使用注解搞定 Spring Boot 接口恶意刷新和暴力请求！

Who_Mr.Lin

于 2022-07-29 23:08:57 发布

阅读量293

点赞数 1

本文链接：https://blog.csdn.net/weixin_44589578/article/details/126062253

版权

首先是写一个注解类：
接着就是在Interceptor拦截器中实现：
再把Interceptor注册到springboot中
接着在Controller中加入注解

1.首先是写一个注解类

import java.lang.annotation.Retention;
import java.lang.annotation.Target;

import static java.lang.annotation.ElementType.METHOD;
import static java.lang.annotation.RetentionPolicy.RUNTIME;

@Retention(RUNTIME)
@Target(METHOD)
public @interface AccessLimit {

    int seconds();
    int maxCount();
    boolean needLogin()default true;
    
}

接着就是在Interceptor拦截器中实现《reids方法可自行封装》

import cn.tolin.springboot.lab1.eum.AccessLimit;
import cn.tolin.springboot.lab1.res.R;
import com.alibaba.fastjson.JSON;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.data.redis.core.StringRedisTemplate;
import org.springframework.stereotype.Component;
import org.springframework.web.method.HandlerMethod;
import org.springframework.web.servlet.handler.HandlerInterceptorAdapter;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.OutputStream;
import java.util.concurrent.TimeUnit;

@Component
public class FangshuaInterceptor extends HandlerInterceptorAdapter {

    @Autowired
        private StringRedisTemplate redisTemplate;

    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
        //判断请求是否属于方法的请求
        if(handler instanceof HandlerMethod){
            HandlerMethod hm = (HandlerMethod) handler;
            //获取方法中的注解,看是否有该注解
            AccessLimit accessLimit = hm.getMethodAnnotation(AccessLimit.class);
            if(accessLimit == null){
                return true;
            }
            int seconds = accessLimit.seconds();
            int maxCount = accessLimit.maxCount();
            boolean login = accessLimit.needLogin();
            String key = request.getRequestURI();
            //如果需要登录
            if (login){
                //获取登录的session进行判断
                //.....
                key+=""+"kou";  //这里假设用户是kou,项目中是动态获取的userId
            }

            //从redis中获取用户访问的次数
           // AccessKey ak = AccessKey.withExpire(seconds);
            //Integer count = redisService.get(ak,key,Integer.class);

            String s = redisTemplate.opsForValue().get(key);
            if (s == null){
                //第一次访问
                //redisService.set(ak,key,1);
                redisTemplate.opsForValue().set(key, "1", seconds, TimeUnit.SECONDS);
            } else if (Integer.valueOf(s) < maxCount){
                //加1
               // redisService.incr(ak,key);
                redisTemplate.boundValueOps(key).increment(1);
            } else {
                //超出访问次数
                render(response); //这里的CodeMsg是一个返回参数
                return false;
            }
        }
        return true;
    }
    
    private void render(HttpServletResponse response)throws Exception {
        response.setContentType("application/json;charset=UTF-8");
        OutputStream out = response.getOutputStream();
        String str  = JSON.toJSONString(R.error());
        out.write(str.getBytes("UTF-8"));
        out.flush();
        out.close();
    }
    
}

再把Interceptor注册到springboot中

package cn.tolin.springboot.lab1.config;

import cn.tolin.springboot.lab1.interceptor.FangshuaInterceptor;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurerAdapter;

@Configuration
public class FangshuaConfig extends WebMvcConfigurerAdapter {

    @Autowired
    private FangshuaInterceptor interceptor;


    @Override
    public void addInterceptors(InterceptorRegistry registry) {
        registry.addInterceptor(interceptor);
    }
    
}

接着在Controller中加入注解

import cn.tolin.springboot.lab1.eum.AccessLimit;
import cn.tolin.springboot.lab1.res.R;
import cn.tolin.springboot.lab1.server.UserServer;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;

@RestController
@RequestMapping("/usr")
public class UserController {
    @Autowired
    private UserServer userServer;


    @RequestMapping("/list")
    @AccessLimit(seconds = 5, maxCount = 5, needLogin = true)
    public R list()  {
        return  userServer.list();
    }
}

配置

spring:
  # datasource 数据源配置内容
  datasource:
    url: jdbc:mysql://172.29.67.66:3306/demo?useSSL=false&useUnicode=true&characterEncoding=UTF-8
    driver-class-name: com.mysql.jdbc.Driver
    username: root
    password: 秘密
  profiles:
    active: dev
  redis:
    port: 6379
    host: 192.168.118.128

# mybatis-plus 配置内容
mybatis-plus:
  configuration:
    map-underscore-to-camel-case: true # 虽然默认为 true ，但是还是显示去指定下。
  global-config:
    db-config:
      id-type: auto # ID 主键自增
      logic-delete-value: 1 # 逻辑已删除值(默认为 1)
      logic-not-delete-value: 0 # 逻辑未删除值(默认为 0)
  mapper-locations: classpath*:mapper/*.xml
  type-aliases-package: cn.tolin.springboot.lab1.domain

# logging
logging:
  level:
    # dao 开启 debug 模式 mybatis 输入 sql
    cn:
      linxj:
        lab01:
          mapper: debug

依赖

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <parent>
        <artifactId>lab-1-mybatis</artifactId>
        <groupId>cn.tolin.springboot.labs</groupId>
        <version>1.0.0</version>
    </parent>
    <modelVersion>4.0.0</modelVersion>

    <artifactId>lab-1-mybatis-plus</artifactId>

    <dependencies>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>
        </dependency>

        <!-- 实现对 MyBatis Plus 的自动化配置 -->
        <dependency>
            <groupId>com.baomidou</groupId>
            <artifactId>mybatis-plus-boot-starter</artifactId>
            <version>3.0.5</version>
        </dependency>
        <!-- lombok -->
        <dependency>
            <groupId>org.projectlombok</groupId>
            <artifactId>lombok</artifactId>
        </dependency>
        <!-- 实现对数据库连接池的自动化配置 -->
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-jdbc</artifactId>
        </dependency>
        <dependency> <!-- 本示例，我们使用 MySQL -->
            <groupId>mysql</groupId>
            <artifactId>mysql-connector-java</artifactId>
            <version>5.1.48</version>
        </dependency>

        <!--操作Redis-->
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-data-redis</artifactId>
        </dependency>

        <dependency>
            <groupId>com.alibaba</groupId>
            <artifactId>fastjson</artifactId>
        </dependency>

        <!-- 方便等会写单元测试 -->
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-test</artifactId>
            <scope>test</scope>
        </dependency>
    </dependencies>

</project>