springMVC自定义注解拦截恶意请求

自定义注解

@Retention(RUNTIME) 
@Target(METHOD)
public @interface AccessLimit {
	
	int seconds() default 5; 
	int maxCount() default 2; 
}

创建一个记录访问次数的model

public class RequestIp{
	
    private String ip ;
    private long createTime;
    private Integer reCount;
	public String getIp() {
		return ip;
	}
	public void setIp(String ip) {
		this.ip = ip;
	}
	public long getCreateTime() {
		return createTime;
	}
	public void setCreateTime(long createTime) {
		this.createTime = createTime;
	}
	public Integer getReCount() {
		return reCount;
	}
	public void setReCount(Integer reCount) {
		this.reCount = reCount;

	}
}

在拦截器中使用注解

public class AccessInterceptor implements HandlerInterceptor {
   @Override
   public void afterCompletion(HttpServletRequest arg0,
			HttpServletResponse arg1, Object arg2, Exception arg3)
			throws Exception {
	// TODO Auto-generated method stub
     }
    @Override
    public void postHandle(HttpServletRequest arg0, HttpServletResponse arg1,
			Object arg2, ModelAndView arg3) throws Exception {
	// TODO Auto-generated method stub
     }
     @Override
     public boolean preHandle(HttpServletRequest request,
			HttpServletResponse response, Object handler) throws Exception {
     if (handler instanceof HandlerMethod) {
	HandlerMethod hm = (HandlerMethod) handler;
	// 使用注解
	AccessLimit accessLimit = hm.getMethodAnnotation(AccessLimit.class);
	if (accessLimit == null) {
	         return true;
	   }
	response.setCharacterEncoding("UTF-8"); 
	// 取用户的真实IP
	String ip =UserIpUtil.getIp(request);
	// 取session中的IP对象
	RequestIp re = (RequestIp) request.getSession().getAttribute(ip);
	// 第一次请求
        if (null == re) {
           // 放入到session中
	   RequestIp reIp = new RequestIp();
	   reIp.setCreateTime(System.currentTimeMillis());
	   reIp.setReCount(1);
	   request.getSession().setAttribute(ip, reIp);
	 } else {
	    Long createTime = re.getCreateTime();
	    if (null == createTime) {

	    } else {
	    if(((System.currentTimeMillis()-createTime)/1000)>accessLimit.seconds()) {
            // 当前时间离上一次请求时间大于3秒，可以直接通过,保存这次的请求
	    RequestIp reIp = new RequestIp();
	    reIp.setCreateTime(System.currentTimeMillis());
	    reIp.setReCount(1);
	    request.getSession().setAttribute(ip, reIp);
	} else {
	   // 小于3秒，并且3秒之内请求了15次，返回提示
	    if (re.getReCount() > accessLimit.maxCount()) {
		return false;
	   } else {
		// 小于3秒，但请求数小于15次，给对象添加
		re.setCreateTime(System.currentTimeMillis());
		re.setReCount(re.getReCount() + 1);
		request.getSession().setAttribute(ip, re);
		}
	    }
          }}
	}
	return true;
    }
}

在Controller中使用注解

     在对应的方法头部添加：

@AccessLimit(seconds=1,maxCount=15) 

   表示该方法一秒钟限制请求15次