基于SpringBoot AOP+Redis实现接口限流注解的示例代码

@Target(ElementType.METHOD)
@Retention(RetentionPolicy.RUNTIME)
public @interface RateLimit {

    /** 限流 key */
    String key() default "";

    /** 限流维度：user / ip / api */
    String type() default "user";

    /** 窗口内最大请求数 */
    long max() default 10;

    /** 窗口大小（秒） */
    long window() default 1;

    /** 被限后的提示 */
    String message() default "请求太频繁，请稍后重试";
}

@Aspect
@Component
public class RateLimitAspect {

    @Autowired
    private StringRedisTemplate redisTemplate;

    @Around("@annotation(rateLimit)")
    public Object around(ProceedingJoinPoint pjp, RateLimit rateLimit) throws Throwable {
        String key = buildKey(rateLimit);

        // 滑动窗口限流
        boolean allowed = tryAcquire(key, rateLimit.max(), rateLimit.window());

        if (!allowed) {
            throw new BusinessException(429, rateLimit.message());
        }

        return pjp.proceed();
    }

    private boolean tryAcquire(String key, long max, long windowSec) {
        long now = System.currentTimeMillis();
        long windowMs = windowSec * 1000L;
        long windowStart = now - windowMs;

        // Lua 脚本保证原子性
        String lua =
            "redis.call('ZREMRANGEBYSCORE', KEYS[1], 0, ARGV[1]) " +
            "local count = redis.call('ZCARD', KEYS[1]) " +
            "if count < tonumber(ARGV[2]) then " +
            "  redis.call('ZADD', KEYS[1], ARGV[3], ARGV[3]) " +
            "  redis.call('EXPIRE', KEYS[1], ARGV[4]) " +
            "  return 1 " +
            "else " +
            "  return 0 " +
            "end";

        Long result = redisTemplate.execute(
            new DefaultRedisScript<>(lua, Long.class),
            Collections.singletonList(key),
            String.valueOf(windowStart),
            String.valueOf(max),
            String.valueOf(now),
            String.valueOf(windowSec + 1)
        );

        return Long.valueOf(1).equals(result);
    }

    private String buildKey(RateLimit rateLimit) {
        String prefix = "rate:";

        switch (rateLimit.type()) {
            case "ip":
                HttpServletRequest request = ((ServletRequestAttributes)
                    RequestContextHolder.getRequestAttributes()).getRequest();
                return prefix + "ip:" + getIp(request);
            case "api":
                return prefix + "api:" + Stream.of(
                    Thread.currentThread().getStackTrace())
                    .filter(s -> s.getMethodName().contains("$"))
                    .findFirst().orElse(new StackTraceElement("", "", "", 0))
                    .getMethodName();
            default:
                // type = user
                return prefix + "user:" + StpUtil.getLoginIdAsString();
        }
    }

    public static String getIp(HttpServletRequest request) {
        String ip = request.getHeader("X-Forwarded-For");
        if (ip == null || ip.isEmpty()) ip = request.getHeader("X-Real-IP");
        if (ip == null || ip.isEmpty()) ip = request.getRemoteAddr();
        if (ip != null && ip.contains(",")) ip = ip.split(",")[0].trim();
        return ip;
    }
}

@RestController
@RequestMapping("/api")
public class TestController {

    @GetMapping("/test")
    @RateLimit(key = "test", type = "ip", max = 5, window = 10)
    public ResultVO<?> test() {
        return ResultVO.success("成功");
    }

    @PostMapping("/seckill/{productId}")
    @RateLimit(type = "user", max = 1, window = 10)
    public ResultVO<?> seckill(@PathVariable Long productId) {
        return ResultVO.success("秒杀成功");
    }
}

@RestControllerAdvice
public class RateLimitExceptionHandler {

    @ExceptionHandler(BusinessException.class)
    public ResultVO<?> handleBusiness(BusinessException e) {
        if (e.getMessage().contains("请求太频繁")) {
            return ResultVO.error(429, e.getMessage());
        }
        return ResultVO.error(e.getCode(), e.getMessage());
    }
}

# 模拟 20 个并发请求
for i in {1..20}; do
    curl -X GET http://localhost:9090/api/test &
done

# 正常响应：{"code":200,"message":"成功"}
# 被限响应：{"code":429,"message":"请求太频繁，请稍后重试"}