AspNetCore新增API限流

最近發現有客戶在大量的請求我們的介面，出於效能考慮遂新增了請求頻率限制。

由於我們介面請求的是.Net Core寫的API閘道器，所以可以直接新增一箇中介軟體，中介軟體中使用請求的地址當key，通過配置中心讀取對應的請求頻率引數設定，然後通過設定redis的過期時間就能實現了。

新增一箇中介軟體ApiThrottleMiddleware，使用httpContext.Request.Path獲取請求的介面，然後以次為key去讀取配置中心設定的請求頻率設定。（Ps：使用_configuration.GetSection(apiUrl).Get<ApiThrottleConfig>()不知為何返回值為null，這個還在查）

    public class ApiThrottleMiddleware
    {
        private readonly RequestDelegate _next;
        private IConfiguration _configuration;
        private readonly IRedisRunConfigDatabaseProvider _redisRunConfigDatabaseProvider;
        private readonly IDatabase _database;

        public ApiThrottleMiddleware(RequestDelegate next,
            IConfiguration configuration,
            IRedisRunConfigDatabaseProvider redisRunConfigDatabaseProvider)
        {
            _next = next;
            _configuration = configuration;
            _redisRunConfigDatabaseProvider = redisRunConfigDatabaseProvider;
            _database = _redisRunConfigDatabaseProvider.GetDatabase();
        }

        public async Task Invoke(HttpContext httpContext)
        {
            var middlewareContext = httpContext.GetOrCreateMiddlewareContext();
            var apiUrl = httpContext.Request.Path.ToString();

            var jsonValue= _configuration.GetSection(apiUrl).Value;
            var apiThrottleConfig=JsonConvert.DeserializeObject<ApiThrottleConfig>(jsonValue);
            //var apiThrottleConfig = _configuration.GetSection(apiUrl).Get<ApiThrottleConfig>();
            
            await _next.Invoke(httpContext);
        }
}

 

我們使用的配置中心是Apollo，設定的格式如下，其中Duration為請求間隔/秒，Limit為呼叫次數。（下圖設定為每分鐘允許請求10次）

 

 

（Ps： 由於在API限流中介軟體前我們已經通過了一個介面簽名驗證的中介軟體了，所以我們可以拿到呼叫客戶的具體資訊）

如果請求地址沒有配置請求頻率控制，則直接跳過。否則先通過SortedSetLengthAsync獲取對應key的記錄數，其中key我們使用了 $"{客戶Id}:{外掛編碼}:{請求地址}"，以此來限制每個客戶，每個外掛對應的某個介面來控制請求頻率。獲取key對應集合，當前時間-配置的時間段到當前時間的記錄。

        /// <summary>
        /// 獲取key
        /// </summary>
        /// <param name="signInfo"></param>
        /// <param name="apiUrl">介面地址</param>
        /// <returns></returns>
        private string GetApiRecordKey(InterfaceSignInfo signInfo,string apiUrl)
        {
            var key = $"{signInfo.LicNo}:{signInfo.PluginCode}:{apiUrl}";
            return key;
        }

        /// <summary>
        /// 獲取介面呼叫次數
        /// </summary>
        /// <param name="signInfo"></param>
        /// <param name="apiUrl">介面地址</param>
        /// <param name="duration">超時時間</param>
        /// <returns></returns>
        public async Task<long> GetApiRecordCountAsync(InterfaceSignInfo signInfo, string apiUrl, int duration)
        {
            var key = GetApiRecordKey(signInfo, apiUrl);
            var nowTicks = DateTime.Now.Ticks;
            return await _database.SortedSetLengthAsync(key, nowTicks - TimeSpan.FromSeconds(duration).Ticks, nowTicks);
        }        

如果請求次數大於等於我們設定的頻率就直接返回介面呼叫頻率超過限制錯誤，否則則在key對應的集合中新增一條記錄，同時將對應key的過期時間設定為我們配置的限制時間。

        /// <summary>
        /// 獲取介面呼叫次數
        /// </summary>
        /// <param name="signInfo"></param>
        /// <param name="apiUrl">介面地址</param>
        /// <param name="duration">超時時間</param>
        /// <returns></returns>
        public async Task<long> GetApiRecordCountAsync(InterfaceSignInfo signInfo, string apiUrl, int duration)
        {
            var key = GetApiRecordKey(signInfo, apiUrl);
            var nowTicks = DateTime.Now.Ticks;
            return await _database.SortedSetLengthAsync(key, nowTicks - TimeSpan.FromSeconds(duration).Ticks, nowTicks);
        }

　然後只需要在Startup中，在API簽名驗證中介軟體後呼叫我們這個API限流中介軟體就行了。

　　以下為完整的程式碼

 

using ApiGateway.Core.Configuration;
using ApiGateway.Core.Domain.Authentication;
using ApiGateway.Core.Domain.Configuration;
using ApiGateway.Core.Domain.Errors;
using Microsoft.AspNetCore.Http;
using Microsoft.Extensions.Configuration;
using Newtonsoft.Json;
using StackExchange.Redis;
using System;
using System.Threading.Tasks;

namespace ApiGateway.Core.Middleware.Api
{
    /// <summary>
    /// API限流中介軟體
    /// </summary>
    public class ApiThrottleMiddleware
    {
        private readonly RequestDelegate _next;
        private IConfiguration _configuration;
        private readonly IRedisRunConfigDatabaseProvider _redisRunConfigDatabaseProvider;
        private readonly IDatabase _database;

        public ApiThrottleMiddleware(RequestDelegate next,
            IConfiguration configuration,
            IRedisRunConfigDatabaseProvider redisRunConfigDatabaseProvider)
        {
            _next = next;
            _configuration = configuration;
            _redisRunConfigDatabaseProvider = redisRunConfigDatabaseProvider;
            _database = _redisRunConfigDatabaseProvider.GetDatabase();
        }

        public async Task Invoke(HttpContext httpContext)
        {
            var middlewareContext = httpContext.GetOrCreateMiddlewareContext();
            var apiUrl = httpContext.Request.Path.ToString();

            var jsonValue= _configuration.GetSection(apiUrl).Value;
            var apiThrottleConfig=JsonConvert.DeserializeObject<ApiThrottleConfig>(jsonValue);
            //var apiThrottleConfig = _configuration.GetSection(apiUrl).Get<ApiThrottleConfig>();
            if (apiThrottleConfig!=null)
            {
                var count = await GetApiRecordCountAsync(middlewareContext.InterfaceSignInfo, apiUrl, apiThrottleConfig.Duration);
                if (count >= apiThrottleConfig.Limit)
                {
                    middlewareContext.Errors.Add(new Error("介面呼叫頻率超過限制", GatewayErrorCode.OverThrottleError));
                }
                else
                {
                    await AddApiRecordCountAsync(middlewareContext.InterfaceSignInfo, apiUrl, apiThrottleConfig.Duration);
                }
            }
            
            await _next.Invoke(httpContext);
        }

        /// <summary>
        /// 獲取介面呼叫次數
        /// </summary>
        /// <param name="signInfo"></param>
        /// <param name="apiUrl">介面地址</param>
        /// <param name="duration">超時時間</param>
        /// <returns></returns>
        public async Task<long> GetApiRecordCountAsync(InterfaceSignInfo signInfo, string apiUrl, int duration)
        {
            var key = GetApiRecordKey(signInfo, apiUrl);
            var nowTicks = DateTime.Now.Ticks;
            return await _database.SortedSetLengthAsync(key, nowTicks - TimeSpan.FromSeconds(duration).Ticks, nowTicks);
        }

        /// <summary>
        /// 新增呼叫次數
        /// </summary>
        /// <param name="signInfo"></param>
        /// <param name="apiUrl">介面地址</param>
        /// <param name="duration">超時時間</param>
        /// <returns></returns>
        public async Task AddApiRecordCountAsync(InterfaceSignInfo signInfo, string apiUrl, int duration)
        {
            var key = GetApiRecordKey(signInfo, apiUrl);
            var nowTicks = DateTime.Now.Ticks;
            await _database.SortedSetAddAsync(key, nowTicks.ToString(), nowTicks);
            await _database.KeyExpireAsync(key, TimeSpan.FromSeconds(duration));
        }

        /// <summary>
        /// 獲取key
        /// </summary>
        /// <param name="signInfo"></param>
        /// <param name="apiUrl">介面地址</param>
        /// <returns></returns>
        private string GetApiRecordKey(InterfaceSignInfo signInfo,string apiUrl)
        {
            var key = $"{signInfo.LicNo}:{signInfo.PluginCode}:{apiUrl}";
            return key;
        }
    }
}