How does the backend judge the login status when the front and rear end separates the interface request?

items separated from front and rear:

;
;
get;
;
;
Mar.11,2021

and they are all get requests, and the parameters are all on the link.
now, as long as you copy the request link, you can also request data on another page.

you can put permission information in header , such as token

.
now that this is not safe, others can grab the data by grabbing the package;

to tell you the truth, you can catch it no matter what, and if you catch it, you can send it. To ensure the security of the link, you can go to https.

is there any better way to do login verification when requesting an interface?

whether this interface can be accessed anonymously, or whether it can only be accessed by specific users, is a function that should exist in the backend. If it is not a public resource, login verification must be done. This is not optional.


1. Request data for encryption
2. After the front end logs in, the unique credentials for subsequent requests are saved locally
3. Checksum time limit for unique credentials (time can be extended)
by the way, what the get is all about? you pull out the backend to kill


. The backend provides another way of verification, and the commonly used authorization identification field can be achieved when cross-domain. Many platforms that provide third-party services do this


save to cookie

Menu