SpringBoot通過攔截器實現(xiàn)接口限流的兩種方案

更新時間：2025年10月11日 10:36:23 作者：IT橘子皮

在Spring Boot中,可以通過自定義攔截器（Interceptor）結(jié)合Redis或內(nèi)存計數(shù)器實現(xiàn)接口限流,以下是兩種典型實現(xiàn)方式及代碼示例,需要的朋友可以參考下

?方案一：基于Redis + Lua腳本的分布式限流?

?核心邏輯?

?Redis配置?：使用Lua腳本保證原子性操作（計數(shù)+過期時間設(shè)置）。
?攔截器?：攔截請求，通過Redis統(tǒng)計IP或用戶維度的訪問次數(shù)。
?注冊攔截器?：指定攔截路徑和排除路徑。

?代碼實現(xiàn)?

1. Redis配置類

@Configuration
public class RedisConfig {
    @Bean
    public RedisTemplate<String, Object> redisTemplate(RedisConnectionFactory factory) {
        RedisTemplate<String, Object> template = new RedisTemplate<>();
        template.setConnectionFactory(factory);
        template.setKeySerializer(new StringRedisSerializer());
        template.setValueSerializer(new GenericJackson2JsonRedisSerializer());
        return template;
    }

    @Bean
    public DefaultRedisScript<Long> rateLimitScript() {
        DefaultRedisScript<Long> script = new DefaultRedisScript<>();
        script.setScriptText(
            "local key = KEYS[1]\n" +
            "local limit = tonumber(ARGV[1])\n" +
            "local expire = tonumber(ARGV[2])\n" +
            "local current = redis.call('INCR', key)\n" +
            "if current == 1 then\n" +
            "    redis.call('EXPIRE', key, expire)\n" +
            "end\n" +
            "return current > limit and 1 or 0"
        );
        script.setResultType(Long.class);
        return script;
    }
}

2. 限流攔截器

@Component
public class RateLimitInterceptor implements HandlerInterceptor {
    @Autowired
    private RedisTemplate<String, Object> redisTemplate;
    @Autowired
    private DefaultRedisScript<Long> rateLimitScript;

    private static final int DEFAULT_LIMIT = 60; // 每分鐘60次
    private static final int DEFAULT_TIMEOUT = 60; // 60秒過期

    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws IOException {
        String ip = request.getRemoteAddr();
        String uri = request.getRequestURI();
        String key = "rate_limit:" + ip + ":" + uri.split("/")[1]; // 按接口前綴分組

        Long result = redisTemplate.execute(
            rateLimitScript,
            Collections.singletonList(key),
            DEFAULT_LIMIT, DEFAULT_TIMEOUT
        );

        if (result != null && result == 1) {
            response.setStatus(HttpStatus.TOO_MANY_REQUESTS.value());
            response.getWriter().write("Too many requests");
            return false;
        }
        return true;
    }
}

3. 注冊攔截器

@Configuration
public class WebConfig implements WebMvcConfigurer {
    @Autowired
    private RateLimitInterceptor rateLimitInterceptor;

    @Override
    public void addInterceptors(InterceptorRegistry registry) {
        registry.addInterceptor(rateLimitInterceptor)
            .addPathPatterns("/api/**")
            .excludePathPatterns("/api/login");
    }
}

?方案二：基于內(nèi)存計數(shù)器的單機(jī)限流?

?核心邏輯?

?攔截器?：使用ConcurrentHashMap存儲IP和訪問時間戳。
?滑動窗口?：統(tǒng)計1分鐘內(nèi)的請求數(shù)，超限則拒絕。

?代碼實現(xiàn)?

public class RateLimitingInterceptor implements HandlerInterceptor {
    private final ConcurrentMap<String, Long> requestCounts = new ConcurrentHashMap<>();
    private static final long ALLOWED_REQUESTS_PER_MINUTE = 60;

    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
        String clientIp = request.getRemoteAddr();
        long currentTime = System.currentTimeMillis();

        // 清理過期請求
        requestCounts.entrySet().removeIf(entry -> 
            currentTime - entry.getValue() > TimeUnit.MINUTES.toMillis(1)
        );

        // 統(tǒng)計當(dāng)前窗口請求數(shù)
        long count = requestCounts.values().stream()
            .filter(timestamp -> currentTime - timestamp < TimeUnit.MINUTES.toMillis(1))
            .count();

        if (count >= ALLOWED_REQUESTS_PER_MINUTE) {
            response.setStatus(HttpServletResponse.SC_TOO_MANY_REQUESTS);
            response.getWriter().write("請求過于頻繁");
            return false;
        }

        requestCounts.put(clientIp, currentTime);
        return true;
    }
}

?關(guān)鍵對比與選擇建議?

?方案?	?適用場景?	?優(yōu)點(diǎn)?	?缺點(diǎn)?
Redis + Lua	分布式環(huán)境，高精度限流	原子性操作，支持分布式，可動態(tài)調(diào)整參數(shù)	依賴Redis，網(wǎng)絡(luò)開銷較大
內(nèi)存計數(shù)器	單機(jī)環(huán)境，簡單場景	無外部依賴，實現(xiàn)簡單	不支持分布式，重啟后數(shù)據(jù)丟失