springboot 接口隐藏

青旅半醒 2022-09-08 10:28 133阅读 0赞

springboot 接口隐藏

*********************

接口隐藏

应用：秒杀场景中，避免直接暴露秒杀接口，实现url动态化

实现方法

  1. 前端页面点击/getPath，获取动态路径path，同时后端存储path
  2. 获取成功后，将path与秒杀路径拼接，如"/"+path+"/miaosha"
  4. 后端读取动态路径path（@PathVariable），并进行检验
  6. 如果与后端存储的路径匹配，则执行后续步骤，否则抛异常退出

说明

  1. 秒杀地址动态化可防止秒杀地址直接暴露，用户只能点击按钮触发秒杀请求
  2. 但是，用户可使用脚本频繁点击按钮，因此需要需要使用限流措施防止刷接口

*********************

示例

***********

dto 层

ResponseResult

  1. @Data
  2. public class ResponseResult<T> {
  4.     private String code;
  5.     private String status;
  6.     private String message;
  7.     private T data;
  8. }

***********

util 层

StoreUtil

  1. public class StoreUtil {
  3.     private static final Map<String,String> map=new HashMap<>();
  5.     public static void setValue(String key, String value){
  6.         map.put(key, value);
  7.     }
  9.     public static String getValue(String key){
  10.         return map.get(key);
  11.     }
  13.     public static void deleteKey(String key){
  14.         map.remove(key);
  15.     }
  16. }

***********

service 层

DynamicUrlService

  1. @Service
  2. public class DynamicUrlService {
  4.     public String createPath(String userId, String goodId){
  5.         String key=userId+goodId;
  6.         String value=RandomStringUtils.randomAlphanumeric(20);
  7.         value=DigestUtils.md5DigestAsHex(value.getBytes(StandardCharsets.UTF_8));
  9.         StoreUtil.setValue(key,value);
  10.         return value;
  11.     }
  13.     public boolean checkPath(String pathKey, String pathValue){
  14.         if (pathKey==null || pathValue==null){
  15.             return false;
  16.         }
  18.         synchronized (this){
  19.             if (pathValue.equals(StoreUtil.getValue(pathKey))){
  20.                 StoreUtil.deleteKey(pathKey);
  22.                 return true;
  23.             }
  24.         }
  26.         return false;
  27.     }
  28. }

***********

config 层

WebConfig

  1. @Configuration
  2. public class WebConfig implements WebMvcConfigurer {
  4.     @Override
  5.     public void addViewControllers(ViewControllerRegistry registry) {
  6.         registry.addViewController("/index").setViewName("index");
  7.     }
  8. }

***********

controller 层

HelloController

  1. @RestController
  2. public class HelloController {
  4.     @Resource
  5.     private DynamicUrlService dynamicUrlService;
  7.     @RequestMapping("/getPath")
  8.     public ResponseResult<String> getPath(String userId, String goodId){
  9.         if ( (userId==null||userId=="")
  10.                 || (goodId==null||goodId=="") ){
  11.             throw new RuntimeException("userId或者goodId不能为空");
  12.         }
  14.         String path = dynamicUrlService.createPath(userId,goodId);
  16.         ResponseResult<String> result=new ResponseResult<>();
  17.         result.setCode("000000");
  18.         result.setStatus("success");
  19.         result.setData(path);
  21.         return result;
  22.     }
  24.     @RequestMapping("/{path}/hello")
  25.     public ResponseResult<String> hello(@PathVariable("path") String path,
  26.                                         String userId, String goodId,
  27.                                         String name, Integer age){
  28.         System.out.println(userId+"  "+goodId);
  29.         System.out.println(path);
  31.         String key=userId+goodId;
  32.         if (!dynamicUrlService.checkPath(key,path)){
  33.             throw new RuntimeException("path 检验出错");
  34.         }
  36.         System.out.println(name+"  "+age);
  38.         ResponseResult<String> result=new ResponseResult<>();
  39.         result.setCode("000000");
  40.         result.setStatus("success");
  41.         result.setData(name+"  "+age);
  43.         return result;
  44.     }
  46.     @ExceptionHandler
  47.     public ResponseResult<String> handleException(Exception e){
  48.         ResponseResult<String> result=new ResponseResult<>();
  49.         result.setCode("111111");
  50.         result.setStatus("error");
  51.         result.setMessage(e.getMessage());
  53.         return result;
  54.     }
  55. }

***********

前端页面

index.html

  1. <!DOCTYPE html>
  2. <html lang="en" xmlns="http://www.w3.org/1999/xhtml"
  3.       xmlns:th="http://www.thymeleaf.org" xmlns:sec="http://www.thymeleaf.org/thymeleaf-extras-springsecurity5">
  4. <head>
  5.     <meta charset="UTF-8">
  6.     <title>Title</title>
  7.     <script src="/jquery/jquery-3.6.0.min.js"></script>
  8.     <script src="/layui-v2.6.8/layui/layui.js"></script>
  9.     <link rel="stylesheet" href="/layui-v2.6.8/layui/css/layui.css">
  10.     <script>
  11.         $(function (){
  12.             let path;
  14.             $("#btn").click(function (){
  15.                 $.get({
  16.                     url: "/getPath",
  17.                     data: {
  18.                         userId: $("#userId").val(),
  19.                         goodId: $("#goodId").val()
  20.                     },
  21.                     success: function (result){
  22.                         if (result.code === "000000" ){
  23.                             path=result.data;
  25.                             $.get({
  26.                                 url: "/"+path+"/hello",
  27.                                 data: {
  28.                                     userId: $("#userId").val(),
  29.                                     goodId: $("#goodId").val(),
  30.                                     name: "瓜田李下",
  31.                                     age: 20
  32.                                 },
  33.                                 success: function (result){
  34.                                     if (result.code==="000000"){
  35.                                         layer.msg(result.data);
  36.                                     }else {
  37.                                         layer.msg(result.message)
  38.                                     }
  39.                                 }
  40.                             })
  41.                         }else {
  42.                             layer.msg(result.message);
  43.                         }
  44.                     }
  45.                 })
  46.             })
  47.         })
  48.     </script>
  49. </head>
  50. <body>
  51.     <div th:align="center">
  52.         <div class="layui-form-item">
  53.             <label class="layui-form-label" style="color: coral;font-weight: bolder">userId</label>
  54.             <div class="layui-input-inline">
  55.                 <input type="text" id="userId" required  lay-verify="required" placeholder="请输入userId" autocomplete="off" class="layui-input">
  56.             </div>
  57.         </div>
  58.         <div class="layui-form-item">
  59.             <label class="layui-form-label" style="color: coral;font-weight: bolder">goodId</label>
  60.             <div class="layui-input-inline">
  61.                 <input type="text" id="goodId" required lay-verify="required" placeholder="请输入goodId" autocomplete="off" class="layui-input">
  62.             </div>
  63.         </div>
  64.         <div class="layui-form-item">
  65.             <div class="layui-input-inline">
  66.                 <button id="btn" class="layui-btn">提交</button>
  67.             </div>
  68.         </div>
  69.     </div>
  70. </body>
  71. </html>

*********************

使用测试

localhost:8080/index

  1.                      ![watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAb1_nk5znlLDmnY7kuItfbw_size_12_color_FFFFFF_t_70_g_se_x_16][]

userId、goodId均为空，点击按钮

  1.                 ![watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAb1_nk5znlLDmnY7kuItfbw_size_9_color_FFFFFF_t_70_g_se_x_16][]

userId、goodId不为空，点击按钮

  1.                 ![watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAb1_nk5znlLDmnY7kuItfbw_size_9_color_FFFFFF_t_70_g_se_x_16 1][]

使用任意path，直接访问/{path}/hello 

  1.                      ![watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAb1_nk5znlLDmnY7kuItfbw_size_12_color_FFFFFF_t_70_g_se_x_16 1][]

发表评论

表情：
评论列表 （有 0 条评论，133人围观）

还没有评论，来说两句吧...

相关阅读