1000字范文 > 【学习笔记】seckill-秒杀项目--（10）安全优化

【学习笔记】seckill-秒杀项目--（10）安全优化

时间：2022-08-02 22:44:20

引言

当我们秒杀开始时，不会直接调秒杀接口，而是获取真正秒杀接口的地址，根据每个用户秒杀的不同商品是不一样的。这样可以避免有些人提前通过脚本准备好固定地址进行秒杀。这种方式的缺点是有可能能提前获取到秒杀接口地址，这种时候可以再进行一次验证码的防护。如果没有验证码的话，一秒内可能有很多请求，加上验证码可以延迟请求的时间，服务器承受的压力就没有那么大。为了减少并发量，还可以进行一次接口的限流。

一、秒杀接口地址隐藏

针对不同用户秒杀不同商品，设计秒杀接口地址不同。

1.1 控制层修改

/*** 秒杀* @author 47roro* @date /4/16* @param path* @param user* @param goodsId* @return java.lang.String**/@RequestMapping(value = "/{path}/doSeckill", method = RequestMethod.POST)@ResponseBodypublic RespBean doSecKill(@PathVariable String path, User user, Long goodsId){if(user == null){return RespBean.error(RespBeanEnum.SESSION_ERROR);}ValueOperations valueOperations = redisTemplate.opsForValue();//判断路径是否正确Boolean check = orderService.checkPath(user, goodsId, path);if(!check){return RespBean.error(RespBeanEnum.REQUEST_ILLEGAL);}//判断是否重复抢购(mybatis plus)SeckillOrder seckillOrder = (SeckillOrder) redisTemplate.opsForValue().get("order:" + user.getId() + ":" + goodsId);if(seckillOrder != null){return RespBean.error(RespBeanEnum.REPEAT_ERROR);}//内存标记减少redis访问if(EmptyStockMap.get(goodsId)){return RespBean.error(RespBeanEnum.EMPT_STOCK);}//预减库存Long stock = valueOperations.decrement("seckillGoods:" + goodsId);//Long stock = (Long) redisTemplate.execute(script,// Collections.singletonList("seckillGoods:" + goodsId),// Collections.EMPTY_LIST);if(stock < 0){EmptyStockMap.put(goodsId, true);valueOperations.increment("seckillGoods:" + goodsId);return RespBean.error(RespBeanEnum.EMPT_STOCK);}SeckillMessage seckillMessage = new SeckillMessage(user, goodsId);mqSender.sendSeckillMessage(JsonUtil.object2JsonStr(seckillMessage));return RespBean.success(0);}/*** 获取秒杀地址* @author 47roro* @date /5/13* @param user* @param goodsId* @return com.example.seckill.vo.RespBean**/@RequestMapping(value = "/path", method = RequestMethod.GET)@ResponseBodypublic RespBean getPath(User user, Long goodsId) {if (user == null) {return RespBean.error(RespBeanEnum.SESSION_ERROR);}String str = orderService.createPath(user, goodsId);return RespBean.success(str);}

1.2 订单服务接口修改

/*** 获取秒杀地址* @author 47roro* @date /5/13* @param user* @param goodsId* @return java.lang.String**/String createPath(User user, Long goodsId);/*** 校验秒杀地址* @author 47roro* @date /5/13* @param user* @param goodsId* @param path* @return java.lang.Boolean**/Boolean checkPath(User user, Long goodsId, String path);

1.3 订单服务修改

/*** 获取秒杀地址* @author 47roro* @date /5/13* @param user* @param goodsId* @return java.lang.String**/@Overridepublic String createPath(User user, Long goodsId) {String str = MD5Util.md5(UUIDUtil.uuid() + "123456");redisTemplate.opsForValue().set("seckillPath:" + user.getId() + ":" +goodsId, str, 60, TimeUnit.SECONDS);return str;}/*** 校验秒杀地址* @author 47roro* @date /5/13* @param user* @param goodsId* @param path* @return java.lang.Boolean**/@Overridepublic Boolean checkPath(User user, Long goodsId, String path) {if (user==null|| !StringUtils.hasLength(path)){return false;}String redisPath = (String) redisTemplate.opsForValue().get("seckillPath:" +user.getId() + ":" + goodsId);return path.equals(redisPath);}

1.4 前端页面修改

function getSeckillPath(){var goodsId = $("#goodsId").val();g_showLoading();$.ajax({url: "/seckill/path",type: "GET",data: {goodsId: goodsId,},success: function (data) {if (data.code == 200) {var path = data.obj;doSeckill(path);} else {layer.msg(data.message);}},error: function () {layer.msg("客户端请求错误");}})}

1.5 结果测试

获取到唯一path，与redis中存储的一致。

1.6 小结

这种方式还存在一种缺点，就是有些人可以通过获取到一次地址后，能立马获取拼接规则，如果知道了拼接规则的话，可以快速发起大量请求。这种时候可以通过加上验证码进行限制。脚本不会进行验证码的校验。能够隔离掉一部分的脚本请求。

二、生成图形验证码

验证码作用：

防止一部分脚本；拉长短时间并发的时间长度。

最好避免简单验证码。可以用数学公式，图形翻转等。验证码可以使用开源的项目。

点击秒杀开始前，先输入验证码，分散用户请求。

2.1 前端页面修改

<div class="row"><div class="form-inline"><img id="captchaImg" width="130" height="32" onclick="refreshCaptcha()"style="display: none"><input id="captcha" class="form-control" style="display: none"><button class="btn btn-primary" type="button" id="buyButton"onclick="getSeckillPath()">立即秒杀<input type="hidden" name="goodsId" id="goodsId"></button></div></div>

2.2 控制层修改

/*** 生成验证码* @author 47roro* @date /5/13* @param user* @param goodsId* @param response**/@RequestMapping(value = "/captcha", method = RequestMethod.GET)public void verifyCode(User user, Long goodsId, HttpServletResponse response) {if (null==user||goodsId<0){throw new GlobalException(RespBeanEnum.REQUEST_ILLEGAL);}// 设置请求头为输出图片类型response.setContentType("image/jpg");response.setHeader("Pragma", "No-cache");response.setHeader("Cache-Control", "no-cache");response.setDateHeader("Expires", 0);//生成验证码，将结果放入redisArithmeticCaptcha captcha = new ArithmeticCaptcha(130, 32, 3);redisTemplate.opsForValue().set("captcha:"+user.getId()+":"+goodsId,captcha.text(),300, TimeUnit.SECONDS);try {captcha.out(response.getOutputStream());} catch (IOException e) {log.error("验证码生成失败", e.getMessage());}}

2.3 测试结果

三、校验验证码

3.1 前端修改

添加验证码的传输

3.2 控制层修改

进行验证码校验

/*** 获取秒杀地址* @author 47roro* @date /5/13* @param user* @param goodsId* @return com.example.seckill.vo.RespBean**/@RequestMapping(value = "/path", method = RequestMethod.GET)@ResponseBodypublic RespBean getPath(User user, Long goodsId, String captcha) {if (user == null) {return RespBean.error(RespBeanEnum.SESSION_ERROR);}boolean check = orderService.checkCaptcha(user, goodsId, captcha);if(!check){return RespBean.error(RespBeanEnum.ERROR_CAPTCHA);}String str = orderService.createPath(user, goodsId);return RespBean.success(str);}

3.3 接口及实现类修改

实现类：

/*** 校验验证码* @author 47roro* @date /5/13* @param user* @param goodsId* @param captcha* @return boolean**/@Overridepublic boolean checkCaptcha(User user, Long goodsId, String captcha) {if(!StringUtils.hasLength(captcha) || user == null || goodsId < 0){return false;}String redisCaptcha = (String) redisTemplate.opsForValue().get("captcha:" + user.getId() + ":" + goodsId);return captcha.equals(redisCaptcha);}

接口：

/*** 验证码校验* @author 47roro* @date /5/13* @param user* @param goodsId* @param captcha* @return boolean**/boolean checkCaptcha(User user, Long goodsId, String captcha);

3.4 结果测试

输入错误答案：

输入正确答案：

四、接口限流

通过限流可以控制系统的QPS，减小服务器的压力。

通用接口限流

4.1 用户环境类

将用户保存在ThreadLocal中，

/*** @author 47roro* @create /5/13* @description:*/public class UserContext {private static ThreadLocal<User> userHolder = new ThreadLocal<User>();public static void setUser(User user) {userHolder.set(user);}public static User getUser() {return userHolder.get();}}

4.2 用户解析修改

从threadlocal中获取用户

@Overridepublic Object resolveArgument(MethodParameter parameter, ModelAndViewContainer mavContainer,NativeWebRequest webRequest, WebDataBinderFactory binderFactory) throws Exception {return UserContext.getUser();}

4.3 配置登录拦截器

/*** @author 47roro* @create /5/13* @description: 注解拦截器*/@Componentpublic class AccessLimitInterceptor implements HandlerInterceptor {@Autowiredprivate IUserService userService;@Autowiredprivate RedisTemplate redisTemplate;@Overridepublic boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {if (handler instanceof HandlerMethod) {User user = getUser(request, response);UserContext.setUser(user);HandlerMethod hm = (HandlerMethod) handler;AccessLimit accessLimit = hm.getMethodAnnotation(AccessLimit.class);if (accessLimit == null) {return true;}int second = accessLimit.second();int maxCount = accessLimit.maxCount();boolean needLogin = accessLimit.needLogin();String key = request.getRequestURI();if (needLogin) {if (user == null) {render(response, RespBeanEnum.SESSION_ERROR);return false;}key += ":" + user.getId();}ValueOperations valueOperations = redisTemplate.opsForValue();Integer count = (Integer) valueOperations.get(key);if (count == null) {valueOperations.set(key, 1, second, TimeUnit.SECONDS);} else if (count < maxCount) {valueOperations.increment(key);} else {render(response, RespBeanEnum.ACCESS_LIMIT_REACHED);return false;}}return true;}/*** 构建返回对象* @author 47roro* @date /5/13* @param response* @param respBeanEnum**/private void render(HttpServletResponse response, RespBeanEnum respBeanEnum) throws IOException {response.setContentType("application/json");response.setCharacterEncoding("UTF-8");PrintWriter out = response.getWriter();RespBean respBean = RespBean.error(respBeanEnum);out.write(new ObjectMapper().writeValueAsString(respBean));out.flush();out.close();}/*** 获取当前登录用户* @author 47roro* @date /5/13* @param request* @param response* @return com.example.seckill.pojo.User**/private User getUser(HttpServletRequest request, HttpServletResponse response) {String cookie = CookieUtil.getCookieValue(request, "userCookie");if (!StringUtils.hasLength(cookie)) {return null;}return userService.getUserByCookie(cookie, request, response);}}

自定义注解：

/*** @author 47roro* @create /5/13* @description: 访问限制注解*/@Retention(RetentionPolicy.RUNTIME)@Target(ElementType.METHOD)public @interface AccessLimit {int second();int maxCount();boolean needLogin() default true;}