springboot 接口防刷
springboot 接口防刷
*****************
接口防刷
刷接口造成的影响
循环访问接口，会使流量暴增，影响网站的正常对外服务如果短信验证、支付接口遭到恶意访问，还会造成企业损失
接口防刷措施
限制ip访问频率与并发数，可用nignx进行限制limit_req_zone $binary_remote_addr zone=one:10m rate=20r/s; #单个ip每秒请求数limit_conn_zone $binary_remote_addr zone=addr:10m; #单个ip每秒并发数接口添加验证码，如短信接口发送短信前先使用验证码验证重要接口在用户认证后才能访问，非认证用户不能访问后端对接口限流，限制同一用户访问频率，可使用guava、Redisson提供的限流工具
*****************
示例：**后端接口限流**
***********
配置文件
application.yml
spring:redis:host: 192.168.57.120port: 6379
***********
dto 层
ResponseResult
@Datapublic class ResponseResult<T> {private String code;private String status;private String message;private T data;}
***********
annotation 层
RateLimiter
@Documented@Target(ElementType.METHOD)@Retention(RetentionPolicy.RUNTIME)public @interface RateLimiter {int userLimit() default 5;int ipLimit() default 10;}
***********
interceptor 层
CustomInterceptor
@Configurationpublic class CustomInterceptor implements HandlerInterceptor {@Resourceprivate RedissonClient client;private final ConcurrentHashMap<String,RRateLimiter> map = new ConcurrentHashMap<>();@Overridepublic boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {if (handler instanceof HandlerMethod){Method method = ((HandlerMethod) handler).getMethod();Authentication authentication = SecurityContextHolder.getContext().getAuthentication();String userName = authentication.getName();String path=request.getServletPath();if (method.isAnnotationPresent(RateLimiter.class)){RateLimiter rateLimiter = method.getAnnotation(RateLimiter.class);RRateLimiter limiter;if (userName!=null && !userName.equals("anonymousUser")){int userLimit = rateLimiter.userLimit();String key=userName+path+"user-rate-limiter";if (!map.containsKey(key)){limiter = client.getRateLimiter(key);limiter.setRate(RateType.PER_CLIENT,userLimit,1, RateIntervalUnit.MINUTES);map.put(key,limiter);}else {limiter = map.get(key);}}else {int ipLimiter = rateLimiter.ipLimit();String remoteAddr = request.getRemoteAddr();String key=remoteAddr+path+"ip-rate-limiter";if (!map.containsKey(key)){limiter = client.getRateLimiter(key);limiter.setRate(RateType.PER_CLIENT,ipLimiter,1, RateIntervalUnit.MINUTES);map.put(key,limiter);}else {limiter = map.get(key);}}if (limiter.tryAcquire()){return true;}else {throw new RuntimeException("请稍后重试");}}}return true;}}
***********
service 层
CustomUserService
@Servicepublic class CustomUserService implements UserDetailsService {@Resourceprivate PasswordEncoder passwordEncoder;@Overridepublic UserDetails loadUserByUsername(String s) throws UsernameNotFoundException {return new User("gtlx",passwordEncoder.encode("123456"),Collections.singletonList(new SimpleGrantedAuthority("user")));}}
***********
config 层
DataConfig
@Configurationpublic class DataConfig {@Resourceprivate RedisProperties redisProperties;@Beanpublic RedissonClient intiRedissonClient(){Config config=new Config();config.useSingleServer().setAddress("redis://"+redisProperties.getHost()+":"+redisProperties.getPort());return Redisson.create(config);}}
WebConfig
@Configurationpublic class WebConfig implements WebMvcConfigurer {@Resourceprivate CustomInterceptor customInterceptor;@Overridepublic void addInterceptors(InterceptorRegistry registry) {registry.addInterceptor(customInterceptor);}}
WebSecurityConfig
@Configurationpublic class WebSecurityConfig extends WebSecurityConfigurerAdapter {@Resourceprotected UserDetailsService userDetailsService;@Overrideprotected void configure(AuthenticationManagerBuilder auth) throws Exception {auth.userDetailsService(userDetailsService);}@Overrideprotected void configure(HttpSecurity http) throws Exception {http.formLogin().and().authorizeRequests().antMatchers("/hello").authenticated().anyRequest().permitAll();}@Beanpublic PasswordEncoder initPasswordEncoder(){return new BCryptPasswordEncoder();}}
***********
controller 层
HelloController
@RestControllerpublic class HelloController {@RateLimiter(userLimit = 5)@RequestMapping("/hello")public ResponseResult<String> hello(){ResponseResult<String> result=new ResponseResult<>();result.setCode("000000");result.setStatus("success");result.setData("hello");return result;}@RateLimiter()@RequestMapping("/hello2")public ResponseResult<String> hello2(){ResponseResult<String> result=new ResponseResult<>();result.setCode("000000");result.setStatus("success");result.setData("hello2");return result;}@ExceptionHandlerpublic ResponseResult<String> handleError(Exception e){ResponseResult<String> result=new ResponseResult<>();result.setCode("111111");result.setStatus("error");result.setMessage(e.getMessage());return result;}}
*****************
使用测试
localhost:8080/hello
![watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAb1_nk5znlLDmnY7kuItfbw_size_9_color_FFFFFF_t_70_g_se_x_16][]
认证通过后，输出
![watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAb1_nk5znlLDmnY7kuItfbw_size_9_color_FFFFFF_t_70_g_se_x_16 1][]
连续点击5次，输出
![watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAb1_nk5znlLDmnY7kuItfbw_size_9_color_FFFFFF_t_70_g_se_x_16 2][]
localhost:8080/hello2（重启应用）
![watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAb1_nk5znlLDmnY7kuItfbw_size_9_color_FFFFFF_t_70_g_se_x_16 3][]
连续点击10次（ip限流），输出
![watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAb1_nk5znlLDmnY7kuItfbw_size_9_color_FFFFFF_t_70_g_se_x_16 4][]
╰+哭是因爲堅強的太久メ
系统管理员
阳光穿透心脏的1/2处
￡神魔★判官ぃ
灰太狼
还没有评论，来说两句吧...