springboot 自定义注解+拦截器+Redis实现限流，防止恶意刷接口实践

朱雀 2023-10-02 15:53 1阅读 0赞

自定义注解，具体频次，根据具体场景设置

import java.lang.annotation.*;
    
    @Inherited
    @Documented
    @Target({ElementType.FIELD, ElementType.TYPE, ElementType.METHOD})
    @Retention(RetentionPolicy.RUNTIME)
    /**
     * 限流注解
     */
    public @interface AccessLimit {
        //标识 指定sec时间段内的访问次数限制
        int limit() default 5;
    
        //标识 时间段
        int sec() default 5;
    }

拦截器

import com.zubus.commonUtils.entity.BusyBusinessException;
    import com.zubus.commonUtils.tool.IpUtils;
    import com.zubus.mobileApi.annotation.AccessLimit;
    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.data.redis.core.RedisTemplate;
    import org.springframework.stereotype.Component;
    import org.springframework.web.method.HandlerMethod;
    import org.springframework.web.servlet.HandlerInterceptor;
    import org.springframework.web.servlet.ModelAndView;
    
    import javax.servlet.ServletOutputStream;
    import javax.servlet.http.HttpServletRequest;
    import javax.servlet.http.HttpServletResponse;
    import java.io.IOException;
    import java.lang.reflect.Method;
    import java.util.concurrent.TimeUnit;
    
    /**
     * @description: 限流拦截器
     * @author: x x 
     * @create: 2021-11-18 09:45
     */
    @Component
    public class AccessLimitInterceptor implements HandlerInterceptor {
    
        //使用RedisTemplate操作redis
        @Autowired
        private RedisTemplate redisTemplate;
    
        @Override
        public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
            if (handler instanceof HandlerMethod) {
                HandlerMethod handlerMethod = (HandlerMethod) handler;
                Method method = handlerMethod.getMethod();
                if (!method.isAnnotationPresent(AccessLimit.class)) {
                    return true;
                }
                AccessLimit accessLimit = method.getAnnotation(AccessLimit.class);
                if (accessLimit == null) {
                    return true;
                }
                int limit = accessLimit.limit();
                int sec = accessLimit.sec();
                String key = IpUtils.getIpAddr(request) + request.getRequestURI();
                Integer maxLimit = (Integer) redisTemplate.opsForValue().get(key);
                if (maxLimit == null) {
                    //set时一定要加过期时间
                    redisTemplate.opsForValue().set(key, 1, sec, TimeUnit.SECONDS);
                } else if (maxLimit < limit) {
                    redisTemplate.opsForValue().set(key, maxLimit + 1, sec, TimeUnit.SECONDS);
                } else {
                    throw new BusyBusinessException("请求太频繁");
                    //output(response, "请求太频繁!");
                    //return false;
                }
            }
            return true;
        }
    
        public void output(HttpServletResponse response, String msg) throws IOException {
            response.setContentType("application/json;charset=UTF-8");
            ServletOutputStream outputStream = null;
            try {
                outputStream = response.getOutputStream();
                outputStream.write(msg.getBytes("UTF-8"));
            } catch (IOException e) {
                e.printStackTrace();
            } finally {
                outputStream.flush();
                outputStream.close();
            }
        }
    
        @Override
        public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler, ModelAndView modelAndView) throws Exception {
    
        }
    
        @Override
        public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex) throws Exception {
    
        }
    }

import org.springframework.context.annotation.Configuration;
    import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
    import org.springframework.web.servlet.config.annotation.WebMvcConfigurerAdapter;
    
    import javax.annotation.Resource;
    
    /**
     * @description: 拦截器注册
     * @author: x x
     * @create: 2021-11-18 09:57
     */
    @Configuration
    public class WebConfig extends WebMvcConfigurerAdapter {
    
        @Resource
        private AccessLimitInterceptor accessLimitInterceptor;
    
        @Override
        public void addInterceptors(InterceptorRegistry registry) {
            registry.addInterceptor(accessLimitInterceptor);
        }
    }

自定义异常

public class BusyBusinessException extends RuntimeException{
    
        public BusyBusinessException() {}
        public BusyBusinessException(String exceptionInfo) {
            super(exceptionInfo);
        }
    }

全局异常处理

@RestController
    @Log4j2
    public class GlobalException {
    	@ControllerAdvice
    	public class GlobalControllerExceptionHandler {   
    		/*
    		 * 统一异常处理
    		 */
    	    @ExceptionHandler(value = Exception.class)
    	    @ResponseBody// 返回json数据
    	    public ApiResult defaultErrorHandler(HttpServletRequest req, Exception e) throws Exception {
    	    	ApiResult api = new ApiResult();
    	    	String info = "系统异常，请联系管理员";
    	    	e.printStackTrace();
    	    	if(e instanceof UnauthorizedException) {
    	    		info = "没有权限";
    	    		//throw e;
    	    	}else if(e instanceof HttpRequestMethodNotSupportedException) {
    	    		throw e;
    	    		//api.setCode(405);
    	    		//return api.failed("请先登录");
    	    	}else if(e instanceof MaxUploadSizeExceededException) {
    	    		info = "文件太大";
    	    	}else if (e instanceof BusyBusinessException) {
    				return api.failed(e.getMessage());
    			}
    	    	return api.failed(info);
    	    }     
    	}
    }

测试接口

@GetMapping("/noAuth/hello")
        @AccessLimit()
        public ApiResult hello(HttpSession session) {
    
    
            return new ApiResult().success("helle");
    
        }

测试，连续访问6次

![watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBA6L275bCYw5c_size_20_color_FFFFFF_t_70_g_se_x_16][]

![watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBA6L275bCYw5c_size_20_color_FFFFFF_t_70_g_se_x_16 1][]

本地测试达到预期效果，线上测试，有待观察，仅供参考。

[watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBA6L275bCYw5c_size_20_color_FFFFFF_t_70_g_se_x_16]: https://img-blog.csdnimg.cn/5d057db0d8a2436cbbc201d1d85d0d8c.png?x-oss-process=image/watermark,type_ZHJvaWRzYW5zZmFsbGJhY2s,shadow_50,text_Q1NETiBA6L275bCYw5c=,size_20,color_FFFFFF,t_70,g_se,x_16
[watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBA6L275bCYw5c_size_20_color_FFFFFF_t_70_g_se_x_16 1]: https://img-blog.csdnimg.cn/e7d86b631033449d89b3c276801ffc78.png?x-oss-process=image/watermark,type_ZHJvaWRzYW5zZmFsbGJhY2s,shadow_50,text_Q1NETiBA6L275bCYw5c=,size_20,color_FFFFFF,t_70,g_se,x_16