栏目分类:
子分类:
返回
名师互学网用户登录
快速导航关闭
当前搜索
当前分类
子分类
实用工具
热门搜索
名师互学网 > IT > 软件开发 > 后端开发 > Java

使用注解搞定 Spring Boot 接口恶意刷新和暴力请求!

Java 更新时间: 发布时间: IT归档 最新发布 模块sitemap 名妆网 法律咨询 聚返吧 英语巴士网 伯小乐 网商动力

使用注解搞定 Spring Boot 接口恶意刷新和暴力请求!

  1. 首先是写一个注解类:
  2. 接着就是在Interceptor拦截器中实现:
  3. 再把Interceptor注册到springboot中
  4. 接着在Controller中加入注解

1.首先是写一个注解类

import java.lang.annotation.Retention;
import java.lang.annotation.Target;

import static java.lang.annotation.ElementType.METHOD;
import static java.lang.annotation.RetentionPolicy.RUNTIME;

@Retention(RUNTIME)
@Target(METHOD)
public @interface AccessLimit {

    int seconds();
    int maxCount();
    boolean needLogin()default true;
    
}
  1. 接着就是在Interceptor拦截器中实现《reids方法可自行封装》
import cn.tolin.springboot.lab1.eum.AccessLimit;
import cn.tolin.springboot.lab1.res.R;
import com.alibaba.fastjson.JSON;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.data.redis.core.StringRedisTemplate;
import org.springframework.stereotype.Component;
import org.springframework.web.method.HandlerMethod;
import org.springframework.web.servlet.handler.HandlerInterceptorAdapter;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.OutputStream;
import java.util.concurrent.TimeUnit;

@Component
public class FangshuaInterceptor extends HandlerInterceptorAdapter {

    @Autowired
        private StringRedisTemplate redisTemplate;

    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
        //判断请求是否属于方法的请求
        if(handler instanceof HandlerMethod){
            HandlerMethod hm = (HandlerMethod) handler;
            //获取方法中的注解,看是否有该注解
            AccessLimit accessLimit = hm.getMethodAnnotation(AccessLimit.class);
            if(accessLimit == null){
                return true;
            }
            int seconds = accessLimit.seconds();
            int maxCount = accessLimit.maxCount();
            boolean login = accessLimit.needLogin();
            String key = request.getRequestURI();
            //如果需要登录
            if (login){
                //获取登录的session进行判断
                //.....
                key+=""+"kou";  //这里假设用户是kou,项目中是动态获取的userId
            }

            //从redis中获取用户访问的次数
           // AccessKey ak = AccessKey.withExpire(seconds);
            //Integer count = redisService.get(ak,key,Integer.class);

            String s = redisTemplate.opsForValue().get(key);
            if (s == null){
                //第一次访问
                //redisService.set(ak,key,1);
                redisTemplate.opsForValue().set(key, "1", seconds, TimeUnit.SECONDS);
            } else if (Integer.valueOf(s) < maxCount){
                //加1
               // redisService.incr(ak,key);
                redisTemplate.boundValueOps(key).increment(1);
            } else {
                //超出访问次数
                render(response); //这里的CodeMsg是一个返回参数
                return false;
            }
        }
        return true;
    }
    
    private void render(HttpServletResponse response)throws Exception {
        response.setContentType("application/json;charset=UTF-8");
        OutputStream out = response.getOutputStream();
        String str  = JSON.toJSONString(R.error());
        out.write(str.getBytes("UTF-8"));
        out.flush();
        out.close();
    }
    
}
  1. 再把Interceptor注册到springboot中
package cn.tolin.springboot.lab1.config;

import cn.tolin.springboot.lab1.interceptor.FangshuaInterceptor;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurerAdapter;

@Configuration
public class FangshuaConfig extends WebMvcConfigurerAdapter {

    @Autowired
    private FangshuaInterceptor interceptor;


    @Override
    public void addInterceptors(InterceptorRegistry registry) {
        registry.addInterceptor(interceptor);
    }
    
}
  1. 接着在Controller中加入注解
import cn.tolin.springboot.lab1.eum.AccessLimit;
import cn.tolin.springboot.lab1.res.R;
import cn.tolin.springboot.lab1.server.UserServer;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;

@RestController
@RequestMapping("/usr")
public class UserController {
    @Autowired
    private UserServer userServer;


    @RequestMapping("/list")
    @AccessLimit(seconds = 5, maxCount = 5, needLogin = true)
    public R list()  {
        return  userServer.list();
    }
}

配置

spring:
  # datasource 数据源配置内容
  datasource:
    url: jdbc:mysql://172.29.67.66:3306/demo?useSSL=false&useUnicode=true&characterEncoding=UTF-8
    driver-class-name: com.mysql.jdbc.Driver
    username: root
    password: 秘密
  profiles:
    active: dev
  redis:
    port: 6379
    host: 192.168.118.128

# mybatis-plus 配置内容
mybatis-plus:
  configuration:
    map-underscore-to-camel-case: true # 虽然默认为 true ,但是还是显示去指定下。
  global-config:
    db-config:
      id-type: auto # ID 主键自增
      logic-delete-value: 1 # 逻辑已删除值(默认为 1)
      logic-not-delete-value: 0 # 逻辑未删除值(默认为 0)
  mapper-locations: classpath*:mapper/*.xml
  type-aliases-package: cn.tolin.springboot.lab1.domain

# logging
logging:
  level:
    # dao 开启 debug 模式 mybatis 输入 sql
    cn:
      linxj:
        lab01:
          mapper: debug


依赖



    
        lab-1-mybatis
        cn.tolin.springboot.labs
        1.0.0
    
    4.0.0

    lab-1-mybatis-plus

    

        
            org.springframework.boot
            spring-boot-starter-web
        

        
        
            com.baomidou
            mybatis-plus-boot-starter
            3.0.5
        
        
        
            org.projectlombok
            lombok
        
        
        
            org.springframework.boot
            spring-boot-starter-jdbc
        
         
            mysql
            mysql-connector-java
            5.1.48
        

        
        
            org.springframework.boot
            spring-boot-starter-data-redis
        

        
            com.alibaba
            fastjson
        

        
        
            org.springframework.boot
            spring-boot-starter-test
            test
        
    


转载请注明:文章转载自 www.mshxw.com
本文地址:https://www.mshxw.com/it/1031150.html
我们一直用心在做
关于我们 文章归档 网站地图 联系我们

版权所有 (c)2021-2022 MSHXW.COM

ICP备案号:晋ICP备2021003244-6号