APIGateway网关安全设计

淩亂°似流年 2022-01-28 11:45 262阅读 0赞

# [APIGateway网关安全设计][APIGateway] #

Spring Cloud里面有个组件 Zuul网关

网关和 过滤器 拦截器很相似

网关可以实现过滤器 拦截器的功能 而且可以实现Nginx的基本功能 反向代理 负载均衡ribbon

Nginx是软负载 ribbon本底客户端负载均衡

网关的核心基本作用： 路由地址  反向代理  黑名单与白名单系统（HTTP请求头的来源字段） 授权安全

DNS过程：先浏览器缓存 然后本底host文件 最后外网DNS解析  最终获取IP地址

访问虚拟的VIP

lvs是四层负载均衡  基于IP+端口号  可以管理Nginx集群

外网部署LVS  （阿里云有负载均衡器可以买）

Nginx基本要求： 一主一备

Nginx走完再走网关

网关可以拦截所有服务请求： 日志管理 权限控制 限流 安全控制

![1179709-20190126003449972-890155899.png][]

既然Nginx可以实现网关，为什么需要Zuul。

Zuul使用Java开发的 。Nginx是C开发的。Nginx功能比Zuul更强大。Zuul针对微服务的，Nginx针对服务器的。

Zuul框架是微服务里面的一个组件，网关。

![1179709-20190125222439053-2089521442.png][]

注意：  LVS管理Nginx

搭建网关：

1、Nginx也可以实现网关。

a. 基于域名区分

b.基于项目名称

拦击域名进行跳转:

![1179709-20190125231856182-1836156195.png][]

访问：

![1179709-20190125231950089-1998480337.png][]

![1179709-20190125231923272-903918276.png][]

2、基于SpringCloud Zuul搭建网关

Eureka

服务A

服务B

网关的核心配置：

### 配置网关反向代理    
    zuul:
      routes:
        api-a:
          path: /api-a/**
          serviceId: toov5_a     ##服务名称
        api-b:
          path: /api-b/** 
          serviceId: toov5_b     ##服务名称

所以：

###注册 中心
    eureka:
      client:
        serviceUrl:
          defaultZone: http://localhost:8100/eureka/
    server:
      port: 80
    ###网关名称
    spring:
      application:
        name: service-zuul
    ### 配置网关反向代理    
    zuul:
      routes:
        api-a:
          path: /api-a/**
          serviceId: toov5_a
        api-b:
          path: /api-b/**
          serviceId: toov5_b

pom:

<parent>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-parent</artifactId>
            <version>2.0.1.RELEASE</version>
            <relativePath /> 
        </parent>
    
        <properties>
            <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
            <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
            <java.version>1.8</java.version>
            <spring-cloud.version>Finchley.RC1</spring-cloud.version>
        </properties>
        <dependencies>
            <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-starter</artifactId>
            </dependency>
            <dependency>
                <groupId>org.springframework.cloud</groupId>
                <artifactId>spring-cloud-starter-netflix-eureka-client</artifactId>
            </dependency>
            <dependency>
                <groupId>org.springframework.cloud</groupId>
                <artifactId>spring-cloud-starter-netflix-ribbon</artifactId>
            </dependency>
            <dependency>
                <groupId>org.springframework.cloud</groupId>
                <artifactId>spring-cloud-starter-netflix-zuul</artifactId>
            </dependency>
            <dependency>
                <groupId>org.projectlombok</groupId>
                <artifactId>lombok</artifactId>
                <optional>true</optional>
            </dependency>
            <dependency>
                <groupId>com.alibaba</groupId>
                <artifactId>fastjson</artifactId>
                <version>1.2.3</version>
            </dependency>
            <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-starter-test</artifactId>
                <scope>test</scope>
            </dependency>
        </dependencies>
    
        <dependencyManagement>
            <dependencies>
                <dependency>
                    <groupId>org.springframework.cloud</groupId>
                    <artifactId>spring-cloud-dependencies</artifactId>
                    <version>${spring-cloud.version}</version>
                    <type>pom</type>
                    <scope>import</scope>
                </dependency>
            </dependencies>
        </dependencyManagement>
    
        <build>
            <plugins>
                <plugin>
                    <groupId>org.springframework.boot</groupId>
                    <artifactId>spring-boot-maven-plugin</artifactId>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-compiler-plugin</artifactId>
                    <configuration>
                        <source>1.8</source>
                        <target>1.8</target>
                    </configuration>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-resources-plugin</artifactId>
                    <version>3.0.1</version>
                    <executions>
                        <execution>
                            <id>copy-conf</id>
                            <phase>package</phase>
                            <goals>
                                <goal>copy-resources</goal>
                            </goals>
                            <configuration>
                                <encoding>UTF-8</encoding>
                                <outputDirectory>${project.build.directory}/ext/conf</outputDirectory>
                                <resources>
                                    <resource>
                                        <directory>ext/conf</directory>
                                        <includes>
                                            <include>logback.xml</include>
                                        </includes>
                                        <filtering>true</filtering>
                                    </resource>
                                </resources>
                            </configuration>
                        </execution>
                    </executions>
                </plugin>
                <plugin>
                    <groupId>org.jacoco</groupId>
                    <artifactId>jacoco-maven-plugin</artifactId>
                    <version>0.7.5.201505241946</version>
                    <executions>
                        <execution>
                            <id>default-prepare-agent</id>
                            <goals>
                                <goal>prepare-agent</goal>
                            </goals>
                        </execution>
                        <execution>
                            <id>default-prepare-agent-integration</id>
                            <goals>
                                <goal>prepare-agent-integration</goal>
                            </goals>
                        </execution>
                    </executions>
                </plugin>
                <plugin>
                    <groupId>com.spotify</groupId>
                    <artifactId>docker-maven-plugin</artifactId>
                    <version>0.4.3</version>
                    <configuration>
                        <imageName>hy_uav_gateway</imageName>
                        <dockerDirectory>src/main/docker</dockerDirectory>
                        <resources>
                            <resource>
                                <targetPath>/</targetPath>
                                <directory>${project.build.directory}</directory>
                                <include>${project.build.finalName}.jar</include>
                                <include>ext/conf/logback.xml</include>
                            </resource>
                        </resources>
                    </configuration>
                </plugin>
            </plugins>
        </build>
    
        <repositories>
            <repository>
                <id>spring-milestones</id>
                <name>Spring Milestones</name>
                <url>https://repo.spring.io/milestone</url>
                <snapshots>
                    <enabled>false</enabled>
                </snapshots>
            </repository>
        </repositories>

Filter：

import javax.servlet.http.HttpServletRequest;
    
    import org.springframework.util.StringUtils;
    
    import com.netflix.zuul.ZuulFilter;
    import com.netflix.zuul.context.RequestContext;
    import com.netflix.zuul.exception.ZuulException;
    
    // 验证Tomcat 参数
    public class TokenFilter extends ZuulFilter {
    
        public Object run() throws ZuulException {
    
            // 拦截参数执行业务逻辑
            RequestContext ctx = RequestContext.getCurrentContext();
            HttpServletRequest request = ctx.getRequest();
            String token = request.getParameter("token");
            if (StringUtils.isEmpty(token)) {
                // 直接不能够继续执行下面业务逻辑
                ctx.setSendZuulResponse(false); // 不继续执行下面业务逻辑
                ctx.setResponseStatusCode(500);// 不继续执行下面业务逻辑
                ctx.setResponseBody("token is null");
                return null;
            }
            // 继续正常执行业务逻辑
            return null;
        }
    
     
        public boolean shouldFilter() {
    
            return true; // 是否开启当前ilter(
        }
    
     
        @Override
        public int filterOrder() {
    
            return 0; // 过滤器优先级 数字越大 越优先执行大
        }
    
        @Override
        public String filterType() {
    
            return "pre";// 前置执行
        }
    
    }

启动类：

import org.springframework.boot.SpringApplication;
    import org.springframework.boot.autoconfigure.SpringBootApplication;
    import org.springframework.cloud.netflix.eureka.EnableEurekaClient;
    import org.springframework.cloud.netflix.zuul.EnableZuulProxy;
    import org.springframework.context.annotation.Bean;
    
    import com.itmayiedu.filter.TokenFilter;
    
    @EnableZuulProxy
    @EnableEurekaClient
    @SpringBootApplication
    public class AppZuul {
    
        // @EnableZuulProxy 开启Zuul网关代理
        // @EnableEurekaClient 注册到EurekaC
    
        public static void main(String[] args) {
            SpringApplication.run(AppZuul.class, args);
        }
    
        // 注册到SpringBoot 容器
        @Bean
        public TokenFilter accessFilter() {
            return new TokenFilter();
        }
    
    }

补充：

自己实现一套RPC远程调用框架。如何设计？

核心在服务治理。

传统服务与服务之间通讯URL地址管理 包括实现负载均衡 熔断机制 服务降级

服务和服务之间的依赖关系 (注册中心)

API网关是一个公共基础组件，无状态，可支持多套分布式部署。如下图所示：

![1179709-20190126003910436-901630631.png][]

posted @ 2019-01-26 00:40 [toov5][] 阅读( ...) 评论( ...) [编辑][Link 1] 收藏

[APIGateway]: https://www.cnblogs.com/toov5/p/10322408.html
[1179709-20190126003449972-890155899.png]: /images/20220128/49f91f3bb4a64f1b9e50ca4b84674f32.png
[1179709-20190125222439053-2089521442.png]: /images/20220128/8068ce69bc284b06a84a646b2de6aace.png
[1179709-20190125231856182-1836156195.png]: /images/20220128/d950e5a16e4f4caa87c522c15767736e.png
[1179709-20190125231950089-1998480337.png]: /images/20220128/bd77afc36d8a4874bad970388c640d9a.png
[1179709-20190125231923272-903918276.png]: /images/20220128/f9c7cebed62e431fa3ac88edddb03c80.png
[1179709-20190126003910436-901630631.png]: /images/20220128/935bf01d19844db5a8994e1c3e3477df.png
[toov5]: https://www.cnblogs.com/toov5/
[Link 1]: https://i.cnblogs.com/EditPosts.aspx?postid=10322408