服务网关和zuul

一个角色来充当request的请求入口，处理非业务功能的场所（防刷，协议监控）

要素：

1. 稳定性，高可用
2. 性能、并发性
3. 安全性
4. 扩展性

常用的网关方案

1. Nginx+Lua（性能极高，事件驱动型，优化设计，扩展性，耦合低）
2. Kong

3. Tyk

   1. 全RestFul Api
   2. go开发
   3. 性能高

4. Spring Cloud Zuul

   1. netflix 开发
   2. java技术栈
   3. 一代zuul不能和nginx比性能

项目改造应该合理利用原有的优势

特点：

路由+过滤器=Zuul

核心是一系列的过滤器

四种过滤器

• 前置
• 路由
• 后置
• error

使用

导入依赖

 <dependency><groupId>org.springframework.cloud</groupId><artifactId>spring-cloud-starter-netflix-zuul</artifactId></dependency>

开启注解@EnableZuulProxy

@EnableEurekaClient
@EnableZuulProxy

yml

spring:application:name: zuulcloud:config:discovery:service-id: CONFIGenabled: trueprofile: dev
server:port: 8085
eureka:client:service-url:defaultZone: http://localhost:8761/eureka
zuul:routes:
# /myProduct/product/list -> /product/list
#    aaa:
#      path: /myProduct/**
#      serviceId: PRODUCT
#简洁写法product: /myProduct/**
#    排除某些路由 set的写法ignored-patterns:- /**/myProduct/product/list#用来查看配置
management:security:enabled: false

{{zuul}}/application/routes查看配置

cookie和动态路由

Cookie

默认是不开启cookie的

全局开启

zuul:sensitive-headers:

开启方式：

zuul:routes:
# /myProduct/product/list -> /product/list
#    aaa:
#      path: /myProduct/**
#      serviceId: PRODUCT
#简洁写法product: /myProduct/**sensitive-headers:

动态路由（cloud config +cloud bus）

@Component
public class ZuulConfig {@Autowired@ConfigurationProperties("zuul")public ZuulProperties zuulProperties() {return new ZuulProperties();}
}

特点

• 路由+过滤器=Zuul
• 核心是一系列的过滤器

典型应用场景

• 前置

  • 鉴权
  • 过滤

• 后置

  • 统计
  • 日志

Zuul的高可用

多个节点注册到Eureka Server上

Nginx 和Zuul"混搭"

前置和后置过滤器

前置过滤

package com.zzjson.apigateway.filter;import com.netflix.zuul.ZuulFilter;
import com.netflix.zuul.context.RequestContext;
import com.netflix.zuul.exception.ZuulException;
import org.apache.commons.lang.StringUtils;
import org.springframework.http.HttpStatus;
import org.springframework.stereotype.Component;import javax.servlet.http.HttpServletRequest;import static org.springframework.cloud.netflix.zuul.filters.support.FilterConstants.PRE_DECORATION_FILTER_ORDER;
import static org.springframework.cloud.netflix.zuul.filters.support.FilterConstants.PRE_TYPE;/*** <p>****************************************************************************</p>* <p><b>Copyright © 2010-2018 rollBall team All Rights Reserved<b></p>* <ul style="margin:15px;">* <li>Description : com.zzjson.apigateway.filter</li>* <li>Version     : 1.0.0</li>* <li>Creation    : 2018年10月19日</li>* <li>@author     : zzy0_0</li>* </ul>* <p>****************************************************************************</p>*/
@Component
public class TokenFilter extends ZuulFilter {@Overridepublic String filterType() {return PRE_TYPE;}@Overridepublic int filterOrder() {return PRE_DECORATION_FILTER_ORDER - 1;}@Overridepublic boolean shouldFilter() {return true;}@Overridepublic Object run() throws ZuulException {RequestContext requestContext = RequestContext.getCurrentContext();HttpServletRequest request = requestContext.getRequest();String token = request.getParameter("token");if (StringUtils.isEmpty(token)) {//不通过requestContext.setSendZuulResponse(false);requestContext.setResponseStatusCode(HttpStatus.UNAUTHORIZED.value());}return null;}
}

order 的值越小，优先级越高

后置过滤

package com.zzjson.apigateway.filter;import com.netflix.zuul.ZuulFilter;
import com.netflix.zuul.context.RequestContext;
import com.netflix.zuul.exception.ZuulException;
import org.springframework.stereotype.Component;import javax.servlet.http.HttpServletResponse;import static org.springframework.cloud.netflix.zuul.filters.support.FilterConstants.POST_TYPE;
import static org.springframework.cloud.netflix.zuul.filters.support.FilterConstants.SEND_RESPONSE_FILTER_ORDER;/*** <p>****************************************************************************</p>* <p><b>Copyright © 2010-2018 rollBall team All Rights Reserved<b></p>* <ul style="margin:15px;">* <li>Description : com.zzjson.apigateway.filter</li>* <li>Version     : 1.0.0</li>* <li>Creation    : 2018年10月19日</li>* <li>@author     : zzy0_0</li>* </ul>* <p>****************************************************************************</p>*/
@Component
public class AddResponseFilter extends ZuulFilter {@Overridepublic String filterType() {return POST_TYPE;}@Overridepublic int filterOrder() {return SEND_RESPONSE_FILTER_ORDER - 1;}@Overridepublic boolean shouldFilter() {return true;}@Overridepublic Object run() throws ZuulException {RequestContext requestContext = RequestContext.getCurrentContext();HttpServletResponse response = requestContext.getResponse();response.setHeader("surprise", "xx");return null;}
}

限流

限流保护，防止网络攻击

时机：请求被转发之前调用

令牌桶限流

package com.zzjson.apigateway.filter;import com.google.common.util.concurrent.RateLimiter;
import com.netflix.zuul.ZuulFilter;
import com.netflix.zuul.exception.ZuulException;
import com.zzjson.apigateway.exception.RateLimiterException;
import org.springframework.stereotype.Component;import static org.springframework.cloud.netflix.zuul.filters.support.FilterConstants.PRE_TYPE;
import static org.springframework.cloud.netflix.zuul.filters.support.FilterConstants.SERVLET_DETECTION_FILTER_ORDER;/*** <p>****************************************************************************</p>* <p><b>Copyright © 2010-2018 rollBall team All Rights Reserved<b></p>* <ul style="margin:15px;">* <li>Description :限流拦截器</li>* <li>Version     : 1.0.0</li>* <li>Creation    : 2018年10月19日</li>* <li>@author     : zzy0_0</li>* </ul>* <p>****************************************************************************</p>*/
@Component
public class RateLimiterFilter extends ZuulFilter {private static final RateLimiter rateLimiter = RateLimiter.create(1);@Overridepublic String filterType() {return PRE_TYPE;}@Overridepublic int filterOrder() {return SERVLET_DETECTION_FILTER_ORDER - 1;}@Overridepublic boolean shouldFilter() {return true;}@Overridepublic Object run() throws ZuulException {//没有取到令牌if (!rateLimiter.tryAcquire()) {throw new RateLimiterException();}return null;}
}

权限校验

1. /order/create 只能买家访问
2. /order/finish 只能卖家
3. /product/list 都可以访问

区分买家和卖家(返回的时候设置)

• 买家：

  • cookie设置 openid=abc

• 卖家：

  • cookie 设置token=uuid ,redis 设置 key=uuid,value=xyz

实现方式

1. Zuul:在前置过滤器中实现相关的逻辑
2. 分布式Session Vs OAuth2

跨域解决

1. 在被调用的类或者方法上加@CrossOrigin注解

   1. 允许cookie跨域

2. Zuul里面增加CrosFilter过滤器

   @Configuration
   public class CrosConfig {@Beanpublic CorsFilter corsFilter() {final UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();final CorsConfiguration config = new CorsConfiguration();//是否支持cookie跨域config.setAllowCredentials(true);//是否支持原始域 http://www.baidu.comconfig.setAllowedOrigins(Collections.singletonList("*"));config.setAllowedHeaders(Collections.singletonList("*"));config.setAllowedMethods(Collections.singletonList("*"));//设置缓存时间config.setMaxAge(300L);source.registerCorsConfiguration("/**", config);return new CorsFilter(source);}}

代码地址： https://gitee.com/zzy0_0/api-gateway