SpringBoot防止大量请求攻击的实现

在有些特定的时候需要加上IP访问时间限制，防止一个IP多次访问请求，本文主要介绍了SpringBoot防止大量请求攻击的实现，感兴趣的可以了解一下

我们使用Jmeter测试同学的网站时，就会出现网站无法访问，403等错误。

An error occurred.
Sorry, the page you are looking for is currently unavailable.
Please try again later.
If you are the system administrator of this resource then you should check the error log for details.
Faithfully yours, nginx.

所以我们需要加上IP访问时间限制，防止一个IP多次访问请求，导致整个网站崩溃。

自定义注解：

 import java.lang.annotation.ElementType; import java.lang.annotation.Retention; import java.lang.annotation.RetentionPolicy; import java.lang.annotation.Target; /** * 自定义注解，用于拦截过于频繁的请求 */ @Retention(RetentionPolicy.RUNTIME) @Target(ElementType.METHOD) public @interface AccessLimit { int seconds(); int maxCount(); boolean needLogin() default true; }

自定义拦截器：
我采用了抛出自定义异常的方式来解决相同IP多次访问的问题：
throw new DujiaoshouException(20001,"操作过于频繁");

 import com.qykhhr.dujiaoshouservice.exceptionhandler.DujiaoshouException; import com.qykhhr.dujiaoshouservice.mycomment.AccessLimit; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.data.redis.core.RedisTemplate; import org.springframework.stereotype.Component; import org.springframework.web.method.HandlerMethod; import org.springframework.web.servlet.HandlerInterceptor; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; import java.util.concurrent.TimeUnit; /** * 自定义拦截器 */ @Component public class AccessLimtInterceptor implements HandlerInterceptor { @Autowired private RedisTemplate redisTemplate; @Override public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception { if (handler instanceof HandlerMethod) { HandlerMethod hm = (HandlerMethod) handler; AccessLimit accessLimit = hm.getMethodAnnotation(AccessLimit.class); if (null == accessLimit) { return true; } int seconds = accessLimit.seconds(); int maxCount = accessLimit.maxCount(); boolean needLogin = accessLimit.needLogin(); if (needLogin) { //判断是否登录 } String ip=request.getRemoteAddr(); String key = request.getServletPath() + ":" + ip ; Integer count = (Integer) redisTemplate.opsForValue().get(key); if (null == count || -1 == count) { redisTemplate.opsForValue().set(key, 1,seconds, TimeUnit.SECONDS); return true; } if (count

在webconfig中配置拦截器

 import com.qykhhr.dujiaoshouservice.Interceptor.AccessLimtInterceptor; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.context.annotation.Configuration; import org.springframework.web.servlet.config.annotation.InterceptorRegistry; import org.springframework.web.servlet.config.annotation.ResourceHandlerRegistry; import org.springframework.web.servlet.config.annotation.WebMvcConfigurerAdapter; /** * 在webconfig中配置拦截器 */ @Configuration public class MyWebMvcConfigurer extends WebMvcConfigurerAdapter { @Autowired private AccessLimtInterceptor accessLimtInterceptor; @Override public void addInterceptors(InterceptorRegistry registry) { registry.addInterceptor(accessLimtInterceptor); super.addInterceptors(registry); } }

在Controller前面加上注解就可以生效了

 @RestController public class AppHomeController { @GetMapping("/index") @AccessLimit(seconds = 1, maxCount = 3) //1秒内 允许请求3次 public R getImageList(){ return R.ok().data("appHome","hahaha"); } }

使用python发送100次请求，可以发现请求被拦截了多少

在这里插入图片描述