SpringCloudZuul详解篇自定义路由，鉴权，重试，限流

Zuul网关过滤器||||鉴权校验、动态路由

路由介绍

/** * Zuul过滤器，必须继承ZuulFilter父类。 * 当前类型的对象必须交由Spring容器管理。使用@Component注解描述。 * 继承父类后，必须实现父类中定义的4个抽象方法。 * shouldFilter、 run、 filterType、 filterOrder */ @Component public class TestFilter extends ZuulFilter { /** * 返回boolean类型。代表当前filter是否生效。 * 默认值为false。 * 返回true代表开启filter。 */ @Override public boolean shouldFilter() { //具体逻辑 if(true){ return true }else{ return false } } /** * run方法就是过滤器的具体逻辑。 * return 可以返回任意的对象，当前实现忽略。（spring-cloud-zuul官方解释） * 直接返回null即可。 */ @Override public Object run() throws ZuulException { // 通过zuul，获取请求上下文 RequestContext ctx = RequestContext.getCurrentContext(); HttpServletRequest request = ctx.getRequest(); if(false){ ctx.setResponseStatusCode(401); //设置为flase,不会继续往下执行 不会调用服务接口了 网关直接响应给客户 ctx.setSendZuulResponse(false); //设置返回内容类型及编码 ctx.getResponse().setContentType("text/html;charset=UTF-8"); ctx.setResponseBody("Token认证失败......"); } return null; } /** * 过滤器的类型。可选值有： * pre - 前置过滤 * route - 路由后过滤 * error - 异常过滤 * post - 远程服务调用后过滤 */ @Override public String filterType() { return "pre"; } /** * 同种类的过滤器的执行顺序。 * 按照返回值的自然升序执行。 */ @Override public int filterOrder() { return 0; } }

++++++++网关鉴权案列，具体的逻辑自己替换即可+++++++++++++

1、前置路由鉴权

@Component public class AuthorizedFilter extends ZuulFilter { Logger logger = LogManager.getLogger(getClass()); @Override public String filterType() { return "pre"; } @Override public int filterOrder() { return 0; } @Override public boolean shouldFilter() { return true; } @Override public Object run() { Date sttime = new Date(); RequestContext ctx = RequestContext.getCurrentContext(); ctx.set("dt", sttime); HttpServletRequest req = ctx.getRequest(); String requestType = req.getMethod(); String requestURL = req.getRequestURL().toString(); logger.info("Gataway请求URI: " + requestURL); //日志记录通道 if (requestURL.contains("loger")) { logger.info("记录插入开始........."); return null; } //获取Token通道 if (getToken(ctx, req, requestURL)) { return null; } //验证参数 LinkedHashMap<String,String> validationParam=new LinkedHashMap<>(); //验证参数在head中的验证 Boolean bl = "routeServer".equals(req.getHeader("routeServer")); Boolean paramCheak; if(bl){ //获取验证参数,返回布尔(参数在header中) paramCheak= getHeaderParam(req, validationParam,ctx); }else { //获取验证参数,返回布尔(参数在body或请求链接中) paramCheak= getValidationParam(ctx,req, requestType, validationParam); } //跟踪标识 String identification = getIdentification(validationParam); logger.info(identification+"请求方式类型:" + requestType); //参数校检 if(!paramCheak){ logger.error(identification+"参数传递错误......"); ctx.setResponseStatusCode(401); ctx.setSendZuulResponse(false); //设置返回内容类型及编码 ctx.getResponse().setContentType("text/html;charset=UTF-8"); ctx.setResponseBody("校检参数传递错误......"); } //验证Token Boolean tokenCheck = checkToken(req,validationParam); if (tokenCheck) { logger.info(identification+"Token校验通过........"); } else { logger.info(identification+"Token校验不通过........"); ctx.setResponseStatusCode(401); ctx.setSendZuulResponse(false); //设置返回内容类型及编码 ctx.getResponse().setContentType("text/html;charset=UTF-8"); ctx.setResponseBody("Token认证失败......"); } return null; } /** *获取验证参数,在header中 * */ private Boolean getHeaderParam(HttpServletRequest req,LinkedHashMap<String, String> validationParam,RequestContext ctx) { String token = req.getHeader("token"); String consumerName = req.getHeader("consumerName"); String consumerIp = req.getHeader("consumerIp"); String consumerMark = req.getHeader("consumerMark"); String uuid = req.getHeader("uuid"); if(StringUtils.isEmpty(uuid)){ //网关进入获取不到uuid，自己生成 uuid=getUuid(); } setUuid(ctx, req, uuid); ctx.set("uuid",uuid); validationParam.put("uuid",uuid); validationParam.put("token",token); validationParam.put("consumerName",consumerName); validationParam.put("consumerIp",consumerIp); //系统用户和管理员标识，否则认定普通用户 validationParam.put("consumerMark",consumerMark); return true; } /** *获取验证参数 * */ private Boolean getValidationParam(RequestContext ctx,HttpServletRequest req, String requestType, LinkedHashMap<String, String> validationParam) { if ("GET".equals(requestType) || "DELETE".equals(requestType)) { validationParam.put("token",req.getParameter("token")); validationParam.put("consumerName",req.getParameter("consumerName")); validationParam.put("consumerIp",req.getParameter("consumerIp")); //系统用户和管理员标识，否则认定普通用户 validationParam.put("consumerMark",req.getParameter("consumerMark")); String uuid = req.getParameter("uuid"); if(StringUtils.isEmpty(uuid)){ //网关进入获取不到uuid，自己生成 uuid=getUuid(); } setUuid(ctx, req, uuid); ctx.set("uuid",uuid); validationParam.put("uuid",uuid); return true; } if ("POST".equals(requestType) || "PUT".equals(requestType)) { RequestWrapper requestWrapper = new RequestWrapper(req); String body = requestWrapper.getBody(); try { JsonAndSqlUtils<AuthorizedDTO> jsonandsqlutils = new JsonAndSqlUtils(); AuthorizedDTO authorizedDTO = jsonandsqlutils.jsonTObject(body, AuthorizedDTO.class); validationParam.put("token",authorizedDTO.getToken()); validationParam.put("consumerName",authorizedDTO.getConsumerName()); validationParam.put("consumerIp",authorizedDTO.getConsumerIp()); validationParam.put("consumerIp",authorizedDTO.getConsumerIp()); String uuid = authorizedDTO.getUuid(); if(StringUtils.isEmpty(uuid)){ //网关进入获取不到uuid，自己生成 uuid=getUuid(); } setUuid(ctx, req, uuid); ctx.set("uuid",uuid); validationParam.put("uuid",uuid); //系统用户和管理员标识，否则认定普通用户 validationParam.put("consumerMark",authorizedDTO.getConsumerMark()); return true; } catch (IOException e) { logger.error("参数传递错误......", e); return false; } } return false; } /** *标识跟踪 * */ private String getIdentification(LinkedHashMap<String,String> validationParam){ String consumerName = validationParam.get("consumerName"); String uuid = validationParam.get("uuid"); return consumerName+"_"+uuid+" "; } /** *校检Token * */ private Boolean checkToken(HttpServletRequest req,LinkedHashMap<String,String> validationParam) { String token = validationParam.get("token"); String consumerName = validationParam.get("consumerName"); String consumerIp = validationParam.get("consumerIp"); String consumerMark = validationParam.get("consumerMark"); //跟踪标识 String identification = getIdentification(validationParam); //校检后的token String tokenAuthorized = ""; LocalDate now = LocalDate.now(); //时间字符串 String dt = now.toString(); //系统用户和管理员 if ("1".equals(consumerMark) || "2".equals(consumerMark)) { String log = "1".equals(consumerMark) ? "系统用户" : "管理员"; logger.info(identification+log + ":校检TOKEN......"); String ipAddr = consumerIp; if (consumerIp == null || "".equals(consumerIp)) { ipAddr = IpUtils.getIpAddr(req); } logger.info(identification+"网关获取系统IP:" + ipAddr); tokenAuthorized = Md5Utils.getMD5(consumerName + ipAddr); } else { logger.info(identification+"普通用户校检TOKEN......"); logger.info(identification+"网关获取普通用户IP:"+ consumerIp); tokenAuthorized = Md5Utils.getMD5(consumerName + consumerIp + dt); } logger.info(identification+"传递token为:" + token); logger.info(identification+"校检token为:" + tokenAuthorized); boolean equals = tokenAuthorized.equals(token); return equals; } /** *获取token * */ private boolean getToken(RequestContext ctx, HttpServletRequest req, String requestURL) { if (requestURL.contains("getTokenByPostMethod") || requestURL.contains("getTokenByGetMethod") || requestURL.contains("getTokenWithAdmin")) { //判定从transfer进入，客户端IP已经传递 if ("transfer".equals(req.getParameter("transfer")) || "transfer".equals(req.getHeader("transfer"))) { logger.info("transfer获取Token,校检通过........."); return true; } else { //管理员获取token if (requestURL.contains("getTokenWithAdmin")) { logger.info("网关获取Token,校检通过........."); return true; } //由网关直接进入属于系统用户，在网关里面获取ip String ipAddr = IpUtils.getIpAddr(req); logger.info("获取token系统IP :" + ipAddr); // 一定要get一下,requestQueryParams才能取到值 req.getParameterMap(); Map<String, List<String>> requestQueryParams = ctx.getRequestQueryParams(); if (requestQueryParams == null) { requestQueryParams = new HashMap<>(); } ArrayList<String> paramsList = new ArrayList<>(); paramsList.add(ipAddr); requestQueryParams.put("ipAddr", paramsList); ctx.setRequestQueryParams(requestQueryParams); logger.info("网关获取Token,校检通过........."); return true; } } return false; } /** *设置跟踪标识到后续服务 * */ private void setUuid(RequestContext ctx, HttpServletRequest req, String uuid) { // 一定要get一下,requestQueryParams才能取到值 req.getParameterMap(); Map<String, List<String>> requestQueryParams = ctx.getRequestQueryParams(); if (requestQueryParams == null) { requestQueryParams = new HashMap<>(); } ArrayList<String> paramsList = new ArrayList<>(); paramsList.add(uuid); requestQueryParams.put("uuid", paramsList); ctx.setRequestQueryParams(requestQueryParams); } }

2、+++兼容业务自定义路由+++

@Component public class RouteFilter extends ZuulFilter { @Value("${zullurl}") private String zullurl; //判定系统是否记录日志 @Value("${logServer}") private String logServer; Logger logger = LogManager.getLogger(getClass()); @Autowired RestTemplate restTemplate; @Override public String filterType() { return FilterConstants.ROUTE_TYPE; } @Override public int filterOrder() { return 1; } @Override public boolean shouldFilter() { return true; } @Override public Object run() { RequestContext ctx = RequestContext.getCurrentContext(); //更具业务逻辑切换服务 if(false){ ctx.put(FilterConstants.PROXY_KEY,"idxs-service");//服务名称 ctx.put(FilterConstants.SERVICE_ID_KEY,"idxs-service");//服务名称 ctx.put(FilterConstants.REQUEST_URI_KEY,"/idxsPostApi");//服务的url } return null; } }

3、+++最后记录日志等操作+++

/** * @Author:zenglengceng * @Remark 请求成功或失败 记录日志到数据库 * @Date: Created in 2019/05/27 15:40 */ @Component public class PostFilter extends ZuulFilter { @Value("${zullurl}") private String zullurl; //判定系统是否记录日志 @Value("${logServer}") private String logServer; Logger logger = LogManager.getLogger(getClass()); @Autowired RestTemplate restTemplate; @Override public String filterType() { return "post"; } @Override public int filterOrder() { return 2; } @Override public boolean shouldFilter() { //正常不需要拦截的在这里放行就好了return false即可 return true; } @Override public Object run() { RequestContext ctx = RequestContext.getCurrentContext(); HttpServletResponse response = ctx.getResponse(); HttpServletRequest req = ctx.getRequest(); String requestType = req.getMethod(); String requestURL = req.getRequestURL().toString(); if (requestURL.contains("loger") || requestURL.contains("error")) { logger.info("记录插入结束........."); return null; } if (requestURL.contains("getTokenByPostMethod") || requestURL.contains("getTokenByGetMethod") || requestURL.contains("getTokenWithAdmin")) { logger.info("用户获取Token结束........."); return null; } Date startTmie = (Date) ctx.get("dt"); Date endTime = new Date(); //获取代理 String micro = (String) ctx.get("proxy"); String consumerIp = ""; String indexcode = ""; String param = ""; String consumerName = ""; String uuid = ""; String identification=""; if (isaBoolean(requestType, micro)) { RequestWrapper requestWrapper = new RequestWrapper(req); String body = requestWrapper.getBody(); JsonAndSqlUtils<AuthorizedDTO> jsonandsqlutils = new JsonAndSqlUtils(); try { AuthorizedDTO authorizedDTO = jsonandsqlutils.jsonTObject(body, AuthorizedDTO.class); consumerIp = authorizedDTO.getConsumerIp(); param = authorizedDTO.getParam() != null ? authorizedDTO.getParam().toString() : ""; if (consumerIp == null) { consumerIp = req.getRemoteAddr(); } indexcode = authorizedDTO.getIndexcode(); uuid = authorizedDTO.getUuid(); if(StringUtils.isEmpty(uuid)){ uuid=(String)ctx.get("uuid"); } consumerName = authorizedDTO.getConsumerName(); } catch (IOException e) { logger.error("访问的微服务为："+micro); logger.error(micro+"传递参数为：["+body+"]"); logger.error("参数转换错误", e); } identification = getIdentification(consumerName, uuid); insertRecord(response, startTmie, endTime, consumerName, consumerIp, indexcode, param, micro,identification); } return null; } private boolean isaBoolean(String requestType, String micro) { String[] split = logServer.split(","); List<String> list = new ArrayList<>(); if (split.length > 0) { list = Arrays.asList(split); } boolean bl = ("POST".equals(requestType) || "PUT".equals(requestType) || "DELETE".equals(requestType)) && list.stream().anyMatch(x -> micro.equals(x)); return bl; } private void insertRecord(HttpServletResponse response, Date startTmie, Date endTime,String consumerCode, String consumerIp, String indexcode, String body, String micro,String identification) { int status = response.getStatus(); if (status == 200) { logger.info(identification+"[指标:"+indexcode+"] 服务调用完成..........."); String result = "SUCCESS"; HttpHeaders header = new HttpHeaders(); //设置请求参数传播类型 header.setContentType(MediaType.valueOf(MediaType.APPLICATION_JSON_VALUE)); DmspIdxAccessRecDTO dmspidxaccessrecdto = setParam(startTmie, endTime, consumerCode, consumerIp, indexcode, body, status, result, micro); HttpEntity<DmspIdxAccessRecDTO> httpEntity = new HttpEntity<>(dmspidxaccessrecdto, header); try { restTemplate.postForObject(zullurl + "public-service/loger/insertMicroserviceRecord", httpEntity, String.class); } catch (RestClientResponseException ex) { //捕获非200状态码异常 logger.error("记录插入失败", ex); } } else { logger.error(identification+"[指标:"+indexcode+"] 服务调用失败..........."); String result = "FAILD"; HttpHeaders header = new HttpHeaders(); //设置请求参数传播类型 header.setContentType(MediaType.valueOf(MediaType.APPLICATION_JSON_VALUE)); DmspIdxAccessRecDTO dmspidxaccessrecdto = setParam(startTmie, endTime, consumerCode, consumerIp, indexcode, body, status, result, micro); HttpEntity<DmspIdxAccessRecDTO> httpEntity = new HttpEntity<>(dmspidxaccessrecdto, header); try { restTemplate.postForObject(zullurl +"public-service/loger/insertMicroserviceRecord", httpEntity, String.class); } catch (RestClientResponseException ex) { //捕获非200状态码异常 logger.error("记录插入失败", ex); } } } private DmspIdxAccessRecDTO setParam(Date startTmie, Date endTime, String consumerCode, String consumerIp, String indexcode, String body, int status, String result, String micro) { DmspIdxAccessRecDTO dmspidxaccessrecdto = new DmspIdxAccessRecDTO(); dmspidxaccessrecdto.setConsumerIp(consumerIp); dmspidxaccessrecdto.setConsumerCode(consumerCode); dmspidxaccessrecdto.setRuleCode(indexcode); dmspidxaccessrecdto.setParams(body); dmspidxaccessrecdto.setStartDate(startTmie); dmspidxaccessrecdto.setEndDate(endTime); dmspidxaccessrecdto.setResult(result); dmspidxaccessrecdto.setMicroService(micro); if (status != 200) { dmspidxaccessrecdto.setErrorCode(String.valueOf(status)); } return dmspidxaccessrecdto; } /** *标识跟踪 * */ private String getIdentification(String consumerName,String uuid){ String result=consumerName+"_"+uuid; return result; }

Zuul网关的限流保护(默认false)

Zuul网关组件也提供了限流保护。当请求并发达到阀值，自动触发限流保护 1、依赖 <dependency> <groupId>com.marcosbarbero.cloud</groupId> <artifactId>spring-cloud-zuul-ratelimit</artifactId> <version>1.3.4.RELEASE</version> </dependency> --全局限流配置 #按粒度拆分的临时变量key前缀 zuul.ratelimit.key-prefix=springcloud-book zuul.ratelimit.enabled=true #key存储类型，默认是IN_MEMORY本地内存，此外还有多种形式 zuul.ratelimit.repository=IN_MEMORY zuul.ratelimit.behind-proxy=true #在一个单位时间窗口的请求数量 zuul.ratelimit.default-policy.limit=500 #在一个单位时间窗口的请求时间限制 zuul.ratelimit.default-policy.quota=2000 #单位时间窗口 zuul.ratelimit.default-policy.refresh-interval=60 #可指定限流粒度，user-用户粒度，origin-客户端地址粒度，url-url粒度 zuul.ratelimit.default-policy.type=url 另一种方法在过滤器中限制 //每秒产生1000个令牌 private static final RateLimiter RATE_LIMITER = RateLimiter.create(1000); //相当于每调用一次tryAcquire()方法，令牌数量减1，当1000个用完后，那么后面进来的用户无法访问上面接口 RATE_LIMITER.tryAcquire()

Zuul重试机制

1、依赖

org.springframework.retry spring-retry

2、如果Hystrix超时，直接返回超时异常。如果ribbon超时，同时Hystrix未超时，ribbon会自动进行服务集群轮询重试，直到 Hystrix超时为止。如果Hystrix超时时长小于ribbon超时时长，ribbon不会进行服务集群轮询重试。

配置如下 # 开启zuul网关重试 zuul.retryable=true # hystrix超时时间设置 # 线程池隔离，默认超时时间1000ms hystrix.command.default.execution.isolation.thread.timeoutInMilliseconds=8000 # ribbon超时时间设置：建议设置比Hystrix小 # 请求连接的超时时间: 默认5000ms ribbon.ConnectTimeout=5000 # 请求处理的超时时间: 默认5000ms ribbon.ReadTimeout=5000 # 重试次数：MaxAutoRetries表示访问服务集群下原节点（同路径访问）；MaxAutoRetriesNextServer表示访问服务集群下其余节点（换台服务器） ribbon.MaxAutoRetries=1 ribbon.MaxAutoRetriesNextServer=1 # 开启重试 ribbon.OkToRetryOnAllOperations=true

Zuul端转发请求的线程数与Service端处理请求的线程数的关系：

限制一：单点部署的Zuul同时处理的最大线程数为server.tomcat.max-threads；

限制二：向所有后端Service同时转发的请求数的最大值为server.tomcat.max-threads、ribbon.MaxTotalConnections和zuul.semaphore.max-semaphores的最小值，这也是所有后端Service能够同时处理请求的最大并发线程数；

限制三：单个后端Service能同时处理的最大请求数为其server.tomcat.max-threads和ribbon.MaxConnectionsPerHost中的最小值。

注意：很多博客提到使用zuul.host.maxTotalConnections与zuul.host.maxPerRouteConnections这两个参数。经过查阅和实践，这两个参数在使用Service ID配置Zuul的路由规则时无效，只适用于指定微服务的url配置路由的情景。