Golang请求速率限制中间件Limiter使用指南

在Go语言中实现请求速率限制是保护API服务免受过载攻击的重要手段。下面我将介绍几种简单高效的速率限制中间件实现方式。

1. 使用golang.org/x/time/rate包

Go标准库中的golang.org/x/time/rate提供了令牌桶算法的实现，非常适合做速率限制。

package main

import (
	"net/http"
	"golang.org/x/time/rate"
	"time"
)

var limiter = rate.NewLimiter(rate.Every(time.Second), 10) // 每秒10个请求

func limitMiddleware(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		if !limiter.Allow() {
			http.Error(w, "Too many requests", http.StatusTooManyRequests)
			return
		}
		next.ServeHTTP(w, r)
	})
}

func main() {
	mux := http.NewServeMux()
	mux.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
		w.Write([]byte("Hello, World!"))
	})
	
	limitedMux := limitMiddleware(mux)
	http.ListenAndServe(":8080", limitedMux)
}

2. 使用github.com/ulule/limiter/v3

ulule/limiter是一个功能更丰富的第三方限流库，支持多种存储后端。

package main

import (
	"net/http"
	"github.com/ulule/limiter/v3"
	"github.com/ulule/limiter/v3/drivers/middleware/stdlib"
	"github.com/ulule/limiter/v3/drivers/store/memory"
)

func main() {
	// 定义限流规则: 10 requests per minute
	rate := limiter.Rate{
		Period: 1 * time.Minute,
		Limit:  10,
	}
	
	store := memory.NewStore()
	instance := limiter.New(store, rate)
	
	middleware := stdlib.NewMiddleware(instance)
	
	mux := http.NewServeMux()
	mux.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
		w.Write([]byte("Hello, World!"))
	})
	
	http.ListenAndServe(":8080", middleware.Handler(mux))
}

3. 基于IP的速率限制

更实用的场景是基于客户端IP进行限流：

package main

import (
	"net/http"
	"sync"
	"time"
	
	"golang.org/x/time/rate"
)

type IPRateLimiter struct {
	ips map[string]*rate.Limiter
	mu  *sync.RWMutex
	r   rate.Limit
	b   int
}

func NewIPRateLimiter(r rate.Limit, b int) *IPRateLimiter {
	return &IPRateLimiter{
		ips: make(map[string]*rate.Limiter),
		mu:  &sync.RWMutex{},
		r:   r,
		b:   b,
	}
}

func (i *IPRateLimiter) AddIP(ip string) *rate.Limiter {
	i.mu.Lock()
	defer i.mu.Unlock()
	
	limiter := rate.NewLimiter(i.r, i.b)
	i.ips[ip] = limiter
	
	return limiter
}

func (i *IPRateLimiter) GetLimiter(ip string) *rate.Limiter {
	i.mu.Lock()
	limiter, exists := i.ips[ip]
	
	if !exists {
		i.mu.Unlock()
		return i.AddIP(ip)
	}
	
	i.mu.Unlock()
	return limiter
}

func limitMiddleware(next http.Handler) http.Handler {
	limiter := NewIPRateLimiter(1, 5) // 每秒1个请求，桶大小5
	
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		ip := r.RemoteAddr
		if !limiter.GetLimiter(ip).Allow() {
			http.Error(w, http.StatusText(http.StatusTooManyRequests), http.StatusTooManyRequests)
			return
		}
		
		next.ServeHTTP(w, r)
	})
}

func main() {
	mux := http.NewServeMux()
	mux.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
		w.Write([]byte("Hello, World!"))
	})
	
	http.ListenAndServe(":8080", limitMiddleware(mux))
}

4. 分布式限流

对于分布式系统，可以使用Redis作为存储后端：

package main

import (
	"net/http"
	"github.com/ulule/limiter/v3"
	"github.com/ulule/limiter/v3/drivers/middleware/stdlib"
	"github.com/ulule/limiter/v3/drivers/store/redis"
)

func main() {
	// 定义限流规则
	rate := limiter.Rate{
		Period: 1 * time.Hour,
		Limit:  1000,
	}
	
	// 创建Redis存储
	store, err := redis.NewStoreWithOptions(redis.Options{
		Address: "localhost:6379",
		Prefix:  "limiter_",
	})
	if err != nil {
		panic(err)
	}
	
	// 创建限流器实例
	instance := limiter.New(store, rate)
	
	// 创建中间件
	middleware := stdlib.NewMiddleware(instance)
	
	mux := http.NewServeMux()
	mux.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
		w.Write([]byte("Hello, World!"))
	})
	
	http.ListenAndServe(":8080", middleware.Handler(mux))
}

最佳实践建议

1. 根据API端点的重要性设置不同的限流阈值
2. 生产环境建议使用Redis等分布式存储
3. 对认证用户和匿名用户使用不同的限流策略
4. 在响应头中添加限流信息(X-RateLimit-Limit, X-RateLimit-Remaining等)
5. 考虑实现滑动窗口算法以获得更精确的控制

以上示例提供了从简单到复杂的多种限流实现方式，您可以根据项目需求选择合适的方案。