An anti-passback method, wherein the method is performed by a server communicatively connected to at least two access controllers, wherein a first valid period for correspondence among an identifier of an access card, an identifier of a card reader and an identifier of an access controller is set in the server, comprising: receiving a door opening request sent by a first access controller, wherein the door opening request contains an identifier of an access card, an identifier of the first access controller, and an identifier of a first card reader reading the access card this time, the first card reader being attached to a door controlled by the first access controller; determining, according to the first valid period, whether a correspondence among the identifier of the access card, the identifier of the first card reader, and the identifier of the first access controller contained in the door opening request is valid at the moment; and if so, searching, based on the identifier of the access card, for an identifier of a second card reader that read the access card last time, and an identifier of a second access controller corresponding to the second card reader; determining a route for the door opening request according to the identifier of the first card reader, the identifier of the first access controller, the identifier of the second card reader, and the identifier of the second access controller; determining whether the determined route exists in a preset list of routes; and if so, sending a door opening instruction to the first access controller to allow the first access controller to open a door corresponding to the door opening request according to the door opening instruction; wherein after sending the door opening instruction to the first access controller, the method further comprises: updating the identifier of the card reader that read the access card last time from the identifier of the second card reader to the identifier of the first card reader, and updating the identifier of the access controller corresponding to the card reader that read the access card last time from the identifier of the second access controller to the identifier of the first access controller. receiving a door opening request sent by a first access controller, wherein the door opening request contains an identifier of an access card, an identifier of the first access controller, and an identifier of a first card reader reading the access card this time, the first card reader being attached to a door controlled by the first access controller; determining, according to the first valid period, whether a correspondence among the identifier of the access card, the identifier of the first card reader, and the identifier of the first access controller contained in the door opening request is valid at the moment; and if so, searching, based on the identifier of the access card, for an identifier of a second card reader that read the access card last time, and an identifier of a second access controller corresponding to the second card reader; determining a route for the door opening request according to the identifier of the first card reader, the identifier of the first access controller, the identifier of the second card reader, and the identifier of the second access controller; determining whether the determined route exists in a preset list of routes; and if so, sending a door opening instruction to the first access controller to allow the first access controller to open a door corresponding to the door opening request according to the door opening instruction; wherein after sending the door opening instruction to the first access controller, the method further comprises: updating the identifier of the card reader that read the access card last time from the identifier of the second card reader to the identifier of the first card reader, and updating the identifier of the access controller corresponding to the card reader that read the access card last time from the identifier of the second access controller to the identifier of the first access controller.