Cross-station request processing method and device and electronic equipment

Abstract

The embodiment of the invention provides a cross-site request processing method and device and electronic equipment, and the method comprises the steps: obtaining a cross-site request initiated from abusiness processing page in a browser, and enabling the cross-site request to be used for obtaining business data from a target address which is different from the address where the cross-site request is initiated; converting the cross-site request into a homologous request homologous with the target address, and carrying a verification token for preventing the cross-site request from being forged in the homologous request; sending the homologous request to a server of the target address, so that the server processes the homologous request based on the verification token; and receiving a processing request result fed back by the server and a newly generated verification token, feeding back the processing request result to the service processing page, and updating the newly generated verification token to replace the currently used verification token. According to the scheme of the embodiment of the invention, the cross-station request service can be processed on the premise of effectively preventing the CSRF.

Description

technical field [0001] The present application relates to the technical field of communications, and in particular to a cross-site request processing method, device and electronic equipment. Background technique [0002] Cross-site request forgery (Cross-site request forgery, CSRF) is a kind of malicious use of websites, which uses trusted websites to achieve malicious attacks on target addresses by disguising requests from trusted users. In the cross-domain data access business of mainstream browsers, JSONP is used as the data transmission protocol in many scenarios. However, since the request is cross-domain, CSRF Token cannot be implanted on the page in the process of submitting data to the web server (using HTML form) like a traditional web application, so for some writing operation scenarios, such as sending a user For transfer, using JSONP directly will have a greater security risk. In addition, the JSONP protocol can only be submitted in GET mode, so parameters can ...

AI Technical Summary

Problems solved by technology

However, since the request is cross-domain, CSRF Token cannot be implanted on the page in the process of submitting data to the web server (using HTML form) like a traditional web application, so for some writing operation scenarios, such as sending a user For transfer, using JSONP directly will have a greater security risk

In addition, the JSONP protocol can only be submitted in GET mode, so parameters can only be written in the URL, which is easy to be intercepted and forged, and is limited by the length of the URL, and cannot be used in some scenarios with relatively large request bodies

[0003] If you use the Asynchronous JavaScript and XML (Asynchronous JavaScript And XML, AJAX) protocol to transmit data, restricted by its homology, there is no way to initiate a cross-domain request. For example, the page a.taobao.com / a.html cannot request through AJAX Access services under the b.taobao.com domain name

Images