Spring Boot 实现 IP 限流(保障系统稳定性的关键技术)

<dependencies>
    <dependency>
        <groupid>org.springframework.boot</groupid>
        <artifactid>spring-boot-starter-web</artifactid>
    </dependency>
    <dependency>
        <groupid>com.google.guava</groupid>
        <artifactid>guava</artifactid>
        <version>31.1-jre</version>
    </dependency>
</dependencies>

import com.google.common.cache.cachebuilder;
import com.google.common.cache.cacheloader;
import com.google.common.cache.loadingcache;
import com.google.common.util.concurrent.ratelimiter;
import org.slf4j.logger;
import org.slf4j.loggerfactory;
import org.springframework.beans.factory.annotation.value;
import org.springframework.stereotype.service;
import java.util.concurrent.timeunit;
@service
public class ratelimiterservice {
    private static final logger logger = loggerfactory.getlogger(ratelimiterservice.class);
    @value("${rate.limit.permitspersecond:10}") // 默认值 10
    private double permitspersecond;
    // 使用 loadingcache 缓存每个 ip 的 ratelimiter
    private final loadingcache<string, ratelimiter> ratelimitercache = cachebuilder.newbuilder()
            .expireafterwrite(1, timeunit.minutes) // 缓存 1 分钟
            .build(new cacheloader<string, ratelimiter>() {
                @override
                public ratelimiter load(string ip) {
                    logger.info("creating ratelimiter for ip: {}, rate: {}", ip, permitspersecond);
                    return ratelimiter.create(permitspersecond);
                }
            });
    /**
     * 尝试获取令牌
     * @param ip 客户端 ip 地址
     * @return true: 允许访问, false: 限流
     */
    public boolean tryacquire(string ip) {
        ratelimiter ratelimiter = ratelimitercache.getunchecked(ip);
        return ratelimiter.tryacquire();
    }
}

import org.slf4j.logger;
import org.slf4j.loggerfactory;
import org.springframework.beans.factory.annotation.autowired;
import org.springframework.beans.factory.annotation.value;
import org.springframework.stereotype.component;
import org.springframework.web.filter.onceperrequestfilter;
import jakarta.servlet.filterchain;
import jakarta.servlet.servletexception;
import jakarta.servlet.http.httpservletrequest;
import jakarta.servlet.http.httpservletresponse;
import java.io.ioexception;
@component
public class ipratelimitfilter extends onceperrequestfilter {
    private static final logger logger = loggerfactory.getlogger(ipratelimitfilter.class);
    @autowired
    private ratelimiterservice ratelimiterservice;
    @value("${rate.limit.enabled:true}")
    private boolean ratelimitenabled;
    @value("${rate.limit.excludepatterns:}") // 排除的url，用逗号分隔
    private string excludepatterns;
    @override
    protected void dofilterinternal(httpservletrequest request, httpservletresponse response, filterchain filterchain)
            throws servletexception, ioexception {
        if (!ratelimitenabled) {
            filterchain.dofilter(request, response);
            return; // 如果禁用限流，直接放行
        }
        // 排除不需要限流的url
        string requesturi = request.getrequesturi();
        if (excludepatterns != null && !excludepatterns.isempty()) {
             string[] patterns = excludepatterns.split(",");
             for (string pattern : patterns) {
                if (requesturi.startswith(pattern.trim())) {
                    filterchain.dofilter(request, response);
                    return;
                 }
             }
        }
        string clientip = getclientip(request);
        if (ratelimiterservice.tryacquire(clientip)) {
            filterchain.dofilter(request, response); // 允许访问
        } else {
            logger.warn("rate limit exceeded for ip: {}", clientip);
            response.setstatus(httpservletresponse.sc_too_many_requests);
            response.getwriter().write("too many requests from this ip.");
        }
    }
    private string getclientip(httpservletrequest request) {
        string xffheader = request.getheader("x-forwarded-for");
        if (xffheader == null) {
            return request.getremoteaddr();
        }
        return xffheader.split(",")[0];
    }
}

import org.springframework.boot.web.servlet.filterregistrationbean;
import org.springframework.context.annotation.bean;
import org.springframework.context.annotation.configuration;
@configuration
public class filterconfig {
    @bean
    public filterregistrationbean<ipratelimitfilter> ipratelimitfilterregistration(ipratelimitfilter ipratelimitfilter) {
        filterregistrationbean<ipratelimitfilter> registration = new filterregistrationbean<>();
        registration.setfilter(ipratelimitfilter);
        registration.addurlpatterns("/*"); // 对所有请求进行限流
        registration.setorder(1);
        return registration;
    }
}

import org.springframework.web.bind.annotation.getmapping;
import org.springframework.web.bind.annotation.restcontroller;
@restcontroller
public class testcontroller {
    @getmapping("/test")
    public string test() {
        return "hello, this is a test api.";
    }
}

# 限流配置
rate.limit.enabled=true
rate.limit.permitspersecond=10
rate.limit.excludepatterns=/health,/metrics # 排除的url

import org.springframework.http.httpstatus;
import org.springframework.stereotype.component;
import org.springframework.web.servlet.handlerinterceptor;
import jakarta.servlet.http.httpservletrequest;
import jakarta.servlet.http.httpservletresponse;
import java.util.map;
import java.util.concurrent.concurrenthashmap;
import java.util.concurrent.atomic.atomicinteger;
@component
public class iprequestratelimiter implements handlerinterceptor {
    private final int request_limit = 10;  // 每秒最大请求数
    private final map<string, atomicinteger> requestcountsperip = new concurrenthashmap<>();
    @override
    public boolean prehandle(httpservletrequest request, httpservletresponse response, object handler) throws exception {
        string ipaddress = request.getremoteaddr();
        // 1. 初始化计数器
        requestcountsperip.computeifabsent(ipaddress, k -> new atomicinteger(0));
        // 2. 检查请求是否超限
        if (requestcountsperip.get(ipaddress).incrementandget() > request_limit) {
            response.setstatus(httpstatus.too_many_requests.value());
            response.getwriter().write("too many requests from this ip. please try again later.");
            return false; // 阻止请求
        }
        return true; // 允许请求
    }
    @override
    public void aftercompletion(httpservletrequest request, httpservletresponse response, object handler, exception ex) throws exception {
        string ipaddress = request.getremoteaddr();
        // 3. 请求完成后，减少计数
        requestcountsperip.get(ipaddress).decrementandget();
    }
}