Spring Boot教程十七：防止接口恶意刷新和暴力请求

喜欢ヅ旅行 2021-09-01 07:04 400阅读 0赞

在实际项目使用中，必须要考虑服务的安全性，当服务部署到互联网以后，就要考虑服务被恶意请求和暴力攻击的情况，下面的教程，通过intercept和redis针对url+ip在一定时间内访问的次数来将ip禁用，可以根据自己的需求进行相应的修改，来打打自己的目的；

首先工程为springboot框架搭建，不再详细叙述。直接上核心代码。

首先创建一个自定义的拦截器类，也是最核心的代码;

/**
     * @package: com.technicalinterest.group.interceptor
     * @className: IpUrlLimitInterceptor
     * @description: ip+url重复请求现在拦截器
     * @author: Shuyu.Wang
     * @date: 2019-10-12 12:34
     * @since: 0.1
     **/
    @Slf4j
    public class IpUrlLimitInterceptor implements HandlerInterceptor {
    
    
    	private RedisUtil getRedisUtil() {
    		return  SpringContextUtil.getBean(RedisUtil.class);
    	}
    
    	private static final String LOCK_IP_URL_KEY="lock_ip_";
    
    	private static final String IP_URL_REQ_TIME="ip_url_times_";
    
    	private static final long LIMIT_TIMES=5;
    
    	private static final int IP_LOCK_TIME=60;
    
    	@Override
    	public boolean preHandle(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, Object o) throws Exception {
    		log.info("request请求地址uri={},ip={}", httpServletRequest.getRequestURI(), IpAdrressUtil.getIpAdrress(httpServletRequest));
    		if (ipIsLock(IpAdrressUtil.getIpAdrress(httpServletRequest))){
    			log.info("ip访问被禁止={}",IpAdrressUtil.getIpAdrress(httpServletRequest));
    			ApiResult result = new ApiResult(ResultEnum.LOCK_IP);
    			returnJson(httpServletResponse, JSON.toJSONString(result));
    			return false;
    		}
    		if(!addRequestTime(IpAdrressUtil.getIpAdrress(httpServletRequest),httpServletRequest.getRequestURI())){
    			ApiResult result = new ApiResult(ResultEnum.LOCK_IP);
    			returnJson(httpServletResponse, JSON.toJSONString(result));
    			return false;
    		}
    		return true;
    	}
    
    	@Override
    	public void postHandle(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, Object o, ModelAndView modelAndView) throws Exception {
    
    	}
    
    	@Override
    	public void afterCompletion(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, Object o, Exception e) throws Exception {
    
    	}
    
    	/**
    	 * @Description: 判断ip是否被禁用
    	 * @author: shuyu.wang
    	 * @date: 2019-10-12 13:08
    	 * @param ip
    	 * @return java.lang.Boolean
    	 */
    	private Boolean ipIsLock(String ip){
    		RedisUtil redisUtil=getRedisUtil();
    		if(redisUtil.hasKey(LOCK_IP_URL_KEY+ip)){
    			return true;
    		}
    		return false;
    	}
    	/**
    	 * @Description: 记录请求次数
    	 * @author: shuyu.wang
    	 * @date: 2019-10-12 17:18
    	 * @param ip
    	 * @param uri
    	 * @return java.lang.Boolean
    	 */
    	private Boolean addRequestTime(String ip,String uri){
    		String key=IP_URL_REQ_TIME+ip+uri;
    		RedisUtil redisUtil=getRedisUtil();
    		if (redisUtil.hasKey(key)){
    			long time=redisUtil.incr(key,(long)1);
    			if (time>=LIMIT_TIMES){
    				redisUtil.getLock(LOCK_IP_URL_KEY+ip,ip,IP_LOCK_TIME);
    				return false;
    			}
    		}else {
    			redisUtil.getLock(key,(long)1,1);
    		}
    		return true;
    	}
    
    	private void returnJson(HttpServletResponse response, String json) throws Exception {
    		PrintWriter writer = null;
    		response.setCharacterEncoding("UTF-8");
    		response.setContentType("text/json; charset=utf-8");
    		try {
    			writer = response.getWriter();
    			writer.print(json);
    		} catch (IOException e) {
    			log.error("LoginInterceptor response error ---> {}", e.getMessage(), e);
    		} finally {
    			if (writer != null) {
    				writer.close();
    			}
    		}
    	}
    
    
    }

代码中redis的使用的是分布式锁的形式，这样可以最大程度保证线程安全和功能的实现效果。代码中设置的是1S内同一个接口通过同一个ip访问5次，就将该ip禁用1个小时，根据自己项目需求可以自己适当修改，实现自己想要的功能；

redis分布式锁的关键代码:

/**
     * @package: com.shuyu.blog.util
     * @className: RedisUtil
     * @description:
     * @author: Shuyu.Wang
     * @date: 2019-07-14 14:42
     * @since: 0.1
     **/
    @Component
    @Slf4j
    public class RedisUtil {
    
    	private static final Long SUCCESS = 1L;
    
    	@Autowired
    	private RedisTemplate<String, Object> redisTemplate;
    	// =============================common============================
    
    	
    
    	/**
    	 * 获取锁
    	 * @param lockKey
    	 * @param value
    	 * @param expireTime：单位-秒
    	 * @return
    	 */
    	public boolean getLock(String lockKey, Object value, int expireTime) {
    		try {
    			log.info("添加分布式锁key={},expireTime={}",lockKey,expireTime);
    			String script = "if redis.call('setNx',KEYS[1],ARGV[1]) then if redis.call('get',KEYS[1])==ARGV[1] then return redis.call('expire',KEYS[1],ARGV[2]) else return 0 end end";
    			RedisScript<String> redisScript = new DefaultRedisScript<>(script, String.class);
    			Object result = redisTemplate.execute(redisScript, Collections.singletonList(lockKey), value, expireTime);
    			if (SUCCESS.equals(result)) {
    				return true;
    			}
    		} catch (Exception e) {
    			e.printStackTrace();
    		}
    		return false;
    	}
    
    	/**
    	 * 释放锁
    	 * @param lockKey
    	 * @param value
    	 * @return
    	 */
    	public boolean releaseLock(String lockKey, String value) {
    		String script = "if redis.call('get', KEYS[1]) == ARGV[1] then return redis.call('del', KEYS[1]) else return 0 end";
    		RedisScript<String> redisScript = new DefaultRedisScript<>(script, String.class);
    		Object result = redisTemplate.execute(redisScript, Collections.singletonList(lockKey), value);
    		if (SUCCESS.equals(result)) {
    			return true;
    		}
    		return false;
    	}
    
    }

最后将上面自定义的拦截器通过registry.addInterceptor添加一下，就生效了；

@Configuration
    @Slf4j
    public class MyWebAppConfig extends WebMvcConfigurerAdapter {
        @Bean
    	IpUrlLimitInterceptor getIpUrlLimitInterceptor(){
        	return new IpUrlLimitInterceptor();
    	}
    
     @Override
        public void addInterceptors(InterceptorRegistry registry) {
    		registry.addInterceptor(getIpUrlLimitInterceptor()).addPathPatterns("/**");
            super.addInterceptors(registry);
        }
    }

自己可以写一个for循环来测试方面的功能，这里就不详细介绍了；