Five solutions for SpringBoot to implement interface flash prevention

@Target({})
@Retention()
@Documented
public @interface RateLimit {
    /**
      * Limited time period, unit in seconds
      */
    int time() default 60;
    
    /**
      * Maximum number of requests allowed in the limited time period
      */
    int count() default 10;
    
    /**
      * Current-limited key, supports SpEL expressions
      */
    String key() default "";
    
    /**
      * Prompt message
      */
    String message() default "The operation is too frequent, please try again later";
}

@Aspect
@Component
@Slf4j
public class RateLimitAspect {
    
    @Autowired
    private StringRedisTemplate redisTemplate;
    
    @Around("@annotation(rateLimit)")
    public Object around(ProceedingJoinPoint pjp, RateLimit rateLimit) throws Throwable {
        // Get the method name of the request        String methodName = ().getName();
        // Get the requested class name        String className = ().getClass().getName();
        
        // Combined current limit key        String limitKey = getLimitKey(pjp, rateLimit, methodName, className);
        
        // Get current limiting parameters        int time = ();
        int count = ();
        
        // Execute current limiting logic        boolean limited = isLimited(limitKey, time, count);
        if (limited) {
            throw new RuntimeException(());
        }
        
        // Execute the target method        return ();
    }
    
    private String getLimitKey(ProceedingJoinPoint pjp, RateLimit rateLimit, String methodName, String className) {
        // Get user-defined key        String key = ();
        
        if ((key)) {
            // Support SpEL expression parsing            StandardEvaluationContext context = new StandardEvaluationContext();
            MethodSignature signature = (MethodSignature) ();
            String[] parameterNames = ();
            Object[] args = ();
            
            for (int i = 0; i < ; i++) {
                (parameterNames[i], args[i]);
            }
            
            ExpressionParser parser = new SpelExpressionParser();
            Expression expression = (key);
            key = (context, );
        } else {
            // Use class name + method name + IP address as key by default            HttpServletRequest request = ((ServletRequestAttributes) ()).getRequest();
            String ip = getIpAddress(request);
            key = ip + ":" + className + ":" + methodName;
        }
        
        return "rate_limit:" + key;
    }
    
    private boolean isLimited(String key, int time, int count) {
        // Use Redis' counter to achieve current limit        try {
            Long currentCount = ().increment(key, 1);
            
            // If it is the first time you access it, set the expiration time            if (currentCount == 1) {
                (key, time, );
            }
            
            return currentCount > count;
        } catch (Exception e) {
            ("current limit exception", e);
            return false;
        }
    }
    
    private String getIpAddress(HttpServletRequest request) {
        String ip = ("X-Forwarded-For");
        if (ip == null || () == 0 || "unknown".equalsIgnoreCase(ip)) {
            ip = ("Proxy-Client-IP");
        }
        if (ip == null || () == 0 || "unknown".equalsIgnoreCase(ip)) {
            ip = ("WL-Proxy-Client-IP");
        }
        if (ip == null || () == 0 || "unknown".equalsIgnoreCase(ip)) {
            ip = ("HTTP_CLIENT_IP");
        }
        if (ip == null || () == 0 || "unknown".equalsIgnoreCase(ip)) {
            ip = ("HTTP_X_FORWARDED_FOR");
        }
        if (ip == null || () == 0 || "unknown".equalsIgnoreCase(ip)) {
            ip = ();
        }
        return ip;
    }
}

@RestController
@RequestMapping("/api")
public class UserController {
    
    @RateLimit(time = 60, count = 3, message = "Requests are too frequent, please try again later")
    @GetMapping("/user/{id}")
    public User getUser(@PathVariable Long id) {
        return (id);
    }
    
    // Specify key using SpEL expression    @RateLimit(time = 60, count = 1, key = "#id + '_' + #")
    @PostMapping("/user/{id}/update")
    public Result updateUser(@PathVariable Long id, @RequestBody UserDTO userDTO, HttpServletRequest request) {
        return (id, userDTO);
    }
}

<dependency>
    <groupId></groupId>
    <artifactId>guava</artifactId>
    <version>31.1-jre</version>
</dependency>

@Component
public class RateLimiter {
    // Use ConcurrentHashMap to store token buckets for different interfaces    private final ConcurrentHashMap<String, > rateLimiterMap = new ConcurrentHashMap<>();
    
    /**
      * Get the token bucket for a specific interface, if it does not exist, it will be created.
      * @param key Current limit key
      * @param permitsPerSecond The amount of requests allowed per second
      * @return Token bucket instance
      */
    public  getRateLimiter(String key, double permitsPerSecond) {
        return (key, 
            k -> (permitsPerSecond));
    }
    
    /**
      * Try to get the token
      * @param key Current limit key
      * @param permitsPerSecond The amount of requests allowed per second
      * @param timeout timeout
      * @param unit time unit
      * @return Whether it is successful
      */
    public boolean tryAcquire(String key, double permitsPerSecond, long timeout, TimeUnit unit) {
         rateLimiter = getRateLimiter(key, permitsPerSecond);
        return (1, timeout, unit);
    }
}

@Component
public class TokenBucketInterceptor implements HandlerInterceptor {
    
    @Autowired
    private RateLimiter rateLimiter;
    
    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
        // Only limit the current to API requests        String requestURI = ();
        if (!("/api/")) {
            return true;
        }
        
        // Get the IP address as the current limit key        String ip = getIpAddress(request);
        String key = ip + ":" + requestURI;
        
        // Try to get the token, set the rate of 2 requests per second, and wait for 100 milliseconds        boolean acquired = (key, 2.0, 100, );
        
        if (!acquired) {
            // Failed to obtain, return the current limit response            ("application/json;charset=UTF-8");
            (HttpStatus.TOO_MANY_REQUESTS.value());
            ().write("{"code":429,"message":"Requests are too frequent, please try again later"}");
            return false;
        }
        
        return true;
    }
    
    // getIpAddress method is the same as above}

@Configuration
public class WebConfig implements WebMvcConfigurer {
    
    @Autowired
    private TokenBucketInterceptor tokenBucketInterceptor;
    
    @Override
    public void addInterceptors(InterceptorRegistry registry) {
        (tokenBucketInterceptor)
                .addPathPatterns("/**");
    }
}

-- Current limitKey
local key = KEYS[1]
-- Current limit窗口，Unit seconds
local window = tonumber(ARGV[1])
-- Current limit阈值
local threshold = tonumber(ARGV[2])
-- Current timestamp
local now = tonumber(ARGV[3])

-- Remove expired request history
('ZREMRANGEBYSCORE', key, 0, now - window * 1000)

-- Get the number of requests in the current window
local count = ('ZCARD', key)

-- If the number of requests exceeds the threshold，Reject request
if count >= threshold then
    return 0
end

-- Add the current request record
('ZADD', key, now, now .. '-' .. ())
-- Set expiration time
('EXPIRE', key, window)

-- Returns the remaining number of available requests in the current window
return threshold - count - 1

@Service
@Slf4j
public class RedisRateLimiterService {
    
    @Autowired
    private StringRedisTemplate redisTemplate;
    
    private DefaultRedisScript<Long> rateLimiterScript;
    
    @PostConstruct
    public void init() {
        // Load Lua script        rateLimiterScript = new DefaultRedisScript<>();
        (new ClassPathResource("scripts/rate_limiter.lua"));
        ();
    }
    
    /**
      * Try to obtain access
      * @param key Current limit key
      * @param window time window (seconds)
      * @param threshold
      * @return The remaining number of available requests, -1 means that the current limit is
      */
    public long isAllowed(String key, int window, int threshold) {
        try {
            // Execute lua script            List<String> keys = (key);
            Long remainingCount = (
                rateLimiterScript, 
                keys, 
                (window), 
                (threshold),
                (())
            );
            
            return remainingCount == null ? -1 : remainingCount;
        } catch (Exception e) {
            ("Redis rate limiter error", e);
            // Release request when an exception occurs            return threshold;
        }
    }
}

@Target({})
@Retention()
@Documented
public @interface DistributedRateLimit {
    /**
      * Current limit key prefix
      */
    String prefix() default "rate:";
    
    /**
      * Time window, unit seconds
      */
    int window() default 60;
    
    /**
      * Maximum number of requests allowed in the time window
      */
    int threshold() default 10;
    
    /**
      * Current limit mode: ip - current limit by IP, user - current limit by user, all - overall interface current limit
      */
    String mode() default "ip";
}

@Aspect
@Component
@Slf4j
public class DistributedRateLimitAspect {
    
    @Autowired
    private RedisRateLimiterService rateLimiterService;
    
    @Autowired(required = false)
    private HttpServletRequest request;
    
    @Around("@annotation(rateLimit)")
    public Object around(ProceedingJoinPoint pjp, DistributedRateLimit rateLimit) throws Throwable {
        String key = generateKey(pjp, rateLimit);
        
        long remainingCount = (
            key, 
            (), 
            ()
        );
        
        if (remainingCount < 0) {
            throw new RuntimeException("The interface is accessed too frequently, please try again later");
        }
        
        // Execute the target method        return ();
    }
    
    private String generateKey(ProceedingJoinPoint pjp, DistributedRateLimit rateLimit) {
        String methodName = ().getName();
        String className = ().getClass().getName();
        StringBuilder key = new StringBuilder(());
        
        (className).append(".").append(methodName);
        
        // Add different suffixes according to the current limit mode        switch (()) {
            case "ip":
                // Limit current by IP                (":").append(getIpAddress());
                break;
            case "user":
                // Limit the current by user                Object userId = getUserId();
                (":").append(userId != null ? userId : "anonymous");
                break;
            case "all":
                // The interface is generally limited in current, without adding suffixes                break;
            default:
                (":").append(getIpAddress());
                break;
        }
        
        return ();
    }
    
    private String getIpAddress() {
        // IP acquisition method is the same as above        if (request == null) {
            return "unknown";
        }
        // The code to get the IP is the same as the previous example        return "127.0.0.1"; // Simplify processing    }
    
    // Get the current user ID and implement it according to the actual authentication system    private Object getUserId() {
        // Here is a simplified process, which should be obtained from the authentication information in practice.        // For example: ().getAuthentication().getPrincipal()        return null;
    }
}

@RestController
@RequestMapping("/api")
public class PaymentController {
    
    @DistributedRateLimit(prefix = "pay:", window = 3600, threshold = 5, mode = "user")
    @PostMapping("/payment")
    public Result createPayment(@RequestBody PaymentRequest paymentRequest) {
        // Create payment business logic        return (paymentRequest);
    }
    
    @DistributedRateLimit(window = 60, threshold = 30, mode = "ip")
    @GetMapping("/products")
    public List<Product> getProducts() {
        // Query product list        return ();
    }
    
    @DistributedRateLimit(window = 1, threshold = 100, mode = "all")
    @GetMapping("/hot/resource")
    public Resource getHotResource() {
        // Get popular resources        return ();
    }
}

<dependency>
    <groupId></groupId>
    <artifactId>spring-cloud-starter-alibaba-sentinel</artifactId>
    <version>2021.0.4.0</version>
</dependency>

# Sentinel console address=localhost:8080
# Cancel Sentinel console lazy loading=true
# Application name=my-application

@Configuration
public class SentinelConfig {
    
    @Bean
    public SentinelResourceAspect sentinelResourceAspect() {
        return new SentinelResourceAspect();
    }
    
    @PostConstruct
    public void init() {
        // Define flow control rules        initFlowRules();
    }
    
    private void initFlowRules() {
        List<FlowRule> rules = new ArrayList<>();
        
        // Set flow control rules for /api/user interface        FlowRule userRule = new FlowRule();
        ("/api/user");
        (RuleConstant.FLOW_GRADE_QPS); // Current limit based on QPS        (10); // 10 requests per second        (userRule);
        
        // Set flow control rules for /api/order interface        FlowRule orderRule = new FlowRule();
        ("/api/order");
        (RuleConstant.FLOW_GRADE_QPS);
        (5); // 5 requests per second        (RuleConstant.CONTROL_BEHAVIOR_WARM_UP); // Preheat mode        (10); // 10 seconds warm-up period        (orderRule);
        
        // Loading rules        (rules);
    }
}

@Component
public class UrlCleaner implements RequestOriginParser {
    
    @Override
    public String parseOrigin(HttpServletRequest request) {
        // Get the URL path to the request        String path = ();
        
        // More complex parsing logic can be added, for example:        // 1. Remove path variables: /api/user/123 -> /api/user/{id}        // 2. Add the request method prefix: GET:/api/user        
        return path;
    }
}

@RestControllerAdvice
public class SentinelExceptionHandler {
    
    @ExceptionHandler()
    public Result handleBlockException(BlockException e) {
        String message = "Requests are too frequent, please try again later";
        if (e instanceof FlowException) {
            message = "Interface current limit:" + message;
        } else if (e instanceof DegradeException) {
            message = "Service downgrade: The system is busy, please try again later";
        } else if (e instanceof ParamFlowException) {
            message = "Hotspot parameter current limit: requests are too frequent";
        } else if (e instanceof SystemBlockException) {
            message = "System Protection: Insufficient System Resources";
        } else if (e instanceof AuthorityException) {
            message = "Authorization Control: No Access";
        }
        
        return (429, message);
    }
}

@RestController
@RequestMapping("/api")
public class UserController {
    
    // Use resource names to define flow-limited resources    @SentinelResource(value = "getUserById", 
                      blockHandler = "getUserBlockHandler",
                      fallback = "getUserFallback")
    @GetMapping("/user/{id}")
    public User getUser(@PathVariable Long id) {
        return (id);
    }
    
    // Current limiting processing method    public User getUserBlockHandler(Long id, BlockException e) {
        ("Get user request blocked: {}", id, e);
        throw new RuntimeException("The request frequency is too high, please try again later");
    }
    
    // Exception fallback method    public User getUserFallback(Long id, Throwable t) {
        ("Get user failed: {}", id, t);
        User fallbackUser = new User();
        (id);
        ("Unknown");
        return fallbackUser;
    }
}

@Service
@Slf4j
public class SentinelRuleService {
    
    public void initComplexFlowRules() {
        List<FlowRule> rules = new ArrayList<>();
        
        // Current limiting rules based on QPS + call relationship        FlowRule apiRule = new FlowRule();
        ("/api/data");
        (RuleConstant.FLOW_GRADE_QPS);
        (20);
        
        // Restrict the source of call        ("frontend"); // Only restrict calls from front-end applications        
        // Flow control policy: associated resources        (RuleConstant.STRATEGY_RELATE);
        ("/api/important"); // When the important interface QPS is high, restrict the data interface        
        (apiRule);
        
        // Current limiting based on the number of concurrent threads        FlowRule threadRule = new FlowRule();
        ("/api/heavy-task");
        (RuleConstant.FLOW_GRADE_THREAD); // Based on the number of threads        (5); // Up to 5 threads are processed simultaneously        (threadRule);
        
        // Loading rules        (rules);
    }
    
    public void initHotspotRules() {
        // Hot spot parameter current limit rules        List<ParamFlowRule> rules = new ArrayList<>();
        
        ParamFlowRule rule = new ParamFlowRule("/api/product");
        // Perform current limiting on the 0th parameter (productId)        (0);
        (5);
        
        // Special case configuration        ParamFlowItem item1 = new ParamFlowItem();
        ("1"); // ProductId = 1        (10);  // There can be higher QPS        
        ParamFlowItem item2 = new ParamFlowItem();
        ("2"); // ProductId = 2        (2);   // More stringent restrictions        
        ((item1, item2));
        
        (rule);
        (rules);
    }
}

<dependency>
    <groupId></groupId>
    <artifactId>easy-captcha</artifactId>
    <version>1.6.2</version>
</dependency>

@Service
public class CaptchaService {
    
    @Autowired
    private StringRedisTemplate redisTemplate;
    
    private static final long CAPTCHA_EXPIRE_TIME = 5 * 60; // 5 minutes    
    /**
      * Generate verification code
      * @param request HTTP request
      * @param response HTTP response
      * @return Verification code Base64 string
      */
    public String generateCaptcha(HttpServletRequest request, HttpServletResponse response) {
        // Generate verification code        SpecCaptcha captcha = new SpecCaptcha(130, 48, 5);
        
        // Generate verification code ID        String captchaId = ().toString();
        
        //Save the verification code into Redis        ().set(
            "captcha:" + captchaId, 
            ().toLowerCase(), 
            CAPTCHA_EXPIRE_TIME, 
            
        );
        
        // Set cookies        Cookie cookie = new Cookie("captchaId", captchaId);
        ((int) CAPTCHA_EXPIRE_TIME);
        ("/");
        (cookie);
        
        // Return the Base64 encoded verification code picture        return captcha.toBase64();
    }
    
    /**
      * Verification verification code
      * @param request HTTP request
      * @param captchaCode The verification code entered by the user
      * @return Whether the verification is passed
      */
    public boolean validateCaptcha(HttpServletRequest request, String captchaCode) {
        // Get the verification code ID from the cookie        Cookie[] cookies = ();
        String captchaId = null;
        
        if (cookies != null) {
            for (Cookie cookie : cookies) {
                if ("captchaId".equals(())) {
                    captchaId = ();
                    break;
                }
            }
        }
        
        if (captchaId == null) {
            return false;
        }
        
        // Get the correct verification code from Redis        String key = "captcha:" + captchaId;
        String correctCode = ().get(key);
        
        // Delete the verification code after successful verification        if (correctCode != null && (())) {
            (key);
            return true;
        }
        
        return false;
    }
}

@RestController
@RequestMapping("/api/captcha")
public class CaptchaController {
    
    @Autowired
    private CaptchaService captchaService;
    
    @GetMapping
    public Map<String, String> getCaptcha(HttpServletRequest request, HttpServletResponse response) {
        String base64 = (request, response);
        return ("captcha", base64);
    }
}

@Target({})
@Retention()
@Documented
public @interface CaptchaRequired {
    String captchaParam() default "captchaCode";
}

@Component
public class CaptchaInterceptor implements HandlerInterceptor {
    
    @Autowired
    private CaptchaService captchaService;
    
    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
        if (!(handler instanceof HandlerMethod)) {
            return true;
        }
        
        HandlerMethod handlerMethod = (HandlerMethod) handler;
        CaptchaRequired captchaRequired = ();
        
        if (captchaRequired == null) {
            return true;
        }
        
        // Get verification code parameters        String captchaParam = ();
        String captchaCode = (captchaParam);
        
        if ((captchaCode)) {
            // Verification verification code            boolean valid = (request, captchaCode);
            if (valid) {
                return true;
            }
        }
        
        // Verification failed        ("application/json;charset=UTF-8");
        (HttpStatus.BAD_REQUEST.value());
        ().write("{"code":400,"message":"Verification code is wrong or expired"}");
        return false;
    }
}

@Service
@Slf4j
public class BehaviorAnalysisService {
    
    @Autowired
    private StringRedisTemplate redisTemplate;
    
    /**
      * Check for suspicious machine behavior
      * @param request HTTP request
      * @return Is it suspicious
      */
    public boolean isSuspicious(HttpServletRequest request) {
        // 1. Obtain client information        String ip = getIpAddress(request);
        String userAgent = ("User-Agent");
        String requestId = ().getId();
        
        // 2. Check the access frequency        String freqKey = "behavior:freq:" + ip;
        Long count = ().increment(freqKey, 1);
        (freqKey, 1, );
        
        if (count != null && count > 30) {
            ("Access frequency abnormality: IP={}, count={}", ip, count);
            return true;
        }
        
        // 3. Check User-Agent        if (userAgent == null || isBotuserAgent(userAgent)) {
            ("SuspiciousUser-Agent: {}", userAgent);
            return true;
        }
        
        // 4. Check the request time mode        String timeKey = "behavior:time:" + ip;
        long now = ();
        String lastTimeStr = ().get(timeKey);
        
        if (lastTimeStr != null) {
            long lastTime = (lastTimeStr);
            long interval = now - lastTime;
            
            // If the request interval is very uniform, it may be a robot            if (isUniformInterval(ip, interval)) {
                ("The request interval is extremely uniform: IP={}, interval={}", ip, interval);
                return true;
            }
        }
        
        ().set(timeKey, (now), 10, );
        
        // More advanced detection logic...        
        return false;
    }
    
    /**
      * Check if it is a robot UA
      */
    private boolean isBotuserAgent(String userAgent) {
        String ua = ();
        return ("bot") || ("spider") || ("crawl") ||
               () || () < 40;
    }
    
    /**
      * Check whether the request interval is abnormally uniform
      */
    private boolean isUniformInterval(String ip, long interval) {
        String key = "behavior:intervals:" + ip;
        
        // Get the most recent intervals        List<String> intervalStrs = ().range(key, 0, 4);
        ().leftPush(key, (interval));
        ().trim(key, 0, 9);  // Only the last 10        (key, 10, );
        
        if (intervalStrs == null || () < 5) {
            return false;
        }
        
        // Calculate the variance of the interval. Small variance means that the request interval is very uniform        List<Long> intervals = ()
                .map(Long::parseLong)
                .collect(());
        
        double mean = ().mapToLong(Long::longValue).average().orElse(0);
        double variance = ()
                .mapToDouble(i -> (i - mean, 2))
                .average()
                .orElse(0);
        
        return variance < 100;  // The variance threshold needs to be adjusted according to actual situation    }
    
    // getIpAddress method is the same as above}

@Component
public class BehaviorAnalysisInterceptor implements HandlerInterceptor {
    
    @Autowired
    private BehaviorAnalysisService behaviorAnalysisService;
    
    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
        // Check for endpoints that need protection        String path = ();
        if (("/api/") && isPotentialRiskEndpoint(path)) {
            boolean suspicious = (request);
            
            if (suspicious) {
                // Verification code or other additional verification is required                ("application/json;charset=UTF-8");
                (HttpStatus.TOO_MANY_REQUESTS.value());
                ().write("{"code":429,"message":"Exception access was detected, please verify","needCaptcha":true}");
                return false;
            }
        }
        
        return true;
    }
    
    /**
      * Determine whether it is a high-risk endpoint
      */
    private boolean isPotentialRiskEndpoint(String path) {
        return ("/login") || 
               ("/register") || 
               ("/payment") || 
               ("/order") ||
               ("/password");
    }
}

@RestController
@RequestMapping("/api")
public class UserController {
    
    @CaptchaRequired
    @PostMapping("/login")
    public Result login(@RequestParam String username, 
                        @RequestParam String password,
                        @RequestParam String captchaCode) {
        // Login logic        return (username, password);
    }
    
    @CaptchaRequired
    @PostMapping("/register")
    public Result register(@RequestBody UserRegisterDTO registerDTO,
                          @RequestParam String captchaCode) {
        // Registration logic        return (registerDTO);
    }
}