CN103188344A - Method for safely invoking REST API (representational state transfer, application programming interface) - Google Patents

Abstract

The invention provides a method for safely invoking an REST API (representational state transfer, application programming interface). The method comprises the following steps that: a client initiates a first API invocation request to an application server; the application server verifies the validity of the first request of the client and provides a token; the client carries the token to imitates a second request to the application server again; and the application server does not generate the token for the client, but verifies the token of the second request information, responds to the client request which is legal and valid to the token and returns a corresponding result. The method for safely invoking the REST API, disclosed by the invention, greatly improves the safety when the client invokes the REST API, and meanwhile, saves the time when the application server requests the verification to the client and improves the efficiency when the application server responds to the client request.

Description

A kind of safety is called the method for REST API

Technical field

The present invention relates to Web application and development field, be specifically related to when REST framework style exploitation internet, applications, a kind of safety is called the method for REST API.

Background technology

Along with the development of Information technology and the continuous application of network technology, the Web application and development is designed into every field gradually.REST framework style is the brand-new exploitation style at the Web application, is the most successful Internet superman media distribution formula system architecture in the world today, and it makes people get a real idea of the original looks of Http agreement.Along with the REST framework becomes mainstream technology, a kind of mode of thinking of brand-new Internet application and development comes into vogue.

In the Web application development process, especially under REST framework style, the user is more and more higher for safe requirement, and for the developer, when seeking efficiently development approach, also constantly pay attention to the raising of fail safe, the present invention calls the method for REST API with regard to having proposed a kind of new safety.

Wherein: REST (Representational State Transfer, presentation state transitions);

API (Application Programming Interface, API).

Summary of the invention

The purpose of this invention is to provide a kind of safety and call the method for REST API.

The objective of the invention is to realize in the following manner, invocation step is as follows:

Client is initiated API Calls first request to application server, the legitimacy of server authentication client first request also provides identity security token token, client is initiated second request, the solicited message of application server checking client and return results to application server again according to identity security token token;

When client is initiated first request of REST API Calls to application server, must in first solicited message, comprise the required identity information of checking, application server receives first request from client, by Verification System checking request legitimacy, for legitimate request provides identity security token token;

This identity security token token content comprise from the identity information of client first request, after the checking of application server Verification System, additional unique ID at random and timestamp, form basic identity security token token, after encrypting, formal generation application server is used for returning to the identity security token token of client, and this token keeps uniqueness also to have certain life cycle;

Client is initiated second request to application server again according to identity security token token, the solicited message of application server checking client and return results, client is received after the identity security token token of application server responses, carry this security token token and initiate second request to application server again, server no longer generates security token token for client, but the identity security token token in second solicited message is verified, identity security token token legal and valid client-requested is responded, return accordingly result.

The invention has the beneficial effects as follows: client is initiated API Calls first request to application server, the legitimacy of server authentication client first request also provides identity security token (token), client is carried identity security token (token) and is initiated second request to application server again, application server no longer generates security token (token) for client, but the identity security token (token) in second solicited message is verified, identity security token legal and valid client-requested is responded, return accordingly result.This method has improved the fail safe of client call REST API greatly, has saved the time of application server to the client-requested checking simultaneously, has improved server customer in response end request efficiency.

Description of drawings

Fig. 1 is the realization flow schematic diagram.

Embodiment

Explain below with reference to Figure of description method of the present invention being done.

With reference to accompanying drawing 1, content of the present invention is described the process of this method of realization with an instantiation.

Implementation step is as follows:

Client is initiated API Calls first request (1) to application server, the legitimacy of server authentication client first request also provides identity security token (token) (2), client is carried identity security token (token) and is initiated second request (3) to application server again, application server is verified the identity security token (token) in second solicited message, identity security token legal and valid client-requested is responded, return accordingly result (4), by that analogy.

Except the described technical characterictic of specification, be the known technology of those skilled in the art.

Claims (1)

1. a safety is called the method for REST API, it is characterized in that invocation step is as follows:

Client is initiated API Calls first request to application server, the legitimacy of server authentication client first request also provides identity security token token, client is initiated second request, the solicited message of application server checking client and return results to application server again according to identity security token token;

When client is initiated first request of REST API Calls to application server, must in first solicited message, comprise the required identity information of checking, application server receives first request from client, by Verification System checking request legitimacy, for legitimate request provides identity security token token;

This identity security token token content comprise from the identity information of client first request, after the checking of application server Verification System, additional unique ID at random and timestamp, form basic identity security token token, after encrypting, formal generation application server is used for returning to the identity security token token of client, and this token keeps uniqueness also to have certain life cycle;

Client is initiated second request to application server again according to identity security token token, the solicited message of application server checking client and return results, client is received after the identity security token token of application server responses, carry this security token token and initiate second request to application server again, server no longer generates security token token for client, but the identity security token token in second solicited message is verified, identity security token token legal and valid client-requested is responded, return accordingly result.

Images