public class RateLimiterExample {
    // 創(chuàng)建一個(gè)RateLimiter，每秒允許10個(gè)請(qǐng)求
    private static final RateLimiter rateLimiter = RateLimiter.create(10);

    public static boolean tryAcquire() {
        return rateLimiter.tryAcquire();
    }
}

@RestController
public class ExampleController {
    @GetMapping("/example")
    public ResponseEntity<String> example() {
        if (!RateLimiterExample.tryAcquire()) {
            return ResponseEntity.status(HttpStatus.TOO_MANY_REQUESTS).body("請(qǐng)求過于頻繁，請(qǐng)稍后再試");
        }
        // 處理正常業(yè)務(wù)邏輯
        return ResponseEntity.ok("成功響應(yīng)");
    }
}

public class ReplayAttackInterceptor implements HandlerInterceptor {
    private static final Set<String> nonceSet = ConcurrentHashMap.newKeySet();
    private static final long EXPIRE_TIME = 5 * 60; // 5分鐘有效期，單位秒

    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
        String appId = request.getHeader("appId");
        String nonce = request.getHeader("nonce");
        String timestamp = request.getHeader("timestamp");

        if (appId == null || nonce == null || timestamp == null) {
            response.setStatus(HttpStatus.BAD_REQUEST.value());
            returnfalse;
        }

        long currentTime = System.currentTimeMillis() / 1000;
        if (currentTime - Long.parseLong(timestamp) > EXPIRE_TIME) {
            response.setStatus(HttpStatus.REQUEST_TIMEOUT.value());
            returnfalse;
        }

        String key = appId + nonce;
        if (nonceSet.contains(key)) {
            response.setStatus(HttpStatus.CONFLICT.value());
            returnfalse;
        }

        nonceSet.add(key);
        // 設(shè)置過期時(shí)間，避免nonceSet無限增長(zhǎng)
        ScheduledExecutorService executorService = Executors.newSingleThreadScheduledExecutor();
        executorService.schedule(() -> nonceSet.remove(key), EXPIRE_TIME, TimeUnit.SECONDS);
        executorService.shutdown();

        returntrue;
    }

    @Override
    public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler, ModelAndView modelAndView) throws Exception {
        // 處理后邏輯，可空
    }

    @Override
    public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex) throws Exception {
        // 完成后邏輯，可空
    }
}

@Configuration
public class WebMvcConfig implements WebMvcConfigurer {
    @Override
    public void addInterceptors(InterceptorRegistry registry) {
        registry.addInterceptor(new ReplayAttackInterceptor())
               .addPathPatterns("/**"); // 攔截所有接口
    }
}

@Retention(RetentionPolicy.RUNTIME)
@Target(ElementType.METHOD)
public @interface SignCheck {
    boolean required() default true;
}

public class SignCheckInterceptor implements HandlerInterceptor {
    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
        if (!(handler instanceof HandlerMethod)) {
            returntrue;
        }

        HandlerMethod handlerMethod = (HandlerMethod) handler;
        SignCheck signCheck = handlerMethod.getMethodAnnotation(SignCheck.class);
        if (signCheck == null ||!signCheck.required()) {
            returntrue;
        }

        String appId = request.getHeader("appId");
        String timestamp = request.getHeader("timestamp");
        String nonce = request.getHeader("nonce");
        String sign = request.getHeader("sign");

        if (appId == null || timestamp == null || nonce == null || sign == null) {
            response.setStatus(HttpStatus.BAD_REQUEST.value());
            returnfalse;
        }

        // 獲取請(qǐng)求參數(shù)
        Map<String, String[]> parameterMap = request.getParameterMap();
        Map<String, String> paramMap = new TreeMap<>();
        for (Map.Entry<String, String[]> entry : parameterMap.entrySet()) {
            paramMap.put(entry.getKey(), String.join(",", entry.getValue()));
        }

        // 拼接參數(shù)
        StringBuilder paramBuilder = new StringBuilder();
        for (Map.Entry<String, String> entry : paramMap.entrySet()) {
            paramBuilder.append(entry.getKey()).append("=").append(entry.getValue()).append("&");
        }
        paramBuilder.append("appSecret=").append(getAppSecret(appId)); // 根據(jù)appId獲取對(duì)應(yīng)的appSecret

        // 計(jì)算簽名
        String serverSign = calculateSign(paramBuilder.toString());

        if (!sign.equals(serverSign)) {
            response.setStatus(HttpStatus.FORBIDDEN.value());
            returnfalse;
        }

        returntrue;
    }

    private String calculateSign(String paramStr) throws Exception {
        MessageDigest md = MessageDigest.getInstance("MD5");
        byte[] digest = md.digest(paramStr.getBytes());
        StringBuilder sb = new StringBuilder();
        for (byte b : digest) {
            sb.append(String.format("%02x", b));
        }
        return sb.toString();
    }

    private String getAppSecret(String appId) {
        // 實(shí)際應(yīng)用中，應(yīng)從數(shù)據(jù)庫(kù)或配置文件中獲取對(duì)應(yīng)的appSecret
        // 這里簡(jiǎn)單示例，返回固定值
        return"your_secret_key";
    }

    @Override
    public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler, ModelAndView modelAndView) throws Exception {
        // 處理后邏輯，可空
    }

    @Override
    public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex) throws Exception {
        // 完成后邏輯，可空
    }
}