最近搭建的博客网站，详情被人刷了，特意以此来提醒该加限流处理了
引入依赖
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-data-redis</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-aop</artifactId>
</dependency>
自定义注解实现，默认10秒内只能请求5次，当然这个是根据自己的实际情况修改
@Target(ElementType.METHOD)
@Retention(RetentionPolicy.RUNTIME)
public @interface RateLimit {
//5次
int count() default 5;
//10秒
int second() default 10;
}
aop
/**
* 限流注解
* Created by PeakGao on 2023/3/2.
*/
@Aspect
@Component
public class IpLimitAspect extends AccessLimitIntercept {
@Pointcut("@annotation(com.fyg.common.annotation.RateLimit)")
public void rateLimit() {
}
@Before("rateLimit()")
public void before(JoinPoint point) throws IOException, InterruptedException {
long beginTime = System.currentTimeMillis();
MethodSignature signature = (MethodSignature) point.getSignature();
Method method = signature.getMethod();
SysLog sysLog = new SysLog();
RateLimit ipLimit = method.getAnnotation(RateLimit.class);
if (ipLimit != null) {
//注解上的描述
sysLog.setOperation(String.valueOf(ipLimit.count()) + String.valueOf(ipLimit.second()));
}
//请求的参数
Object[] args = point.getArgs();
try {
String params = new Gson().toJson(args);
sysLog.setParams(params);
} catch (Exception e) {
}
//请求的方法名
String className = point.getTarget().getClass().getName();
String methodName = signature.getName();
sysLog.setMethod(className + "." + methodName + "()");
//获取request
HttpServletRequest request = HttpContextUtils.getHttpServletRequest();
HttpServletResponse response = HttpContextUtils.getHttpServletResponse();
// try {
this.preHandle(request, response, ipLimit.count(), ipLimit.second());
// } catch (Exception e) {
// logger.error("限流内部程序出错：{}", e.getMessage());
// }
// 执行时长(毫秒)
long time = System.currentTimeMillis() - beginTime;
logger.info("API：{}，限流注解程序执行：{} 毫秒", request.getRequestURI(), time);
}
具体实现逻辑，采用ip限制控流
/**
* 接口限流
* 同一个接口10s内请求超过5次进行限流
* Created by PeakGao on 2023/3/2.
*/
public class AccessLimitIntercept extends BaseController {
public boolean preHandle(HttpServletRequest request, HttpServletResponse response, int count, int second) throws InterruptedException, IOException {
//文章搜索则不进行限流,如需部分接口地址限流可自定义注解实现
// 拼接redis key = IP + Api限流
String prefix = Constant.REDIS_KEY_PREFIX + Constant.RATE_LIMIT;
String key = ipUtils.getIpAddr(request) + request.getRequestURI();
// 获取redis的value
Integer maxTimes = null;
Object value = redisUtil.get(prefix+key);
if (value != null) {
maxTimes = (Integer) value;
}
if (maxTimes == null) {
// 如果redis中没有该ip对应的时间则表示第一次调用，保存key到redis
redisUtil.set(Constant.REDIS_KEY_PREFIX + Constant.RATE_LIMIT, key, 1, second);
} else if (maxTimes < count) {
// 如果redis中的时间比注解上的时间小则表示可以允许访问,这是修改redis的value时间
redisUtil.set(Constant.REDIS_KEY_PREFIX + Constant.RATE_LIMIT, key, maxTimes + 1, second);
} else {
// 请求过于频繁
output(response, "{\"code\":\"8002\",\"message\":\"请求过于频繁，请稍后再试\"}");
throw new RuntimeException("API请求限流拦截启动,当前接口：【" + key + "】请求过于频繁");
}
return true;
}
public void output(HttpServletResponse response, String msg) throws IOException {
response.setContentType("application/json;charset=UTF-8");
ServletOutputStream outputStream = null;
try {
outputStream = response.getOutputStream();
outputStream.write(msg.getBytes(StandardCharsets.UTF_8));
} catch (IOException e) {
e.printStackTrace();
} finally {
if (ObjectUtils.isNotEmpty(outputStream)) {
outputStream.flush();
outputStream.close();
}
}
}
}
