Restful style interface anti-brushing processing method
By building a RESTful API project and testing environment, using Redis components to count access counts and intercepting requests in the Interceptor, and writing custom annotations, the problem of redundant development in API anti-fraud processing was solved, achieving efficient API anti-fraud processing and improving service stability and availability.
Patent Information
- Application Number
- CN202510859516.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-06-25
- Publication Date
- 2025-11-21
AI Technical Summary
In existing technologies, interface anti-scraping measures need to be set up every time a project is built, resulting in redundant development work and reducing work efficiency.
Build an API project based on the RESTful style, install API testing tools and Redis tools, write interceptor logic and custom annotations, configure API anti-spam restrictions, use the API project to process HTTP requests and generate responses, use the Redis component to count access counts and intercept requests in the Interceptor, write custom annotations and mark the APIs that need anti-spam processing in the Controller layer.
It reduces the development workload of API anti-scraping, improves service stability and availability, prevents API from being maliciously attacked, reduces backend pressure, and provides clear error messages for easy debugging.
Smart Images
Figure CN120995448A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The application belongs to the field of interface security, and relates to interface anti-brushing processing technology, in particular to a Restful style interface anti-brushing processing method. BACKGROUND
[0002] The Restful style interface is an architecture style based on the HTTP protocol, which is used to design the interface of a network application, aiming to make the interaction between the client and the server more intuitive and standardized; the behavior of maliciously brushing the interface may cause the server load to increase sharply, thereby affecting the normal access of other users; through anti-brushing processing, the frequency of malicious requests can be effectively limited to prevent server overload; frequent database operations may cause the database performance to decrease, and even cause data damage or loss; anti-brushing processing can reduce unnecessary database access, thereby protecting the safety and stability of the database; anti-brushing processing can release resources occupied by malicious requests, improve the access speed of normal users, and help maintain the stability of the server to ensure that users can smoothly access and use the service.
[0003] In the prior art, when the interface is subjected to anti-brushing processing, the interface of each project is analyzed to identify the interface that needs to be subjected to anti-brushing processing, and the interface that needs to be subjected to anti-brushing processing is subjected to custom setting; in the prior art, the interface is subjected to anti-brushing processing, which can intercept malicious access to a certain extent; however, when each project is constructed, the anti-brushing processing setting needs to be performed, which leads to redundant development work and is not conducive to ensuring the work efficiency.
[0004] The application provides a Restful style interface anti-brushing processing method to solve the above technical problems. SUMMARY
[0005] The application aims to solve at least one of the technical problems in the prior art; for this purpose, the application provides a Restful style interface anti-brushing processing method to solve the technical problem in the prior art that when each project is constructed, the anti-brushing processing setting needs to be performed, which leads to redundant development work and is not conducive to ensuring the work efficiency.
[0006] To achieve the above purpose, a first aspect of the application provides a Restful style interface anti-brushing processing method, which comprises the following steps:
[0007] An interface project is built based on the Restful style; an interface test tool is installed according to the interface project, and a test environment is built;
[0008] A local Redis tool is installed and a local environment is built; a logic business of an interceptor is written, an exception handling business is unified, and a custom annotation is declared;
[0009] extracting the interface needing to be subjected to the anti-brushing processing from the interface tool, and weaving the self-defined anti-brushing annotation into the interface needing to be subjected to the anti-brushing processing;
[0010] configuring the interface anti-brushing limit times according to the interface business, and configuring the parameters of the interface test tool calling the interface;
[0011] calling the interface and returning the result, and verifying the anti-brushing processing of the interface according to the returned result.
[0012] Preferably, the interface project is built based on the Restful style, and the interface project comprises the following steps:
[0013] determining the development language of the back-end interface, and creating the interface project of the SpringBoot architecture according to the development language, wherein the development language of the back-end interface is JAVA;
[0014] locally building the MySql database, writing the Restful type interface used by the project, processing the http request by using the written interface, and responding to the http request.
[0015] The application builds the interface project according to the programming language, processes the http request by using the interface project and makes a response, and completes the creation of the interface project, and can make the basic project preparation for the interface anti-brushing processing.
[0016] Preferably, the interface test tool is installed according to the interface project and the test environment is built, and the installation comprises the following steps:
[0017] locally installing the interface test tool Postman, and creating a new request in the Postman application;
[0018] filling the request information according to the interface document of the interface project, and sending the request information to the interface for testing, wherein the request information comprises the URL, the request method, the request header and the request body.
[0019] The application can build the test tool and the test environment, and provides the application basis for the subsequent test of the anti-brushing interface.
[0020] Preferably, the local Redis tool is installed and the local environment is built, and the installation comprises the following steps:
[0021] locally downloading and installing the Redis component, modifying the localization configuration of the Redis component, and starting the Redis service after the configuration is completed.
[0022] Preferably, the logic business of the interceptor is written, and the writing comprises the following steps:
[0023] An IP address of the visitor is acquired, the IP address is spliced with the URI as an access interface of the visitor, and the number of times of accessing the access interface of the visitor is counted from a Redis component;
[0024] When the number of times of accessing the access interface of the visitor is greater than a threshold value, the access request of the visitor is intercepted in an Interceptor.
[0025] The application determines the access interface of the visitor according to the IP address of the visitor, counts the number of times of accessing the access interface of the visitor from the Redis component, and intercepts the access request of the visitor in the Interceptor when the number of times of accessing the access interface of the visitor is greater than the threshold value, so that the logic business of the Interceptor can be defined, the number of times of accessing the visitor is set, and the interface is prevented from being brushed.
[0026] Preferably, the uniform exception handling business is written and the custom annotation is declared, and the writing includes:
[0027] An exception capturing scenario is acquired, an exception type is defined according to the exception capturing scenario, the exception capturing scenario includes interface login verification, permission verification and interface anti-brushing, exception attribute information is defined according to the exception type, and the exception attribute information includes an exception response code and an error message.
[0028] The custom annotation @AccessLimit is written, the scope and attribute information of the custom annotation are defined, and the attribute information includes the maximum number of times of accessing within n seconds, a disable duration and a default value.
[0029] The application sets the exception type and the exception attribute information according to the exception capturing scenario, provides a clearer error message when the exception is captured and processed, and is helpful for better debugging and solving problems subsequently, the custom annotation is written and declared, and a foundation is laid for subsequent processing of the anti-brushing interface.
[0030] Preferably, the custom anti-brushing annotation is woven into the interface that needs to be prevented from being brushed, and the weaving includes:
[0031] The @AccessLimit annotation is introduced into the Controller layer of the interface that needs to be prevented from being brushed, and the interface that needs to be prevented from being brushed is marked.
[0032] Preferably, the interface anti-brushing limit number is configured according to the interface business, and the configuring includes:
[0033] The business condition and the access condition of the interface are acquired, the limit number of the interface anti-brushing is determined according to the business condition and the access condition of the interface, and the limit number includes the maximum number of times of accessing within n seconds and the disable duration.
[0034] According to the definition of the number of times, the properties in the AccessLimit annotation are defined.
[0035] It should be noted that the maximum number of accesses in the number of times within n seconds is the threshold value of the number of times of accessing the interface by the visitor; when the number of accesses by the visitor within n seconds is greater than the maximum value, the access interface of the visitor is intercepted.
[0036] Preferably, the parameters for configuring the interface test tool to call the interface include:
[0037] In the interface test tool Postman application, the frequency parameter of the interface that has been processed for anti-brushing is set, and the automatic execution of the interface access is clicked.
[0038] Preferably, the anti-brushing processing of the interface according to the return result comprises:
[0039] After the interface access is executed for a set time period, the response information in the response area is viewed; wherein the response information includes: status code, response header and response body;
[0040] When the response information and the preset result are consistent, the interface anti-brushing processing test is successful.
[0041] According to the set completed parameters, the interface access is executed in the test tool, and after a set time period, the response information in the response area is viewed; when the response information and the preset result are consistent, the interface anti-brushing processing test is successful; the interfaces that need to be processed for anti-brushing in the project can reuse this method, which greatly reduces the development workload of interface anti-brushing.
[0042] Compared with the prior art, the beneficial effects of the present application are:
[0043] 1. The present application builds a Restful style interface project and a test environment; the limit parameters in the interface are defined; and the interface is tested for anti-brushing by using an interface test tool; when the test is successful, the anti-brushing interface can be configured to the interface that needs to be processed for anti-brushing in the project; the development workload of interface anti-brushing is greatly reduced, and then the pressure on the back end can be effectively reduced by configuring the interface in the project, the interface is prevented from being maliciously attacked, and the stability and usability of the service are improved.
[0044] 2.The application builds an interface project according to a programming language, processes an HTTP request and makes a response by using the interface project, completes the creation of the interface project, can make basic project preparation for interface anti-brushing processing, can build a test tool and a test environment, determines an access interface of an access visitor according to an IP address of the access visitor, counts the number of times of accessing the access interface of the access visitor from a Redis component, when the number of times of accessing the access interface of the access visitor is greater than a threshold value, intercepts the access request of the access visitor in an interceptor, can define the logic business of the interceptor, sets the number of times of accessing the access visitor, and thus completes the anti-brushing of the interface, sets an exception type and an exception attribute information according to an exception capture scenario, can provide a clearer error message by setting the exception when the exception is captured, which is helpful for better debugging and solving problems subsequently, writes a declaration custom annotation, which lays a foundation for subsequent processing of the anti-brushing interface, executes the interface access in the test tool according to the set completed parameters, and after a set time period, views response information in a response area, when the response information is consistent with a preset result, the interface anti-brushing processing test is successful, and the interfaces that need to be processed in the project can reuse this method, which greatly reduces the development workload of the interface anti-brushing. BRIEF DESCRIPTION OF DRAWINGS
[0045] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or the prior art description. Obviously, the drawings in the following description only some embodiments of the present application, and for those skilled in the art, other drawings can be obtained without creative labor on the basis of these drawings.
[0046] Figure 1 The schematic diagram of the whole steps of the present application;
[0047] Figure 2 The schematic diagram of the interface construction and business writing steps of the present application;
[0048] Figure 3 The schematic diagram of the interface anti-brushing setting and testing steps of the present application. DETAILED DESCRIPTION
[0049] The technical solutions of the present application will be described clearly and completely in combination with the embodiments. Obviously, the described embodiments are only some of the embodiments of the present application, not all. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.
[0050] Please refer to Figure 1The embodiment of the first aspect of the application provides a Restful style interface anti-brushing processing method, comprising:
[0051] An interface engineering is built based on the Restful style, an interface test tool is installed according to the interface engineering, and a test environment is built;
[0052] A local Redis tool is installed and a local environment is built, logic business of an interceptor is written, unified exception processing business is written, and a custom annotation is declared;
[0053] An interface that needs to be subjected to anti-brushing processing is extracted from the interface tool, and the custom anti-brushing annotation is woven into the interface that needs to be subjected to anti-brushing processing;
[0054] The number of times of interface anti-brushing is configured according to interface business, and the parameters of the interface test tool are configured to call the interface;
[0055] The interface is called and a result is returned, and the anti-brushing processing of the interface is verified according to the returned result.
[0056] Please refer to Figure 2 , a development language of a back-end interface is determined, an interface engineering of a SpringBoot architecture is created according to the development language, wherein the development language of the back-end interface is JAVA, a MySql database is built locally, a Restful type interface used by a project is written, an http request is processed by using the written interface, and the http request is responded.
[0057] A local interface test tool Postman is installed, a new request is created in the Postman application, request information is filled in according to an interface document of the interface engineering, and the request information is sent to the interface for testing, wherein the request information comprises a URL, a request method, a request header and a request body.
[0058] A Redis component is downloaded and installed locally, a localization configuration of the Redis component is modified, and the Redis service is started after the configuration is completed.
[0059] An IP address of a visitor is acquired, the IP address is spliced with a uri to serve as an access interface of the visitor, the number of times of accessing the interface by the visitor is counted from the Redis component, and when the number of times of accessing the interface by the visitor is greater than a threshold value, the access request of the visitor is intercepted in the Interceptor.
[0060] Example: Assuming that the IP addresses of visitors A and B are obtained, the IP addresses of the two are spliced with the uir respectively to obtain the access interfaces of the two; the number of times of accessing the access interfaces of visitors A and B is counted in the Redis component; the number of times of accessing the access interface of visitor A is greater than the number threshold, and the access request of visitor A is intercepted in the Interceptor; the number of times of accessing the access interface of visitor B is less than the number threshold, and visitor B is a normal access, and the number of times of accessing visitor B is counted continuously.
[0061] An exception capture scenario is obtained; an exception type is defined according to the exception capture scenario; wherein the exception capture scenario includes: interface login verification, permission verification and interface anti-brushing; an exception attribute information is defined according to the exception type; wherein the exception attribute information includes: exception response code and error message;
[0062] A custom annotation @AccessLimit is written, and the scope and attribute information of the custom annotation are defined; wherein the attribute information includes: the maximum number of accesses within n seconds, the disable duration and its default value.
[0063] Please refer to Figure 3 The @AccessLimit annotation is introduced in the Controller layer of the interface to be prevented from being brushed, and the interface to be prevented from being brushed is marked.
[0064] The business situation and access situation of the interface are obtained; the limit number of times of interface anti-brushing is determined according to the business situation and access situation of the interface; wherein the limit number of times includes: the maximum number of accesses within n seconds and the disable duration; the attribute in the @AccessLimit annotation is defined according to the limit number of times.
[0065] The frequency parameter of the interface that has been prevented from being brushed is set in the interface test tool Postman application, and the automatic execution of the interface access is clicked.
[0066] After the interface access is executed for a set period of time, the response information in the response area is viewed; wherein the response information includes: status code, response header and response body; when the response information is consistent with the preset result, the interface anti-brushing processing test is successful.
[0067] Example: Assuming that the frequency parameter of the interface that has been prevented from being brushed is set in the interface test tool; and the interface access is executed, the response information in the response area of the interface within a set period of time is obtained; the verification result is as follows:
[0068]
[0069]
[0070] Table 1 test result and preset result
[0071] From the above table, the actual response verification point: all requests return the same 429 response during the disable period; after 60 seconds, re-access restores the 200 state; then the same as the expected result, then the interface anti-brush test is successful.
[0072] Part of the data in the above formula is calculated by removing the dimension, and the formula is obtained by simulating a large amount of collected data to be closest to the actual situation; the preset parameters and the preset threshold in the formula are set by the person skilled in the art according to the actual situation or obtained by a large amount of data simulation.
[0073] The working principle of the application is: the application is based on Restful style interface engineering; according to the interface engineering, an interface test tool is installed and a test environment is built; a local Redis tool is installed and a local environment is built; the logic business of the interceptor is written, the unified exception handling business and the declaration of the custom annotation are written; the interface that needs to be processed for anti-brush is extracted from the interface tool; and the custom anti-brush annotation is woven into the interface that needs to be processed for anti-brush; according to the interface business, the interface anti-brush limit number is configured; the parameters of the interface test tool calling the interface are configured; the interface is called and the result is returned; the anti-brush processing of the interface is verified according to the returned result.
[0074] The above examples are only used to illustrate the technical method of the application and are not limited, although the application is described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical method of the application can be modified or replaced equivalently without departing from the spirit and scope of the technical method of the application.
Claims
1. A method for preventing unauthorized access to a RESTful API, characterized in that, include: Build an interface project based on the RESTful style; Install the interface testing tools and set up the testing environment according to the interface project; Install local Redis tools and set up the local environment; write the interceptor logic, unify exception handling logic, and declare custom annotations; Extract the interfaces that need to be protected against spam from the interface tool; and weave the custom anti-spamming annotations into the interfaces that need to be protected against spam. Configure the API anti-scraping limit based on the API business configuration; configure the parameters for API testing tools to call the API; Call the API and return the result; verify the API's anti-fraud measures based on the returned result.
2. The method for preventing spoofing of a Restful interface according to claim 1, characterized in that, The interface project built based on the RESTful style includes: Determine the development language for the backend interface, and create an interface project based on the development language using the Spring Boot architecture; the development language for the backend interface is JAVA. Set up a local MySQL database; write RESTful APIs for the project; use the written APIs to handle HTTP requests and respond to them.
3. The method for preventing spoofing of a Restful interface according to claim 1, characterized in that, The step of installing interface testing tools and setting up a testing environment based on the interface project includes: Install the API testing tool Postman locally, and create a new request in the Postman application; Fill in the request information according to the interface documentation of the interface project, and send the request information to the interface for testing; the request information includes: URL, request method, request header, and request body.
4. The method for preventing spoofing of a Restful interface according to claim 1, characterized in that, The installation of local Redis tools and the setup of the local environment include: Download and install the Redis component locally, modify the local configuration of the Redis component, and start the Redis service after configuration.
5. The method for preventing spoofing of a Restful interface according to claim 1, characterized in that, The logic for writing the interceptor includes: Obtain the visitor's IP address, concatenate the IP address with the URI to obtain the visitor's access interface; count the number of times the visitor accesses the interface from the Redis component; If a visitor accesses the interface more times than the threshold, the visitor's access request will be intercepted in the Interceptor.
6. The method for preventing spoofing of a RESTful interface according to claim 1, characterized in that, The process of writing unified exception handling logic and declaring custom annotations includes: Obtain exception capture scenarios; define custom exception types based on exception capture scenarios; exception capture scenarios include: interface login verification, permission verification, and interface anti-fraud; define exception attribute information based on exception types; exception attribute information includes: exception response code and error message; Create a custom annotation @AccessLimit to define the scope and attributes of the custom annotation; the attributes include: the maximum number of accesses within n seconds, the duration of disabling, and their default values.
7. The method for preventing spoofing of a Restful interface according to claim 1, characterized in that, The process of weaving custom anti-scraping annotations into the interface requiring anti-scraping treatment includes: In the Controller layer of the interface that needs to be protected against data breaches, introduce the @AccessLimit annotation to mark the interface that needs to be protected against data breaches.
8. The method for preventing spoofing of a Restful interface according to claim 1, characterized in that, The configuration of the interface anti-scraping limit based on the interface service includes: Obtain the business and access information of the interface; determine the limit on the number of times the interface is protected against data breaches based on the business and access information; the limit includes: the maximum number of accesses within n seconds and the duration of the restriction; Define the attributes in the @AccessLimit annotation based on the limit number of times.
9. A method for preventing spoofing of a Restful interface according to claim 1, characterized in that, The parameters for the interface call in the configuration interface testing tool include: In the Postman application, an interface testing tool, set the frequency parameters for the interface that has been protected against spam, and then click "Automatically execute interface access".
10. A method for preventing spoofing of a Restful interface according to claim 1, characterized in that, The anti-scraping processing of the verification interface based on the returned results includes: After the interface access is executed for a set period of time, view the response information in the response area; the response information includes: status code, response header, and response body; If the response information is consistent with the preset result, the interface anti-scraping test is successful.