java秒杀高并发------安全优化验证码秒杀接口地址隐藏接口限流防刷

「爱情、让人受尽委屈。」 2022-05-25 05:30 166阅读 0赞

## 秒杀接口地址隐藏 ##

思路：秒杀开始之前，先去请求接口获取秒杀地址

1.接口改造，带上 PathVariable参数
    
    2.添加接口生成地址的接口
    
    3.秒杀手动请求，先验证PathVariable

随机生成一个字符串，作为地址加在url上，然后生成的时候  
存入 redis缓存中，根据前端请求的url获取path。  
判断与缓存中的字符串是否一致，一致就认为对的。就正常  
藐视，否则失败。

先请求下获取path。之后拼接成秒杀地址

@RequestMapping(value = "/path",method = RequestMethod.GET)
    @ResponseBody
    public Result<String> getMiaoshaPath(Model model, MiaoshaUser user, @RequestParam("goodsId") long goodsId) {
        //没登录就跳转到登录页面
        model.addAttribute("user", user);
        if (user == null) {
            return Result.error(CodeMsg.SESSION_ERROR);
        }
            String path = miaoshaService.createMiaoshaPath(user,goodsId);
    
        return Result.success(path);
    
    
    }

存入和取出 redis

public boolean checkPath(MiaoshaUser user, long goodsId, String path) {
        if (user == null||path==null){
            return false;
        }
        String pathOld = redisService.get(MiaoshaKey.getMiaoshaPath,""+user.getId()+"_"+goodsId,String.class);
    
        return path.equals(pathOld);
    }
    
    public String createMiaoshaPath(MiaoshaUser user,long goodsId) {
        String str = MD5Util.md5(UUIDUtil.uuid() + "123456");
        //利用用户id，商品id拼接为key同时也是不同的路径
        redisService.set(MiaoshaKey.getMiaoshaPath, "" + user.getId() + "_" + goodsId, str);
        return str;
    }

控制器中验证

//验证path
    boolean over = miaoshaService.checkPath(user,goodsId,path);
    if (!over){
        return Result.error(CodeMsg.REQUEST_ILLEGAL);
    }

## 数据公式验证码添加 ##

思路：点击秒杀之前，先输入验证码，分散用户的请求

1.添加生成验证码的接口
    
      2.在获取秒杀路径的时候，验证码证码
    
      3.ScriprEngine使用

前端增加获取验证码显示验证码输入验证码上传。

增加返回验证码的接口

在每次秒杀的时候，要先判断这个验证码是否正确

生成数字验证码并存入redis中，判断也是从redis中取出来判断

public BufferedImage createVerifyCode(MiaoshaUser user, long goodsId) {
        if(user == null || goodsId <=0) {
            return null;
        }
        int width = 80;
        int height = 32;
        //create the image
        BufferedImage image = new BufferedImage(width, height, BufferedImage.TYPE_INT_RGB);
        Graphics g = image.getGraphics();
        // set the background color
        g.setColor(new Color(0xDCDCDC));
        g.fillRect(0, 0, width, height);
        // draw the border
        g.setColor(Color.black);
        g.drawRect(0, 0, width - 1, height - 1);
        // create a random instance to generate the codes
        Random rdm = new Random();
        // make some confusion
        for (int i = 0; i < 50; i++) {
            int x = rdm.nextInt(width);
            int y = rdm.nextInt(height);
            g.drawOval(x, y, 0, 0);
        }
        // generate a random code
        String verifyCode = generateVerifyCode(rdm);
        g.setColor(new Color(0, 100, 0));
        g.setFont(new Font("Candara", Font.BOLD, 24));
        g.drawString(verifyCode, 8, 24);
        g.dispose();
        //把验证码存到redis中
        int rnd = calc(verifyCode);
        redisService.set(MiaoshaKey.getMiaoshaVerifyCode, user.getId()+","+goodsId, rnd);
        //输出图片
        return image;
    }
    
    public boolean checkVerifyCode(MiaoshaUser user, long goodsId, int verifyCode) {
        if(user == null || goodsId <=0) {
            return false;
        }
        Integer codeOld = redisService.get(MiaoshaKey.getMiaoshaVerifyCode, user.getId()+","+goodsId, Integer.class);
        if(codeOld == null || codeOld - verifyCode != 0 ) {
            return false;
        }
        redisService.delete(MiaoshaKey.getMiaoshaVerifyCode, user.getId()+","+goodsId);
        return true;
    }
    private static int calc(String exp) {
        try {
            ScriptEngineManager manager = new ScriptEngineManager();
            ScriptEngine engine = manager.getEngineByName("JavaScript");
            return (Integer)engine.eval(exp);
        }catch(Exception e) {
            e.printStackTrace();
            return 0;
        }
    }
    
    private static char[] ops = new char[] {
       '+', '-', '*'};
    /** * + - * * */
    * private String generateVerifyCode(Random rdm) {
        int num1 = rdm.nextInt(10);
        int num2 = rdm.nextInt(10);
        int num3 = rdm.nextInt(10);
        char op1 = ops[rdm.nextInt(3)];
        char op2 = ops[rdm.nextInt(3)];
        String exp = ""+ num1 + op1 + num2 + op2 + num3;
        return exp;
    }

## 接口限流防刷 ##

思路：对接口做限流

可以把用户访问这个url的次数存入 redis中  
做次数限制

key是 前缀+url路径+用户id

使用拦截器，拦截器中判断次数

实现只写一个注解，就可以对这个url判断  
多少秒，多少次数，是否需要登录

如何实现：

先定义注解

import static java.lang.annotation.ElementType.METHOD;
    import static java.lang.annotation.RetentionPolicy.RUNTIME;
    
    import java.lang.annotation.Retention;
    import java.lang.annotation.Target;
    @Retention(RUNTIME)
    @Target(METHOD)
    public @interface AccessLimit { 
        int seconds();
        int maxCount();
        boolean needLogin() default true;//默认需要定义
    }

接下来定义拦截器

import com.alibaba.fastjson.JSON;
    import com.example.demo.domain.MiaoshaUser;
    import com.example.demo.redis.AccessKey;
    import com.example.demo.result.CodeMsg;
    import com.example.demo.result.Result;
    import com.example.demo.service.MiaoshaUserService;
    import com.example.demo.service.RedisService;
    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.stereotype.Service;
    import org.springframework.util.StringUtils;
    import org.springframework.web.method.HandlerMethod;
    import org.springframework.web.servlet.handler.HandlerInterceptorAdapter;
    
    import javax.servlet.http.Cookie;
    import javax.servlet.http.HttpServletRequest;
    import javax.servlet.http.HttpServletResponse;
    import java.io.OutputStream;
    
    /** * Created by Administrator on 2018/5/8. */
    @Service
    public class AccessInterceptor extends HandlerInterceptorAdapter { 
    
        @Autowired
        MiaoshaUserService userService;
    
        @Autowired
        RedisService redisService;
    
        @Override
       public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler)
                throws Exception {
            if(handler instanceof HandlerMethod) {
                MiaoshaUser user = getUser(request, response);
                UserContext.setUser(user);//将用户保存到 ThreadLocal中
                HandlerMethod hm = (HandlerMethod)handler;
                //获取方法注解
                AccessLimit accessLimit = hm.getMethodAnnotation(AccessLimit.class);
                //如果没有不做任何限制
                if(accessLimit == null) {
                    return true;
                }
                //获取注解定义的几个参数
                int seconds = accessLimit.seconds();
                int maxCount = accessLimit.maxCount();
                boolean needLogin = accessLimit.needLogin();
                String key = request.getRequestURI();
                if(needLogin) {
                    if(user == null) {
                        //如果没有登录则返回错误信息，需要自己输出
                        render(response, CodeMsg.SESSION_ERROR);
                        return false;
                    }
                    key += "_" + user.getId();
                }else {
                    //do nothing
                }
                AccessKey ak = AccessKey.withExpire(seconds);
                Integer count = redisService.get(ak, key, Integer.class);
                if(count  == null) {
                    redisService.set(ak, key, 1);
                }else if(count < maxCount) {
                    redisService.incr(ak, key);
                }else {
                    render(response, CodeMsg.ACCESS_LIMIT_REACHED);
                    return false;
                }
            }
            return true;
        }
       private void render(HttpServletResponse response, CodeMsg cm)throws Exception {
            response.setContentType("application/json;charset=UTF-8");
            OutputStream out = response.getOutputStream();
            String str  = JSON.toJSONString(Result.error(cm));
            out.write(str.getBytes("UTF-8"));
            out.flush();
            out.close();
        }
    
        //取用户
        private MiaoshaUser getUser(HttpServletRequest request, HttpServletResponse response) {
            String paramToken = request.getParameter(MiaoshaUserService.COOKI_NAME_TOKEN);
            String cookieToken = getCookieValue(request, MiaoshaUserService.COOKI_NAME_TOKEN);
            if(StringUtils.isEmpty(cookieToken) && StringUtils.isEmpty(paramToken)) {
                return null;
            }
            String token = StringUtils.isEmpty(paramToken)?cookieToken:paramToken;
            return userService.getByToken(response, token);
        }
    
        private String getCookieValue(HttpServletRequest request, String cookiName) {
            Cookie[]  cookies = request.getCookies();
            if(cookies == null || cookies.length <= 0){
                return null;
            }
            for(Cookie cookie : cookies) {
                if(cookie.getName().equals(cookiName)) {
                    return cookie.getValue();
                }
            }
            return null;
        }
    
    }

定义完拦截器要注册

@Configuration
    public class WebConfig extends WebMvcConfigurerAdapter{ 
    
        @Autowired
        UserArgumentResolver userArgumentResolver;
    
        @Autowired
        AccessInterceptor accessInterceptor;
    
        @Override
        public void addArgumentResolvers(List<HandlerMethodArgumentResolver> argumentResolvers) {
            argumentResolvers.add(userArgumentResolver);
        }
    
    
        @Override
        public void addInterceptors(InterceptorRegistry registry) {
            registry.addInterceptor(accessInterceptor);
        }
    
    }