导读

由于项目需要，这里需要设计一个IP白名单，增加接口安全。SpringBoot项目，因为接口已经开发好，在不变动接口的情况下，采用拦截器做处理，思路是拦截指定的请求，获取到该请求的IP，然后根据该ip去数据库查询是否存在，如果存在就允许访问，否则没有权限访问。（PS：拦截器可以通过访问Service层，在service层添加Redis缓存，设置下缓存失效时间，这样就不需要每次访问接口就从数据库中查一遍，减轻数据库访问压力，点击查看Redis缓存配置，目前这里未设置Redis缓存）

使用

创建表ip_filter

  1. CREATE TABLE `ip_filter` (
  2.   `id` int(11) NOT NULL AUTO_INCREMENT COMMENT '序号',
  3.   `ip` varchar(255) NOT NULL COMMENT 'ip地址',
  4.   `whitelists` tinyint(4) NOT NULL COMMENT '白名单0：黑名单1',
  5.   `module` varchar(255) DEFAULT NULL COMMENT '模块',
  6.   `create_time` datetime DEFAULT NULL COMMENT '创建时间',
  7.   `modify_time` datetime DEFAULT NULL COMMENT '修改时间',
  8.   PRIMARY KEY (`id`)
  9. ) ENGINE=InnoDB DEFAULT CHARSET=utf8 COMMENT='IP白名单表';

创建实体类和Mapper查询接口

  • 实体类IpFilter ```java

/**

  • ip过滤器实体类 */ @Data public class IpFilter implements Serializable {

    private static final long serialVersionUID = 8802493743077425037L; /**

    • ip地址 */ private String ip;

      /**

    • 白名单—0,黑名单—1 */ private Integer whitelists;

      /**

    • 模块 */ private String module;

      /**

    • 创建时间 */ private Date createTime;

      /**

    • 修改时间 */ private Date modifyTime; }
  2. - **Mapper接口IpFilterMapper**
  4. ```java
  5. import com.demo.common.entity.IpFilter;
  6. import org.apache.ibatis.annotations.*;
  7. import org.springframework.stereotype.Component;
  9. import java.util.List;
  11. @Mapper
  12. @Component
  13. public interface IpFilterMapper {
  14.     /**
  15.      * 从数据库中查询IP是否存在
  16.      *
  17.      * @param ipFilter
  18.      * @return
  19.      */
  20.     @Select("select * from ip_filter where ip = #{query.ip} and whitelists=#{query.whitelists}")
  21.     @Results(
  22.             id = "ipFilterMessage",
  23.             value = {
  24.                     @Result(column = "ip", property = "ip"),
  25.                     @Result(column = "module", property = "module"),
  26.                     @Result(column = "whitelists", property = "whitelists"),
  27.                     @Result(column = "create_time", property = "createTime"),
  28.                     @Result(column = "modifyTime", property = "modify_time")
  29.             }
  30.     )
  31.     List<IpFilter> selectIpFilterByRealIp(@Param("query") IpFilter ipFilter);
  32. }

获取工具类IPUtils

  1. import javax.servlet.http.HttpServletRequest;
  3. /**
  4.  * 获取用户的IP
  5.  */
  7. public class IPUtils {
  8.    /**
  9.      * 本地IP localhost
  10.      */
  11.     private static final String NATIVEIP = "0:0:0:0:0:0:0:1";
  13.     /**
  14.      * 获取用户真实IP地址，不使用request.getRemoteAddr()的原因是有可能用户使用了代理软件方式避免真实IP地址,
  15.      * 可是，如果通过了多级反向代理的话，X-Forwarded-For的值并不止一个，而是一串IP值
  16.      *
  17.      * @return ip
  18.      */
  19.     public static String getRealIP(HttpServletRequest request) {
  20.         String ip = request.getHeader("x-forwarded-for");
  21.         if (ip != null && ip.length() != 0 && !"unknown".equalsIgnoreCase(ip)) {
  22.             // 多次反向代理后会有多个ip值，第一个ip才是真实ip
  23.             if (ip.indexOf(",") != -1) {
  24.                 ip = ip.split(",")[0];
  25.             }
  26.         }
  27.         if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
  28.             ip = request.getHeader("Proxy-Client-IP");
  29.             System.out.println("Proxy-Client-IP ip: " + ip);
  30.         }
  31.         if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
  32.             ip = request.getHeader("WL-Proxy-Client-IP");
  33.             System.out.println("WL-Proxy-Client-IP ip: " + ip);
  34.         }
  35.         if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
  36.             ip = request.getHeader("HTTP_CLIENT_IP");
  37.             System.out.println("HTTP_CLIENT_IP ip: " + ip);
  38.         }
  39.         if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
  40.             ip = request.getHeader("HTTP_X_FORWARDED_FOR");
  41.             System.out.println("HTTP_X_FORWARDED_FOR ip: " + ip);
  42.         }
  43.         if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
  44.             ip = request.getHeader("X-Real-IP");
  45.             System.out.println("X-Real-IP ip: " + ip);
  46.         }
  47.         if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
  48.             ip = request.getRemoteAddr();
  49.             System.out.println("getRemoteAddr ip: " + ip);
  50.         }
  51.           if (ip.equals(NATIVEIP)) {
  52.             ip = "127.0.0.1";
  53.             System.out.println("get native ip" + ip);
  54.         }
  55.         return ip;
  56.     }
  57. }

拦截器IPInterceptor

  1. import com.demo.common.entity.IpFilter;
  2. import com.demo.common.mapper.IpFilterMapper;
  3. import com.demo.common.utils.IPUtils;
  4. import org.apache.commons.lang3.StringUtils;
  5. import org.slf4j.Logger;
  6. import org.slf4j.LoggerFactory;
  7. import org.springframework.beans.factory.annotation.Autowired;
  8. import org.springframework.stereotype.Component;
  9. import org.springframework.web.servlet.HandlerInterceptor;
  10. import org.springframework.web.servlet.ModelAndView;
  12. import javax.servlet.http.HttpServletRequest;
  13. import javax.servlet.http.HttpServletResponse;
  14. import java.util.List;
  16. /**
  17.  * IP 拦截器
  18.  */
  19. @Component
  20. public class IPInterceptor implements HandlerInterceptor {
  21.     private static Logger LOG = LoggerFactory.getLogger(IPInterceptor.class);
  23.     @Autowired
  24.     private IpFilterMapper ipFilterMapper;
  26.     @Override
  27.     public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
  28.         //过滤ip,若用户在白名单内，则放行
  29.         String ipAddress = IPUtils.getRealIP(request);
  30.         LOG.info("USER IP ADDRESS IS =>" + ipAddress);
  31.         if (!StringUtils.isNotBlank(ipAddress)) {
  32.             return false;
  33.         }
  34.         IpFilter ipFilter = new IpFilter();
  35.         //可以访问模块
  36.         ipFilter.setModule("test");
  37.         //ip地址
  38.         ipFilter.setIp(ipAddress);
  39.         //白名单
  40.         ipFilter.setWhitelists(0);
  42.         List<IpFilter> ips = ipFilterMapper.selectIpFilterByRealIp(ipFilter);
  43.         if (ips.isEmpty()) {
  44.             response.getWriter().append("<h1 style=\"text-align:center;\">Not allowed!</h1>");
  45.             return false;
  46.         }
  47.         return true;
  48.     }
  51.     @Override
  52.     public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler, ModelAndView modelAndView) throws Exception {
  54.     }
  57.     @Override
  58.     public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex) throws Exception {
  60.     }
  61. }

全局配置拦截

  2. import com.demo.common.interceptor.IPInterceptor;
  3. import org.springframework.beans.factory.annotation.Autowired;
  4. import org.springframework.context.annotation.Configuration;
  5. import org.springframework.web.servlet.config.annotation.CorsRegistry;
  6. import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
  7. import org.springframework.web.servlet.config.annotation.WebMvcConfigurerAdapter;
  10. @Configuration
  11. public class GlobalCorsConfig extends WebMvcConfigurerAdapter {
  12.     @Autowired
  13.     private IPInterceptor ipInterceptor;
  15.     @Override
  16.     public void addInterceptors(InterceptorRegistry registry) {
  17.         // 添加拦截器，配置拦截地址,这里拦截以api请求的接口比如http://localhost/api/getUser
  18.         registry.addInterceptor(ipInterceptor).addPathPatterns("/api/**");
  19.     }
  21.   /** 
  22.   //跨域请求拦截器
  23.   @Override
  24.     public void addCorsMappings(CorsRegistry registry) {
  25.         registry.addMapping("/**")
  26.                 .allowCredentials(true)
  27.                 .allowedHeaders("*")
  28.                 .allowedOrigins("*")
  29.                 .allowedMethods("*");
  31.     }*/
  32. }

END

这里还没有做限流处理，下次考虑试下限流。