秒杀项目07-安全优化

1. 秒杀接口地址隐藏
- 1.1 接口改造，带上PathVariable参数
- 1.2 添加生成地址的接口
- 1.3 秒杀收到请求，先验证PathVariable
2. 数学公式验证码
- 2.1. 添加生成验证码的接口
- 2.2. 在获取秒杀路径的时候，验证验证码
- 2.3 scriptEngine使用
3. 接口限流防刷
- 3.1 可以用拦截器减少业务侵入
- - 编写注解类
  - 使用ThreadLocal存储线程局部变量
  - 编写拦截器
  - 给秒杀接口方法添加限流注解

1. 秒杀接口地址隐藏

思路: 秒杀开始之前，先去请求接口获取秒杀地址

1.1 接口改造，带上PathVariable参数 1.2 添加生成地址的接口 1.3 秒杀收到请求，先验证PathVariable

MiaoshaController.java

	@RequestMapping("/miaosha")
	@Controller
	public class MiaoshaController implements InitializingBean {


	//@AccessLimit(seconds=5, maxCount=5, needLogin=true)
    @RequestMapping(value="/path", method=RequestMethod.GET)
    @ResponseBody
    public Result getMiaoshaPath(HttpServletRequest request, MiaoshaUser user,
                                         @RequestParam("goodsId")long goodsId,
                                         @RequestParam(value="verifyCode", defaultValue="0")int verifyCode
    ) {
        if(user == null) {
            return Result.fail(CodeMsg.SESSION_ERROR);
        }
        
        String path  =miaoshaService.createMiaoshaPath(user, goodsId);
        return Result.success(path);
    }
	
    
    @RequestMapping(value="/{path}/do_miaosha", method=RequestMethod.POST)
    @ResponseBody
    public Result miaosha(Model model,MiaoshaUser user,
                                   @RequestParam("goodsId")long goodsId,
                                   @PathVariable("path") String path) {
        model.addAttribute("user", user);
        if(user == null) {
            return Result.fail(CodeMsg.SESSION_ERROR);
        }
        //验证path
        boolean check = miaoshaService.checkPath(user, goodsId, path);
        if(!check){
            return Result.fail(CodeMsg.REQUEST_ILLEGAL);
        }
        //内存标记，减少redis访问
        boolean over = localOverMap.get(goodsId);
        if(over) {
            return Result.fail(CodeMsg.MIAO_SHA_OVER);
        }
        //预减库存
        long stock = redisService.decr(GoodsKey.getMiaoshaGoodsStock, ""+goodsId);//10
        if(stock < 0) {
            localOverMap.put(goodsId, true);
            return Result.fail(CodeMsg.MIAO_SHA_OVER);
        }
        //判断是否已经秒杀到了
        MiaoshaOrder order = orderService.getMiaoshaOrderByUserIdGoodsId(user.getId(), goodsId);
        if(order != null) {
            return Result.fail(CodeMsg.REPEAT_MIAOSHA);
        }
        //入队
        MiaoshaMessage mm = new MiaoshaMessage();
        mm.setUser(user);
        mm.setGoodsId(goodsId);
        sender.sendMiaoshaMessage(mm);
        return Result.success(0);//排队中
    }

}

goods_detail.html




    商品详情
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    




  秒杀商品详情
  
  	 您还没有登录，请登陆后再操作

  	没有收货地址的提示。。。
  
  
  	  
        商品名称  
        
       
       
        商品图片  
        
     
       
        秒杀开始时间  
        
        
        	
        	
        
        
        	
            
            

        
     
       
        商品原价  
        
     
        
        秒杀价  
        
     
       
        库存数量

2. 数学公式验证码

思路: 点击秒杀之前，先输入验证码，分散用户的请求

2.1. 添加生成验证码的接口 2.2. 在获取秒杀路径的时候，验证验证码 2.3 scriptEngine使用

MiaoshaController.java

package com.hmx.miaosha.controller;

import com.hmx.miaosha.domain.MiaoshaOrder;
import com.hmx.miaosha.domain.MiaoshaUser;
import com.hmx.miaosha.domain.OrderInfo;
import com.hmx.miaosha.rabbitmq.MQSender;
import com.hmx.miaosha.rabbitmq.MiaoshaMessage;
import com.hmx.miaosha.redis.GoodsKey;
import com.hmx.miaosha.redis.MiaoshaKey;
import com.hmx.miaosha.redis.OrderKey;
import com.hmx.miaosha.redis.RedisService;
import com.hmx.miaosha.result.CodeMsg;
import com.hmx.miaosha.result.Result;
import com.hmx.miaosha.service.GoodsService;
import com.hmx.miaosha.service.MiaoshaService;
import com.hmx.miaosha.service.OrderService;
import com.hmx.miaosha.vo.GoodsVo;
import org.springframework.beans.factory.InitializingBean;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Controller;
import org.springframework.ui.Model;
import org.springframework.web.bind.annotation.*;

import javax.imageio.ImageIO;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.awt.image.BufferedImage;
import java.io.OutputStream;
import java.util.HashMap;
import java.util.List;
import java.util.Map;



@RequestMapping("/miaosha")
@Controller
public class MiaoshaController implements InitializingBean {

    //@AccessLimit(seconds=5, maxCount=5, needLogin=true)
    @RequestMapping(value="/path", method=RequestMethod.GET)
    @ResponseBody
    public Result getMiaoshaPath(HttpServletRequest request, MiaoshaUser user,
                                         @RequestParam("goodsId")long goodsId,
                                         @RequestParam(value="verifyCode", defaultValue="0")int verifyCode
    ) {
        if(user == null) {
            return Result.fail(CodeMsg.SESSION_ERROR);
        }
        boolean check = miaoshaService.checkVerifyCode(user, goodsId, verifyCode);
        if(!check) {
            return Result.fail(CodeMsg.REQUEST_ILLEGAL);
        }
        String path  =miaoshaService.createMiaoshaPath(user, goodsId);
        return Result.success(path);
    }

    @RequestMapping(value="/verifyCode", method=RequestMethod.GET)
    @ResponseBody
    public Result getMiaoshaVerifyCod(HttpServletResponse response, MiaoshaUser user,
                                              @RequestParam("goodsId")long goodsId) {
        if(user == null) {
            return Result.fail(CodeMsg.SESSION_ERROR);
        }
        try {
            BufferedImage image  = miaoshaService.createVerifyCode(user, goodsId);
            OutputStream out = response.getOutputStream();
            ImageIO.write(image, "JPEG", out);
            out.flush();
            out.close();
            return null;
        }catch(Exception e) {
            e.printStackTrace();
            return Result.fail(CodeMsg.MIAOSHA_FAIL);
        }
    }
}

MiaoshaService.java

@Service
public class MiaoshaService {


    public BufferedImage createVerifyCode(MiaoshaUser user, long goodsId) {
        if(user == null || goodsId <=0) {
            return null;
        }
        int width = 80;
        int height = 32;
        //create the image
        BufferedImage image = new BufferedImage(width, height, BufferedImage.TYPE_INT_RGB);
        Graphics g = image.getGraphics();
        // set the background color
        g.setColor(new Color(0xDCDCDC));
        g.fillRect(0, 0, width, height);
        // draw the border
        g.setColor(Color.black);
        g.drawRect(0, 0, width - 1, height - 1);
        // create a random instance to generate the codes
        Random rdm = new Random();
        // make some confusion
        for (int i = 0; i < 50; i++) {
            int x = rdm.nextInt(width);
            int y = rdm.nextInt(height);
            g.drawOval(x, y, 0, 0);
        }
        // generate a random code
        String verifyCode = generateVerifyCode(rdm);
        g.setColor(new Color(0, 100, 0));
        g.setFont(new Font("Candara", Font.BOLD, 24));
        g.drawString(verifyCode, 8, 24);
        g.dispose();
        //把验证码存到redis中
        int rnd = calc(verifyCode);
        redisService.set(MiaoshaKey.getMiaoshaVerifyCode, user.getId()+","+goodsId, rnd);
        //输出图片
        return image;
    }

    public boolean checkVerifyCode(MiaoshaUser user, long goodsId, int verifyCode) {
        if(user == null || goodsId <=0) {
            return false;
        }
        Integer codeOld = redisService.get(MiaoshaKey.getMiaoshaVerifyCode, user.getId()+","+goodsId, Integer.class);
        if(codeOld == null || codeOld - verifyCode != 0 ) {
            return false;
        }
        redisService.delete(MiaoshaKey.getMiaoshaVerifyCode, user.getId()+","+goodsId);
        return true;
    }

    private static int calc(String exp) {
        try {
            scriptEngineManager manager = new scriptEngineManager();
            scriptEngine engine = manager.getEngineByName("Javascript");
            return (Integer)engine.eval(exp);
        }catch(Exception e) {
            e.printStackTrace();
            return 0;
        }
    }

    private static char[] ops = new char[] {'+', '-', '*'};
    
    private String generateVerifyCode(Random rdm) {
        int num1 = rdm.nextInt(10);
        int num2 = rdm.nextInt(10);
        int num3 = rdm.nextInt(10);
        char op1 = ops[rdm.nextInt(3)];
        char op2 = ops[rdm.nextInt(3)];
        return ""+ num1 + op1 + num2 + op2 + num3;
    }
}

Goods_detail.html




    商品详情
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    




  秒杀商品详情
  
  	 您还没有登录，请登陆后再操作

  	没有收货地址的提示。。。
  
  
  	  
        商品名称  
        
       
       
        商品图片  
        
     
       
        秒杀开始时间  
        
        
        	
        	
        
        
            
                
                    
                    
                    
                
            
            

        
     
       
        商品原价  
        
     
        
        秒杀价  
        
     
       
        库存数量

3. 接口限流防刷 3.1 可以用拦截器减少业务侵入编写注解类

AccessLimit.java

@Retention(RUNTIME)
@Target(METHOD)
public @interface AccessLimit {
	int seconds();
	int maxCount();
	boolean needLogin() default true;
}

使用ThreadLocal存储线程局部变量

UserContext.java

public class UserContext {
	
	private static final ThreadLocal userHolder = new ThreadLocal<>();

	public static void setUser(MiaoshaUser user) {
		userHolder.set(user);
	}

	public static MiaoshaUser getUser() {
		return userHolder.get();
	}

}

编写拦截器

AccessInterceptor.java

@Service
public class AccessInterceptor implements HandlerInterceptor {
	
	@Autowired
	MiaoshaUserService userService;
	
	@Autowired
	RedisService redisService;
	
	@Override
	public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler)
			throws Exception {
		if(handler instanceof HandlerMethod) {
			HandlerMethod hm = (HandlerMethod)handler;
			AccessLimit accessLimit = hm.getMethodAnnotation(AccessLimit.class);
			if(accessLimit == null) {
				return true;
			}
			MiaoshaUser user = getUser(request, response);
			UserContext.setUser(user);
			int seconds = accessLimit.seconds();
			int maxCount = accessLimit.maxCount();
			boolean needLogin = accessLimit.needLogin();
			String key = request.getRequestURI();
			if(needLogin) {
				if(user == null) {
					render(response, CodeMsg.SESSION_ERROR);
					return false;
				}
				key += "_" + user.getId();
			}else {
				//do nothing
			}
			AccessKey ak = AccessKey.withExpire(seconds);
			Integer count = redisService.get(ak, key, Integer.class);
	    	if(count  == null) {
	    		 redisService.set(ak, key, 1);
	    	}else if(count < maxCount) {
	    		 redisService.incr(ak, key);
	    	}else {
	    		render(response, CodeMsg.ACCESS_LIMIT_REACHED);
	    		return false;
	    	}
		}
		return true;
	}
	
	private void render(HttpServletResponse response, CodeMsg cm)throws Exception {
		response.setContentType("application/json;charset=UTF-8");
		OutputStream out = response.getOutputStream();
		String str  = JSON.toJSONString(Result.fail(cm));
		out.write(str.getBytes("UTF-8"));
		out.flush();
		out.close();
	}

	private MiaoshaUser getUser(HttpServletRequest request, HttpServletResponse response) {
		String paramToken = request.getParameter(MiaoshaUserService.cookie_NAME_TOKEN);
		String cookieToken = getcookievalue(request, MiaoshaUserService.cookie_NAME_TOKEN);
		if(StringUtils.isEmpty(cookieToken) && StringUtils.isEmpty(paramToken)) {
			return null;
		}
		String token = StringUtils.isEmpty(paramToken)?cookieToken:paramToken;
		return userService.getByToken(response, token);
	}
	
	private String getcookievalue(HttpServletRequest request, String cookiName) {
		cookie[]  cookies = request.getcookies();
		if(cookies == null || cookies.length <= 0){
			return null;
		}
		for(cookie cookie : cookies) {
			if(cookie.getName().equals(cookiName)) {
				return cookie.getValue();
			}
		}
		return null;
	}
	
}

给秒杀接口方法添加限流注解

MiaoshaController.java

	@AccessLimit(seconds=5, maxCount=5, needLogin=true)
    @RequestMapping(value="/path", method=RequestMethod.GET)
    @ResponseBody
    public Result getMiaoshaPath(MiaoshaUser user,
                                         @RequestParam("goodsId")long goodsId,
                                         @RequestParam(value="verifyCode", defaultValue="0")int verifyCode
    ) {
        if(user == null) {
            return Result.fail(CodeMsg.SESSION_ERROR);
        }
        boolean check = miaoshaService.checkVerifyCode(user, goodsId, verifyCode);
        if(!check) {
            return Result.fail(CodeMsg.REQUEST_ILLEGAL);
        }
        String path  =miaoshaService.createMiaoshaPath(user, goodsId);
        return Result.success(path);
    }

商品名称
商品图片
秒杀开始时间
商品原价
秒杀价
库存数量

秒杀项目07-安全优化

Java相关栏目本月热门文章