<dependencies>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-web</artifactId>
    </dependency>
    <dependency>
        <groupId>com.google.guava</groupId>
        <artifactId>guava</artifactId>
        <version>31.1-jre</version>
    </dependency>
</dependencies>

import com.google.common.cache.CacheBuilder;
import com.google.common.cache.CacheLoader;
import com.google.common.cache.LoadingCache;
import com.google.common.util.concurrent.RateLimiter;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.stereotype.Service;
 
import java.util.concurrent.TimeUnit;
 
@Service
public class RateLimiterService {
 
    private static final Logger logger = LoggerFactory.getLogger(RateLimiterService.class);
 
    @Value("${rate.limit.permitsPerSecond:10}") // 默認值 10
    private double permitsPerSecond;
 
    // 使用 LoadingCache 緩存每個 IP 的 RateLimiter
    private final LoadingCache<String, RateLimiter> rateLimiterCache = CacheBuilder.newBuilder()
            .expireAfterWrite(1, TimeUnit.MINUTES) // 緩存 1 分鐘
            .build(new CacheLoader<String, RateLimiter>() {
                @Override
                public RateLimiter load(String ip) {
                    logger.info("Creating RateLimiter for IP: {}, rate: {}", ip, permitsPerSecond);
                    return RateLimiter.create(permitsPerSecond);
                }
            });
 
    /**
     * 嘗試獲取令牌
     * @param ip 客戶端 IP 地址
     * @return true: 允許訪問, false: 限流
     */
    public boolean tryAcquire(String ip) {
        RateLimiter rateLimiter = rateLimiterCache.getUnchecked(ip);
        return rateLimiter.tryAcquire();
    }
 
}

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.stereotype.Component;
import org.springframework.web.filter.OncePerRequestFilter;
 
import jakarta.servlet.FilterChain;
import jakarta.servlet.ServletException;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import java.io.IOException;
 
@Component
public class IpRateLimitFilter extends OncePerRequestFilter {
 
    private static final Logger logger = LoggerFactory.getLogger(IpRateLimitFilter.class);
 
    @Autowired
    private RateLimiterService rateLimiterService;
 
    @Value("${rate.limit.enabled:true}")
    private boolean rateLimitEnabled;
 
    @Value("${rate.limit.excludePatterns:}") // 排除的URL，用逗號分隔
    private String excludePatterns;
 
 
    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
            throws ServletException, IOException {
 
        if (!rateLimitEnabled) {
            filterChain.doFilter(request, response);
            return; // 如果禁用限流，直接放行
        }
 
        // 排除不需要限流的URL
        String requestURI = request.getRequestURI();
        if (excludePatterns != null && !excludePatterns.isEmpty()) {
             String[] patterns = excludePatterns.split(",");
             for (String pattern : patterns) {
                if (requestURI.startsWith(pattern.trim())) {
                    filterChain.doFilter(request, response);
                    return;
                 }
             }
        }
 
 
        String clientIp = getClientIp(request);
 
        if (rateLimiterService.tryAcquire(clientIp)) {
            filterChain.doFilter(request, response); // 允許訪問
        } else {
            logger.warn("Rate limit exceeded for IP: {}", clientIp);
            response.setStatus(HttpServletResponse.SC_TOO_MANY_REQUESTS);
            response.getWriter().write("Too many requests from this IP.");
        }
    }
 
    private String getClientIp(HttpServletRequest request) {
        String xffHeader = request.getHeader("X-Forwarded-For");
        if (xffHeader == null) {
            return request.getRemoteAddr();
        }
        return xffHeader.split(",")[0];
    }
}

import org.springframework.boot.web.servlet.FilterRegistrationBean;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
 
@Configuration
public class FilterConfig {
 
    @Bean
    public FilterRegistrationBean<IpRateLimitFilter> ipRateLimitFilterRegistration(IpRateLimitFilter ipRateLimitFilter) {
        FilterRegistrationBean<IpRateLimitFilter> registration = new FilterRegistrationBean<>();
        registration.setFilter(ipRateLimitFilter);
        registration.addUrlPatterns("/*"); // 對所有請求進行限流
        registration.setOrder(1);
        return registration;
    }
}

import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;
 
@RestController
public class TestController {
 
    @GetMapping("/test")
    public String test() {
        return "Hello, this is a test API.";
    }
}

# 限流配置
rate.limit.enabled=true
rate.limit.permitsPerSecond=10
rate.limit.excludePatterns=/health,/metrics # 排除的URL

import org.springframework.http.HttpStatus;
import org.springframework.stereotype.Component;
import org.springframework.web.servlet.HandlerInterceptor;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import java.util.Map;
import java.util.concurrent.ConcurrentHashMap;
import java.util.concurrent.atomic.AtomicInteger;
 
@Component
public class IPRequestRateLimiter implements HandlerInterceptor {
    private final int REQUEST_LIMIT = 10;  // 每秒最大請求數(shù)
    private final Map<String, AtomicInteger> requestCountsPerIP = new ConcurrentHashMap<>();
 
    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
        String ipAddress = request.getRemoteAddr();
 
        // 1. 初始化計數(shù)器
        requestCountsPerIP.computeIfAbsent(ipAddress, k -> new AtomicInteger(0));
 
        // 2. 檢查請求是否超限
        if (requestCountsPerIP.get(ipAddress).incrementAndGet() > REQUEST_LIMIT) {
            response.setStatus(HttpStatus.TOO_MANY_REQUESTS.value());
            response.getWriter().write("Too many requests from this IP. Please try again later.");
            return false; // 阻止請求
        }
        return true; // 允許請求
    }
 
    @Override
    public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex) throws Exception {
        String ipAddress = request.getRemoteAddr();
 
        // 3. 請求完成后，減少計數(shù)
        requestCountsPerIP.get(ipAddress).decrementAndGet();
    }
}