API网关详解：路由、限流与安全

概述

API网关是微服务架构的重要组件。本教程介绍API网关的设计和实现。

1. Spring Cloud Gateway

import org.springframework.cloud.gateway.route.RouteLocator;
import org.springframework.cloud.gateway.route.builder.RouteLocatorBuilder;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

@Configuration
public class GatewayConfig {
    @Bean
    public RouteLocator customRouteLocator(RouteLocatorBuilder builder) {
        return builder.routes()
            .route("user-service", r -> r
                .path("/api/users/**")
                .filters(f -> f
                    .stripPrefix(1)
                    .addRequestHeader("X-Request-Source", "gateway")
                    .retry(config -> config.setRetries(3)))
                .uri("lb://user-service"))
            .route("order-service", r -> r
                .path("/api/orders/**")
                .filters(f -> f.stripPrefix(1))
                .uri("lb://order-service"))
            .build();
    }
}

2. 限流实现

import org.springframework.cloud.gateway.filter.ratelimit.KeyResolver;
import org.springframework.cloud.gateway.filter.ratelimit.RedisRateLimiter;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import reactor.core.publisher.Mono;

@Configuration
public class RateLimitConfig {
    @Bean
    public RedisRateLimiter redisRateLimiter() {
        return new RedisRateLimiter(10, 20);  // 10请求/秒，突发20
    }
    
    @Bean
    public KeyResolver userKeyResolver() {
        return exchange -> Mono.just(
            exchange.getRequest().getRemoteAddress().getAddress().getHostAddress()
        );
    }
}

// 使用限流
.route("rate-limited", r -> r
    .path("/api/limited/**")
    .filters(f -> f
        .requestRateLimiter(config -> config
            .setRateLimiter(redisRateLimiter())
            .setKeyResolver(userKeyResolver())))
    .uri("lb://service"))

3. 安全认证

import org.springframework.cloud.gateway.filter.GatewayFilterChain;
import org.springframework.cloud.gateway.filter.GlobalFilter;
import org.springframework.core.Ordered;
import org.springframework.http.HttpStatus;
import org.springframework.stereotype.Component;
import org.springframework.web.server.ServerWebExchange;
import reactor.core.publisher.Mono;

@Component
public class AuthenticationFilter implements GlobalFilter, Ordered {
    @Override
    public Mono<Void> filter(ServerWebExchange exchange, GatewayFilterChain chain) {
        String token = exchange.getRequest().getHeaders().getFirst("Authorization");
        
        if (token == null || !isValidToken(token)) {
            exchange.getResponse().setStatusCode(HttpStatus.UNAUTHORIZED);
            return exchange.getResponse().setComplete();
        }
        
        // 添加用户信息到请求头
        String userId = extractUserId(token);
        exchange.getRequest().mutate()
            .header("X-User-Id", userId);
        
        return chain.filter(exchange);
    }
    
    private boolean isValidToken(String token) {
        // 验证token
        return token.startsWith("Bearer ");
    }
    
    private String extractUserId(String token) {
        // 从token中提取用户ID
        return "user123";
    }
    
    @Override
    public int getOrder() {
        return -1;  // 高优先级
    }
}

4. 实际应用示例

路由配置

spring:
  cloud:
    gateway:
      routes:
      - id: user-service
        uri: lb://user-service
        predicates:
        - Path=/api/users/**
        filters:
        - StripPrefix=1
        - name: CircuitBreaker
          args:
            name: userService
            fallbackUri: forward:/fallback/users
      
      - id: order-service
        uri: lb://order-service
        predicates:
        - Path=/api/orders/**
        filters:
        - StripPrefix=1
        - name: RequestRateLimiter
          args:
            redis-rate-limiter.replenishRate: 10
            redis-rate-limiter.burstCapacity: 20

跨域配置

@Configuration
public class CorsConfig {
    @Bean
    public CorsWebFilter corsWebFilter() {
        CorsConfiguration config = new CorsConfiguration();
        config.addAllowedOrigin("*");
        config.addAllowedMethod("*");
        config.addAllowedHeader("*");
        
        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        source.registerCorsConfiguration("/**", config);
        
        return new CorsWebFilter(source);
    }
}

5. 最佳实践

1. 路由管理：集中管理路由配置
2. 限流控制：防止服务过载
3. 安全认证：统一身份验证
4. 监控告警：监控网关状态
5. 高可用部署：多实例部署网关

总结

API网关是微服务架构的重要组件。掌握网关的设计和实现，可以构建安全、高效的微服务系统。