一、设计思路（IP + 时间窗限流）

目标：

按 IP 维度

在固定时间窗口（如 1 秒 / 1 分钟）

限制最大请求次数（如 100 次/分钟）

实现方式：

key = IP

value = 该 IP 在当前时间窗内的请求次数

时间窗过期自动清零

二、核心实现（Thread-safe + 本地缓存版）

方案：ConcurrentHashMap + AtomicInteger + 时间窗口

import java.util.concurrent.*;

import java.util.concurrent.atomic.AtomicInteger;

public class IpRateLimiter {

// 每个 IP 的访问记录

private static class Counter {

AtomicInteger count = new AtomicInteger(0);

long windowStart;

}

private final ConcurrentHashMap<String, Counter> cache = new ConcurrentHashMap<>();

// 时间窗口（毫秒）

private final long windowSizeInMs;

// 每个窗口最大请求数

private final int maxRequest;

public IpRateLimiter(long windowSizeInMs, int maxRequest) {

this.windowSizeInMs = windowSizeInMs;

this.maxRequest = maxRequest;

// 定时清理过期数据（防止内存泄漏）

Executors.newSingleThreadScheduledExecutor()

.scheduleAtFixedRate(this::cleanup, windowSizeInMs, windowSizeInMs, TimeUnit.MILLISECONDS);

}

public boolean allowRequest(String ip) {

long now = System.currentTimeMillis();

Counter counter = cache.computeIfAbsent(ip, k -> {

Counter c = new Counter();

c.windowStart = now;

return c;

});

synchronized (counter) {

// 如果已经进入新的时间窗口，重置

if (now - counter.windowStart > windowSizeInMs) {

counter.windowStart = now;

counter.count.set(0);

}

// 判断是否超过限制

if (counter.count.incrementAndGet() > maxRequest) {

return false;

}

return true;

}

private void cleanup() {

long now = System.currentTimeMillis();

for (String ip : cache.keySet()) {

Counter c = cache.get(ip);

if (c != null && now - c.windowStart > windowSizeInMs) {

cache.remove(ip);

}

三、Spring Boot 使用方式（Interceptor）

1. 定义拦截器

import jakarta.servlet.http.HttpServletRequest;

import jakarta.servlet.http.HttpServletResponse;

import org.springframework.web.servlet.HandlerInterceptor;

public class RateLimitInterceptor implements HandlerInterceptor {

private final IpRateLimiter rateLimiter;

public RateLimitInterceptor(IpRateLimiter rateLimiter) {

this.rateLimiter = rateLimiter;

}

@Override

public boolean preHandle(HttpServletRequest request,

HttpServletResponse response,

Object handler) throws Exception {

String ip = getClientIp(request);

if (!rateLimiter.allowRequest(ip)) {

response.setStatus(429);

response.getWriter().write("Too Many Requests");

return false;

}

return true;

}

private String getClientIp(HttpServletRequest request) {

String ip = request.getHeader("X-Forwarded-For");

if (ip == null || ip.isEmpty()) {

ip = request.getRemoteAddr();

}

return ip.split(",")[0];

}

2. 注册拦截器

import org.springframework.context.annotation.Configuration;

import org.springframework.web.servlet.config.annotation.*;

@Configuration

public class WebConfig implements WebMvcConfigurer {

@Override

public void addInterceptors(InterceptorRegistry registry) {

IpRateLimiter limiter = new IpRateLimiter(60_000, 100); // 1分钟100次

registry.addInterceptor(new RateLimitInterceptor(limiter))

.addPathPatterns("/**");

}

ITPub博客

java编写一个接口限流器（IP + 时间窗算法）

最新文章