Single sign on method and system based on Cookie and application server thereof

Abstract

The invention discloses a single sign on method and system based on Cookie and an application server thereof. The technical problems of replay attack and frequent access of the database are solved through the following operations: receiving request a message transmitted by a client browser by an application server; B, checking whether Cookie of a user exists in the client browser; if so, directly returning a failure result and entering a step C, otherwise entering the step F; C, redirecting the client browser to a login server for performing login operation; D, generating effective Cookie through the login server after the user login is successful; E, transmitting the generated effective Cookie to the client browser, redirecting to the application server, and turning to the step B; and F, verifying the Cookie of the user, comprising judging whether the authentication information value of the Cookie of the user is matched with Session value of the server, whether the ID value of the Cookie is unique, whether the timestamp of the Cookie is repeated and overtime, and providing the requested resources to the user under the verification condition.

Description

technical field [0001] The present invention relates to network communication technology, and more specifically, to a cookie-based single sign-on method, system and application server thereof. Background technique [0002] Single sign-on system SSO (Single Sign-On) is also known as a unified identity authentication system, which means that users only need to perform identity authentication once when using the system, and then they can access all network resources within the scope allowed by the system according to user permissions. There is no need to log in to different subsystems multiple times or to repeat the process of user identity authentication when using all network resources in different computer environments. [0003] The current single sign-on implementation scheme is mainly divided into three types: one is based on the network token mechanism of the Oauth protocol (a secure, open and simple standard for the authorization of user resources); the other is based on...

AI Technical Summary

Problems solved by technology

Although encryption can effectively prevent session hijacking, it cannot prevent replay attacks

[0006] (2) Frequent access to the database

If a hacker makes frequent requests to the server by forging the authentication information of the cookie, when verifying the effectiveness and authenticity of the authentication information of the client cookie, the database access performance consumption will be proportional to the amount of requests

[0007] (3) Cookie tampering

Cookie access is only valid for hosts under the same domain, and distributed application systems often cannot guarantee that all hosts are under the same domain

Images