防止接口恶意刷新和暴力请求

在实际项目使用中，必须要考虑服务的安全性，当服务部署到互联网以后，就要考虑服务被恶意请求和暴力攻击的情况，下面的教程，通过intercept和redis针对url+ip在一定时间内访问的次数来将ip禁用，可以根据自己的需求进行相应的修改，来打打自己的目的；首先创建一个自定义的拦截器类，也是最核心的代码;

import lombok.extern.slf4j.Slf4j;
import org.springframework.web.servlet.HandlerInterceptor;
import org.springframework.web.servlet.ModelAndView;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.io.PrintWriter;
@Slf4j
public class IpUrlLimitInterceptor implements HandlerInterceptor {

   private RedisUtil getRedisUtil() {
      return  SpringContextUtil.getBean(RedisUtil.class);
   }
   private static final String LOCK_IP_URL_KEY="lock_ip_";
   private static final String IP_URL_REQ_TIME="ip_url_times_";
   private static final long LIMIT_TIMES=5;
   private static final int IP_LOCK_TIME=60;
   @Override
   public boolean preHandle(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, Object o) throws Exception {
      //log.info("request请求地址uri={},ip={}", httpServletRequest.getRequestURI(), IpAdrressUtil.getIpAdrress(httpServletRequest));
      if (ipIsLock(IpAdrressUtil.getIpAdrress(httpServletRequest))){
         log.info("ip访问被禁止={}",IpAdrressUtil.getIpAdrress(httpServletRequest));
         /*ApiResult result = new ApiResult(ResultEnum.LOCK_IP);
         returnJson(httpServletResponse, JSON.toJSONString(result));*/
         return false;
      }
      if(!addRequestTime(IpAdrressUtil.getIpAdrress(httpServletRequest),httpServletRequest.getRequestURI())){
         log.info("请求次数超禁止={}",IpAdrressUtil.getIpAdrress(httpServletRequest));
         /*ApiResult result = new ApiResult(ResultEnum.LOCK_IP);
         returnJson(httpServletResponse, JSON.toJSONString(result));*/
         return false;
      }
      return true;
   }
 
   @Override
   public void postHandle(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, Object o, ModelAndView modelAndView) throws Exception { }
 
   @Override
   public void afterCompletion(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, Object o, Exception e) throws Exception { }
   /**
    * @Description: 判断ip是否被禁用
    */
   private Boolean ipIsLock(String ip){
      RedisUtil redisUtil=getRedisUtil();
      if(redisUtil.hasKey(LOCK_IP_URL_KEY+ip)){
         return true;
      }
      return false;
   }
   /**
    * @Description: 记录请求次数
    */
   private Boolean addRequestTime(String ip,String uri){
      String key=IP_URL_REQ_TIME+ip+uri;
      RedisUtil redisUtil=getRedisUtil();
      if (redisUtil.hasKey(key)){
         long time=redisUtil.incr(key,1);
         return time < LIMIT_TIMES;
      }else {
         redisUtil.getLock(key,"1",1);
      }
      return true;
   }
 
   private void returnJson(HttpServletResponse response, String json) throws Exception {
      PrintWriter writer = null;
      response.setCharacterEncoding("UTF-8");
      response.setContentType("text/json; charset=utf-8");
      try {
         writer = response.getWriter();
         ((PrintWriter) writer).print(json);
      } catch (IOException e) {
         log.error("LoginInterceptor response error ---> {}", e.getMessage(), e);
      } finally {
         if (writer != null) {
            writer.close();
         }
      }
   }
}

获取IP地址的工具类

import javax.servlet.http.HttpServletRequest;
import java.net.InetAddress;
import java.net.UnknownHostException;

/**
 * @ClassName IpAdrressUtil
 * @Description 获取IP地址的工具类
 */
public class IpAdrressUtil {

    /**
     * 获取IP地址
     */
    public static String getIpAdrress(HttpServletRequest request){
        String ipAddress = request.getHeader("x-forwarded-for");
        if(ipAddress == null || ipAddress.length() == 0 || "unknown".equalsIgnoreCase(ipAddress)) {
            ipAddress = request.getHeader("Proxy-Client-IP");
        }
        if(ipAddress == null || ipAddress.length() == 0 || "unknown".equalsIgnoreCase(ipAddress)) {
            ipAddress = request.getHeader("WL-Proxy-Client-IP");
        }
        if(ipAddress == null || ipAddress.length() == 0 || "unknown".equalsIgnoreCase(ipAddress)) {
            ipAddress = request.getRemoteAddr();
            if(ipAddress.equals("127.0.0.1") || ipAddress.equals("0:0:0:0:0:0:0:1")){
                //根据网卡取本机配置的IP
                InetAddress inet=null;
                try {
                    inet = InetAddress.getLocalHost();
                } catch (UnknownHostException e) {
                }
                if (inet.getHostAddress() != null) {
                    ipAddress= inet.getHostAddress();
                }
            }
        }
        //对于通过多个代理的情况，第一个IP为客户端真实IP,多个IP按照','分割
        if(ipAddress!=null && ipAddress.length()>15){ //"***.***.***.***".length() = 15
            if(ipAddress.indexOf(",")>0){
                ipAddress = ipAddress.substring(0,ipAddress.indexOf(","));
            }
        }
        return ipAddress;
    }
}

获取Redis工具类

import com.gssdgsfit.constant.RedisfMessageConstant;
import lombok.extern.slf4j.Slf4j;
import org.apache.commons.lang3.StringUtils;
import org.apache.http.entity.StringEntity;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.data.redis.core.script.DefaultRedisScript;
import org.springframework.data.redis.core.script.RedisScript;
import org.springframework.stereotype.Component;
import org.springframework.data.redis.core.RedisTemplate;

import java.util.ArrayList;
import java.util.Collections;
import java.util.List;
import java.util.concurrent.TimeUnit;


@Component
@Slf4j
public class RedisUtil {
 
   private static final String SUCCESS = "1L";
 
   @Autowired
   private RedisTemplate<String, String> redisTemplate;
  
   // * 获取锁
    //* @param expireTime：单位-秒
    /*
   public boolean getLock(String lockKey, Object value, int expireTime) {
      try {
         log.info("添加分布式锁key={},expireTime={}",lockKey,expireTime);
         String script = "if redis.call('setNx',KEYS[1],ARGV[1]) " +
               "then if redis.call('get',KEYS[1])==ARGV[1] " +
               "then return redis.call('expire',KEYS[1],ARGV[2]) " +
               "else return 0 end end";

         RedisScript<String> redisScript = new DefaultRedisScript<>(script, String.class);

         String result = redisTemplate.execute(redisScript, Collections.singletonList(lockKey), value, expireTime);

         if (SUCCESS.equals(result)) {
            return true;
         }
      } catch (Exception e) {
         e.printStackTrace();
      }
      return false;
   }*/
   /**
    * 加锁
    * @param key
    * @param value
    * @param timeout 过期时间
    */
   public  boolean getLock(String key, String value, Integer timeout){
      Boolean b = redisTemplate.opsForValue().setIfAbsent(key, value,timeout, TimeUnit.SECONDS);
      if(b){
         return true;
      }else{
         log.info("lock err!");
      }
      return false;
   }

   /**
    * 释放锁
    * @param lockKey
    * @param value
    * @return
    */
   public boolean releaseLock(String lockKey, String value) {
      String script = "if redis.call('get', KEYS[1]) == ARGV[1] then return redis.call('del', KEYS[1]) else return 0 end";
      RedisScript<String> redisScript = new DefaultRedisScript<>(script, String.class);
      Object result = redisTemplate.execute(redisScript, Collections.singletonList(lockKey), value);
      if (SUCCESS.equals(result)) {
         return true;
      }
      return false;
   }

   public boolean hasKey(String key){
      Object o = redisTemplate.opsForValue().get(key);
      if(StringUtils.isBlank(key) ){
         return true;
      }
      return false;
   }

   public long incr(String key, long l) {
      String s = redisTemplate.opsForValue().get(key);
      redisTemplate.opsForValue().set(key,String.valueOf(Long.parseLong(s)+l));
      return  Long.parseLong(s)+l;
   }
}

SpringContextUtil工具类

import org.springframework.beans.BeansException;
import org.springframework.beans.factory.NoSuchBeanDefinitionException;
import org.springframework.context.ApplicationContext;
import org.springframework.context.ApplicationContextAware;
import org.springframework.stereotype.Component;

@Component
public class SpringContextUtil implements ApplicationContextAware {
    private static ApplicationContext applicationContext;

    public static ApplicationContext getApplicationContext() {
        return applicationContext;
    }

    // 下面的这个方法上加了@Override注解，原因是继承ApplicationContextAware接口是必须实现的方法
    @Override
    public void setApplicationContext(ApplicationContext applicationContext)
            throws BeansException {
        SpringContextUtil.applicationContext = applicationContext;
    }

    public static Object getBean(String name)
            throws BeansException {
        return applicationContext.getBean(name);
    }

    public static Object getBean(String name, Class<?> requiredType)
            throws BeansException {

        return applicationContext.getBean(name, requiredType);
    }

    public static <T> T getBean(Class<T> clazz)
            throws BeansException {
        return applicationContext.getBean(clazz);
    }

    public static boolean containsBean(String name) {
        return applicationContext.containsBean(name);
    }

    public static boolean isSingleton(String name)
            throws NoSuchBeanDefinitionException {
        return applicationContext.isSingleton(name);
    }

    public static Class<?> getType(String name)
            throws NoSuchBeanDefinitionException {
        return applicationContext.getType(name);
    }

    public static String[] getAliases(String name)
            throws NoSuchBeanDefinitionException {
        return applicationContext.getAliases(name);
    }
}

最后将上面自定义的拦截器通过registry.addInterceptor添加一下，就生效了；

import lombok.extern.slf4j.Slf4j;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurerAdapter;

@Configuration
@Slf4j
public class MyWebAppConfig extends WebMvcConfigurerAdapter {
    @Bean
   IpUrlLimitInterceptor getIpUrlLimitInterceptor(){
       return new IpUrlLimitInterceptor();
   }
 
 @Override
    public void addInterceptors(InterceptorRegistry registry) {
      registry.addInterceptor(getIpUrlLimitInterceptor()).addPathPatterns("/**");
        super.addInterceptors(registry);
    }
}

原文地址：http://www.cnblogs.com/yswsxf/p/16815738.html