. The method comprises the following steps of: starting at least one application program of the client platform; calling the JS interface of the client platform to acquire the basic information at least comprising the username of a current login user by using the application program; if information indicating that the user does not log in is returned and the user is required by the application program to log in, calling a login JS interface by using the application program; calling back and returning the basic information of the signature of the user to the application program through the JS interface; and if the application program determines that only the information of the username and the signature are required, allowing the user to access the application program. Therefore, a plurality of users can share a plurality of pieces of application, the authorization page counterfeiting of the application is avoided, user experiences are improved, the advanced background entry of a calling-back address is avoided, and the basic information can be acquired without the official authorization of the user after the addition of the application.

Description

technical field [0001] The invention relates to the technical field of security in Internet interaction, in particular to a method and system for security authentication and authorization of an Internet platform service interface (client platform), and belongs to the technical field of Internet security. Background technique [0002] In the Internet age, some platforms will encapsulate their own services as interfaces for use by third-party developers. We generally call these platforms open platforms. By calling the interface provided by the open platform, third-party developers can easily import user information and provide services such as recharge, which improves development efficiency and saves a lot of development and operation costs for third-party developers. [0003] For an open platform, since user information must be provided to third-party developers, this involves user authentication and authorization. As a result, the OAuth authentication and authorization pro...

AI Technical Summary

Problems solved by technology

[0044] The technical problem to be solved by the present invention is to provide a technical solution that can overcome the defects of potential safety hazards and low efficiency in authentication and authorization of the client platform (when interacting with network access) existing in the prior art. On top of that, users can only log in once when using different applications; use client-side login and authorization pages to avoid fake authorization pages; cancel the page jump step to improve user experience and avoid users needing to enter callbacks in the background in advance Address this complex step (to improve efficiency); and, further, allow the user to directly obtain some of the most basic information of the user without formal authorization from the user after adding the application

Images