Java防止恶意刷接口的五种方法小结

private static final RateLimiter rateLimiter = RateLimiter.create(50); // 每秒最多 50 个请求
@GetMapping("/seckill")
public ResponseEntity<String> doSeckill(@RequestParam Long productId) {
    if (!rateLimiter.tryAcquire()) {
        return ResponseEntity.status(HttpStatus.TOO_MANY_REQUESTS).body("请求过于频繁，请稍后再试");
    }
    // 进行秒杀逻辑
    return ResponseEntity.ok("秒杀成功");
}

public boolean checkSignature(String userId, String timestamp, String sign) {
    String secret = "server_secret"; // 服务端秘钥
    String raw = userId + timestamp + secret;
    String expectedSign = DigestUtils.md5DigestAsHex(raw.getBytes());
    return expectedSign.equals(sign);
}

@GetMapping("/captcha")
public void getCaptcha(HttpServletResponse response, HttpSession session) throws IOException {
    String captchaText = producer.createText();
    session.setAttribute("captcha", captchaText);
    BufferedImage image = producer.createImage(captchaText);
    ImageIO.write(image, "jpg", response.getOutputStream());
}

@PostMapping("/seckill")
public ResponseEntity<String> doSeckill(@RequestParam String captchaInput, HttpSession session) {
    String realCaptcha = (String) session.getAttribute("captcha");
    if (!captchaInput.equalsIgnoreCase(realCaptcha)) {
        return ResponseEntity.badRequest().body("验证码错误");
    }
    // 继续处理秒杀逻辑
}

// 接口只发送消息
@PostMapping("/seckill")
public ResponseEntity<String> doSeckill(@RequestBody SeckillRequest request) {
    if (!verifyToken(request.getToken())) {
        return ResponseEntity.status(HttpStatus.FORBIDDEN).body("非法请求");
    }
    mqSender.send("SECKILL_QUEUE", request);
    return ResponseEntity.ok("请求已受理");
}

@RabbitListener(queues = "SECKILL_QUEUE")
public void handleSeckill(SeckillRequest request) {
    // 检查库存、扣减、生成订单
}