SpringBoot（20）之高并发接口优化-------秒杀接口地址隐藏 + 验证码验证 +接口限流防刷
SpringBoot学习之高并发接口优化—–秒杀接口地址隐藏(验证码)+接口限流防刷
秒杀接口地址隐藏
思路：秒杀开始之前，先去请求接口获取秒杀地址。
- 接口改造，带上PathVariable参数
- 添加生成地址的接口
- 秒杀收到请求，先验证PathVariable随机生成一个字符串，作为地址加在url上，然后生成的时候，存入 redis缓存中，根据前端请求的url获取path。 判断与缓存中的字符串是否一致，一致就认为对的。就可以执行秒杀操作，否则失败。
对于秒杀接口，不是直接去请求秒杀的这个接口了， 而是先请求下获取path。之后拼接成秒杀地址。
前端代码：
function getMiaoshaPath() {
goodsId:$("#goodsId").val(),
g_showLoading();
$.ajax({
url:"/miaosha/path",
type:"GET",
data:{
goodsId:$("#goodsId").val(),
verifyCode:$("#verifyCode").val()
},
success:function (data) {
if(data.code == 0){
var path = data.data;
doMiaosha(path);
}else {
layer.msg(data.msg);
}
},
error:function() {
layer.msg("客户端请求错误");
}
});
} 对应的后端代码：
@AccessLimit(seconds = 5,maxCount = 5, needLogin = true)
@RequestMapping(value = "/path",method = RequestMethod.GET)
@ResponseBody
public Result getSecKillPath(HttpServletRequest request, SecKillUser user,
@RequestParam("goodsId") long goodsId,
@RequestParam(value = "verifyCode", defaultValue = "0") int verifyCode){
if (user == null){
return Result.error(CodeMsg.SESSION_ERROR);
}
//验证码的校验
boolean check = secKillService.checkVerifyCode(user,goodsId,verifyCode);
if (!check){
return Result.error(CodeMsg.REQUEST_ILLEGAL);
}
//生成path
String path = secKillService.createSecKillPath(user,goodsId);
return Result.success(path);
} 生成path，存入redis中
public String createSecKillPath(SecKillUser user, Long goodsId) {
if (user == null || goodsId <= 0){
return null;
}
String str = MD5Util.md5(UUIDUtil.uuid() + "123456");
redisService.set(SecKillKey.getPath,user.getId()+"_"+goodsId,str);
return str;
}秒杀接口，先拿到这个path验证一下是否正确，正确再进入下面的逻辑：
//验证path
boolean check = secKillService.checkPath(user,goodsId,path);
if (!check){
return Result.error(CodeMsg.REQUEST_ILLEGAL);
}具体的验证，就是取出缓存中的path，与前端传来的path进行对比，相等，说明是这个用户发来的请求：
/**
* 验证秒杀接口参数
* @param user
* @param goodsId
* @param path
* @return
*/
public boolean checkPath(SecKillUser user, long goodsId, String path) {
if (user == null || path == null){
return false;
}
String pathOld = redisService.get(SecKillKey.getPath,""+user.getId()+"_"+goodsId,String.class);
return path.equals(pathOld);
}然后前端拼接出秒杀的地址
function doMiaosha(path){
$.ajax({
url:"/miaosha/"+path+"/do_miaosha",
type:"POST",
data:{
goodsId:$("#goodsId").val()
},
success:function(data){
if(data.code == 0){
// window.location.href="/order_detail.htm?orderId="+data.data.id;
getMiaoShaResult($("#goodsId").val());
}else{
layer.msg(data.msg);
}
},
error:function(){
layer.msg("客户端请求有误");
}
});
}公式验证码
思路：点击秒杀之前，先输入验证码，分散用户的请求
前端增加获取验证码显示验证码输入验证码上传。
<div class="row">
<div class="form-inline">
<img id="verifyCodeImg" width="80" height="32" style="display: none" onclick="refreshVerifyCode()"/>
<input id="verifyCode" class="form-control" style="display: none"/>
<button class="btn btn-primary" type="button" id="buyButton"οnclick="getMiaoshaPath()">立即秒杀button>
div>
div>增加返回验证码的接口
/**
* 获取验证码
* @param response
* @param user
* @param goodsId
* @return
*/
@RequestMapping(value = "/verifyCode",method = RequestMethod.GET)
@ResponseBody
public Result getMiaoshaVerifyCode(HttpServletResponse response, SecKillUser user, @RequestParam("goodsId") long goodsId){
if (user == null){
return Result.error(CodeMsg.SESSION_ERROR);
}
BufferedImage image = secKillService.createSecKillVerifyCode(user,goodsId);
try{
OutputStream out = response.getOutputStream(); //输出流
ImageIO.write(image,"JPEG",out); //图片写入输出流
out.flush();
out.close();
return null;
}catch (Exception e){
e.printStackTrace();
return Result.error(CodeMsg.SECKILL_FAILED);
}
} 在每次秒杀的时候，要先判断这个验证码是否正确
//验证码的校验
boolean check = secKillService.checkVerifyCode(user,goodsId,verifyCode);
if (!check){
return Result.error(CodeMsg.REQUEST_ILLEGAL);
}生成数字验证码并存入redis中，判断也是从redis中取出来判断
public BufferedImage createSecKillVerifyCode(SecKillUser user, long goodsId) {
if (user == null || goodsId <= 0){
return null;
}
int width = 80;
int height = 32;
//生成图片
BufferedImage image = new BufferedImage(width, height, BufferedImage.TYPE_INT_RGB);
Graphics g = image.getGraphics();
// 背景
g.setColor(new Color(0xDCDCDC));
g.fillRect(0, 0, width, height);
// 背景上生成矩形框
g.setColor(Color.black);
g.drawRect(0, 0, width - 1, height - 1);
// 随机数
Random rdm = new Random();
// 生成干扰点
for (int i = 0; i < 50; i++) {
int x = rdm.nextInt(width);
int y = rdm.nextInt(height);
g.drawOval(x, y, 0, 0);
}
// 生成验证码
String verifyCode = generateVerifyCode(rdm);
g.setColor(new Color(0, 100, 0));
g.setFont(new Font("Candara", Font.BOLD, 24));
g.drawString(verifyCode, 8, 24);
g.dispose();
//把验证码存到redis中
int rnd = calc(verifyCode);
redisService.set(SecKillKey.getSecKillVerifyCode, user.getId()+","+goodsId, rnd);
//输出图片
return image;
}
private static char[] ops = new char[] {'+', '-', '*'};
/**
* 生成验证码公式
* + - *
* */
private String generateVerifyCode(Random rdm) {
int num1 = rdm.nextInt(10);
int num2 = rdm.nextInt(10);
int num3 = rdm.nextInt(10);
char op1 = ops[rdm.nextInt(3)];
char op2 = ops[rdm.nextInt(3)];
String exp = ""+ num1 + op1 + num2 + op2 + num3;
return exp;
}
/**
* Java ScriptEngine 解析js计算验证码
* @param exp 验证码
* @return
*/
private static int calc(String exp) {
try {
ScriptEngineManager manager = new ScriptEngineManager();
ScriptEngine engine = manager.getEngineByName("JavaScript");
return (Integer)engine.eval(exp);
}catch(Exception e) {
e.printStackTrace();
return 0;
}
}前端在function getMiaoshaPath()这个函数中将结果传到后端，后端在这个获取真正秒杀链接的时候进行判断是否正确：
verifyCode:$("#verifyCode").val()后端接收验证码验证
@AccessLimit(seconds = 5,maxCount = 5, needLogin = true)
@RequestMapping(value = "/path",method = RequestMethod.GET)
@ResponseBody
public Result getMiaoshaPath(HttpServletRequest request, SecKillUser user,
@RequestParam("goodsId") long goodsId,
@RequestParam(value = "verifyCode", defaultValue = "0") int verifyCode){
if (user == null){
return Result.error(CodeMsg.SESSION_ERROR);
}
//验证码的校验
boolean check = secKillService.checkVerifyCode(user,goodsId,verifyCode);
if (!check){
return Result.error(CodeMsg.REQUEST_ILLEGAL);
}
String path = secKillService.createSecKillPath(user,goodsId);
return Result.success(path);
} redis中取出生成时存入的验证码并与前端传进来的验证码做校验
/**
* 验证码的验证
* @param user 用户
* @param goodsId 商品id
* @param verifyCode 验证码
* @return
*/
public boolean checkVerifyCode(SecKillUser user, long goodsId, int verifyCode) {
if (user == null || goodsId <= 0){
return false;
}
Integer codeOld = redisService.get(SecKillKey.getSecKillVerifyCode, user.getId()+","+goodsId, Integer.class);
if (codeOld == null || codeOld - verifyCode != 0){
return false;
}
//把当前的验证码清除
redisService.delete(SecKillKey.getSecKillVerifyCode, user.getId()+","+goodsId);
return true;
}接口限流防刷
思路：对接口做限流
可以使用拦截器减少对业务的侵入
点击秒杀之后，首先是生成path，那假如我们对这个接口进行限制：5秒之内用户只能点击5次。
这放在redis中是非常好实现的，因为redis有个自增(自减)和缓存时间，可以很好地实现这个效果。
这里使用注解的方式来实现接口的限流防刷，使用注解的话就可以做成通用的方法，在你想使用限流防刷的接口就可以添加上该注解
假设，我想在5秒内最多请求5次，并且必须要登陆：相应的注解就是这样的：
@AccessLimit(seconds = 5,maxCount = 5,needLogin = true)首先是实现这个注解：
package com.springboot.SecKill.access;
import java.lang.annotation.Retention;
import java.lang.annotation.RetentionPolicy;
import java.lang.annotation.Target;
import static java.lang.annotation.ElementType.METHOD;
/**
* 注解
* @author WilsonSong
* @date 2018/8/9/009
*/
@Retention(RetentionPolicy.RUNTIME)
@Target(METHOD)
public @interface AccessLimit {
int seconds();
int maxCount();
boolean needLogin() default true;
}
要想这个注解能够生效，必须要配置拦截器AccessInterceptor：
package com.springboot.SecKill.access;
import com.alibaba.fastjson.JSON;
import com.springboot.SecKill.domain.SecKillUser;
import com.springboot.SecKill.redis.AccessKey;
import com.springboot.SecKill.redis.RedisService;
import com.springboot.SecKill.result.CodeMsg;
import com.springboot.SecKill.result.Result;
import com.springboot.SecKill.service.SecKillUserService;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Service;
import org.springframework.util.StringUtils;
import org.springframework.web.method.HandlerMethod;
import org.springframework.web.servlet.handler.HandlerInterceptorAdapter;
import javax.servlet.http.Cookie;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.OutputStream;
/**
* 拦截器
* @author WilsonSong
* @date 2018/8/9/009
*/
@Service
public class AccessInterceptor extends HandlerInterceptorAdapter{
@Autowired
SecKillUserService secKillUserService;
@Autowired
RedisService redisService;
//方法执行前执行
public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
if(handler instanceof HandlerMethod){
SecKillUser user = getUser(request,response);
UserContext.setUser(user); //把用户保存在本地线程变量中,并且该user与线程绑定一直执行到结束
HandlerMethod handlerMethod = (HandlerMethod)handler;
AccessLimit accessLimit = handlerMethod.getMethodAnnotation(AccessLimit.class); //取方法上的注解
if (accessLimit == null){
return true;
}
int seconds = accessLimit.seconds();
int maxCount = accessLimit.maxCount();
boolean needLogin = accessLimit.needLogin();
String key = request.getRequestURI();
if (needLogin){
if (user == null){
render(response,CodeMsg.SESSION_ERROR);
return false;
}
key +="_" + user.getId();
}else {
//da nothing
}
//访问次数限制 访问次数存入内存
AccessKey accessKey = AccessKey.withExpires(seconds);
Integer count = redisService.get(accessKey,key, Integer.class);
if (count == null){
redisService.set(accessKey,key, 1);
}else if (count < maxCount){
redisService.incr(accessKey,key);
}else {
render(response,CodeMsg.ACCESS_LIMIT_REACHED);
return false;
}
}
return true;
}
/**
* 返回客户端的错误信息
* @param response
* @param cm
* @throws Exception
*/
public void render(HttpServletResponse response,CodeMsg cm) throws Exception{
response.setContentType("application/json;charset=UTF-8"); //返回的数据的编码方式
OutputStream outputStream = response.getOutputStream();
String str = JSON.toJSONString(Result.error(cm));
outputStream.write(str.getBytes("UTF-8"));
outputStream.flush();
outputStream.close();
}
/**
* 通过cookie获取用户
* @param request
* @param response
* @return
*/
private SecKillUser getUser(HttpServletRequest request, HttpServletResponse response){
String paramToken = request.getParameter(SecKillUserService.COOKIE_NAME_TOKEN);
String cookieToken = getCookieValue(request,SecKillUserService.COOKIE_NAME_TOKEN);
if (StringUtils.isEmpty(cookieToken) && StringUtils.isEmpty(paramToken)){
return null;
}
String token = StringUtils.isEmpty(paramToken)?cookieToken:paramToken;
return secKillUserService.getByToken(response,token);
}
/**
* 获取cookie
* @param request
* @param cookieName
* @return
*/
private String getCookieValue(HttpServletRequest request,String cookieName){
Cookie[] cookies = request.getCookies();
if(cookies == null || cookies.length <= 0){
return null;
}
for (Cookie cookie : cookies){
if (cookie.getName().equals(cookieName)){
return cookie.getValue();
}
}
return null;
}
}要想这个拦截器工作，我们要重写WebMvcConfigurerAdapter中的addInterceptors方法，将我们的拦截器添加进去就可以了：
public void addInterceptors(InterceptorRegistry registry) {
registry.addInterceptor(accessInterceptor);
}这样，利用注解和拦截器就实现了接口通用的限流功能。