API限流和防滥用

// 固定窗口限流伪代码
function isAllowed(key: string, limit: number, windowMs: number): boolean {
  const windowStart = Math.floor(Date.now() / windowMs) * windowMs
  const count = redis.get(`${key}:${windowStart}`)
  if (count >= limit) return false
  redis.incr(`${key}:${windowStart}`)
  redis.expire(`${key}:${windowStart}`, windowMs / 1000)
  return true
}

// 滑动窗口限流伪代码
function isAllowed(key: string, limit: number, windowMs: number): boolean {
  const now = Date.now()
  const currentWindowStart = Math.floor(now / windowMs) * windowMs
  const previousWindowStart = currentWindowStart - windowMs
 
  const currentCount = redis.get(`${key}:${currentWindowStart}`) ?? 0
  const previousCount = redis.get(`${key}:${previousWindowStart}`) ?? 0
 
  // 计算前一窗口的加权比例
  const elapsed = now - currentWindowStart
  const weight = (windowMs - elapsed) / windowMs
 
  const estimatedCount = previousCount * weight + currentCount
  if (estimatedCount >= limit) return false
 
  redis.incr(`${key}:${currentWindowStart}`)
  return true
}

// 令牌桶限流伪代码
function isAllowed(key: string, rate: number, capacity: number): boolean {
  const now = Date.now()
  const bucket = redis.hgetall(key)
 
  const tokens = bucket.tokens ?? capacity
  const lastRefill = bucket.lastRefill ?? now
 
  // 补充令牌
  const elapsed = (now - lastRefill) / 1000
  const newTokens = Math.min(capacity, tokens + elapsed * rate)
 
  if (newTokens < 1) return false
 
  redis.hset(key, {
    tokens: newTokens - 1,
    lastRefill: now,
  })
  return true
}

// Express + Redis 滑动窗口限流中间件
import rateLimit from 'express-rate-limit'
import RedisStore from 'rate-limit-redis'
import Redis from 'ioredis'
 
const redis = new Redis(process.env.REDIS_URL!)
 
const limiter = rateLimit({
  windowMs: 60 * 1000, // 1 分钟
  max: 60, // 每分钟 60 次
  standardHeaders: true, // 返回 X-RateLimit-* 头
  legacyHeaders: false,
  store: new RedisStore({
    sendCommand: (...args) => redis.call(...args),
  }),
  keyGenerator: (req) => {
    // 按 API Key 或 IP 限流
    return req.headers['x-api-key'] ?? req.ip
  },
  handler: (req, res) => {
    res.status(429).json({
      error: 'Too Many Requests',
      retryAfter: res.getHeader('Retry-After'),
    })
  },
})
 
app.use('/api/', limiter)

# Kong Rate Limiting Plugin 配置示例
plugins:
  - name: rate-limiting
    config:
      minute: 60
      hour: 1000
      policy: redis
      redis_host: redis.internal
      redis_port: 6379
      limit_by: consumer  # 按 API Consumer 限流
      hide_client_headers: false
      strategy: fixed-window  # 或 sliding-window

// 客户端限流重试逻辑
async function callApiWithRetry(
  url: string,
  options: RequestInit,
  maxRetries = 3,
): Promise<Response> {
  for (let attempt = 0; attempt < maxRetries; attempt++) {
    const response = await fetch(url, options)
 
    if (response.status === 429) {
      // 读取 Retry-After 头，退避后重试
      const retryAfter = response.headers.get('Retry-After')
      const delay = retryAfter ? parseInt(retryAfter) * 1000 : Math.pow(2, attempt) * 1000
      await new Promise((resolve) => setTimeout(resolve, delay))
      continue
    }
 
    return response
  }
  throw new Error('Max retries exceeded')
}

// API Key 认证中间件
async function authenticateApiKey(req: Request): Promise<ApiKeyInfo> {
  const key = req.headers.get('x-api-key')
  if (!key) throw new UnauthorizedError('Missing API Key')
 
  const keyInfo = await db.apiKeys.findOne({ key: hash(key) })
  if (!keyInfo) throw new UnauthorizedError('Invalid API Key')
  if (keyInfo.revokedAt) throw new UnauthorizedError('API Key revoked')
 
  // 检查 Key 的权限范围
  return keyInfo
}

// 简化的异常检测逻辑
interface RequestLog {
  apiKeyId: string
  timestamp: number
  path: string
  statusCode: number
}
 
function detectAnomaly(recentLogs: RequestLog[]): Anomaly | null {
  const oneMinuteAgo = Date.now() - 60_000
 
  // 检查 1 分钟内的请求数
  const recentCount = recentLogs.filter((l) => l.timestamp > oneMinuteAgo).length
  if (recentCount > 100) {
    return { type: 'FREQUENCY_SPIKE', severity: 'high', count: recentCount }
  }
 
  // 检查是否遍历大量不同路径
  const uniquePaths = new Set(recentLogs.map((l) => l.path))
  if (uniquePaths.size > 50) {
    return { type: 'PATH_SCANNING', severity: 'medium', uniquePaths: uniquePaths.size }
  }
 
  // 检查大量 4xx 错误（可能是暴力试探）
  const errorCount = recentLogs.filter((l) => l.statusCode >= 400).length
  if (errorCount > 30) {
    return { type: 'HIGH_ERROR_RATE', severity: 'high', errorCount }
  }
 
  return null
}

// HMAC 请求签名
function signRequest(body: string, secret: string, timestamp: number): string {
  const payload = `${timestamp}:${body}`
  return crypto.createHmac('sha256', secret).update(payload).digest('hex')
}
 
// 服务端验证
function verifySignature(
  body: string,
  secret: string,
  timestamp: number,
  signature: string,
): boolean {
  // 拒绝超过 5 分钟的旧请求
  if (Date.now() - timestamp > 5 * 60 * 1000) return false
 
  const expected = signRequest(body, secret, timestamp)
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected),
  )
}

# Prometheus 告警规则示例
groups:
  - name: api-abuse-alerts
    rules:
      # 某 API Key 的 429 响应突然增加
      - alert: HighRateLimitRejections
        expr: |
          sum(rate(http_responses_total{status="429"}[5m])) by (api_key) > 10
        for: 5m
        labels:
          severity: warning
        annotations:
          summary: "API Key {{ $labels.api_key }} 频繁触发限流"
 
      # 认证失败率异常
      - alert: HighAuthFailureRate
        expr: |
          sum(rate(http_responses_total{status="401"}[5m])) /
          sum(rate(http_requests_total[5m])) > 0.1
        for: 3m
        labels:
          severity: critical
        annotations:
          summary: "认证失败率超过 10%，可能存在暴力破解"
 
      # 单 IP 请求量异常
      - alert: SingleIPHighTraffic
        expr: |
          sum(rate(http_requests_total[5m])) by (client_ip) > 100
        for: 2m
        labels:
          severity: warning
        annotations:
          summary: "IP {{ $labels.client_ip }} 请求频率异常"