百万QPS风暴：接口防刷实战指南

# Nginx 限流配置 (漏桶算法)
limit_req_zone $binary_remote_addr zone=api_per_ip:10m rate=100r/s;

location /critical_api {
    limit_req zone=api_per_ip burst=50 nodelay;
    proxy_pass http://backend;
}

// 基于Guava的令牌桶实现
RateLimiter limiter = RateLimiter.create(5000); // 全局5000QPS

@PostMapping("/v1/order")
public Response createOrder(@RequestBody OrderRequest req) {
    if (!limiter.tryAcquire()) {
        throw new RateLimitException(); 
    }
    // 业务逻辑
}

-- Redis限流Lua脚本
local key = KEYS[1]
local limit = tonumber(ARGV[1])
local current = redis.call('incr', key)
if current > limit then
    return 0
elseif current == 1 then
    redis.call('expire', key, 1)
end
return 1

# Kubernetes HPA配置示例
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: payment-service
  minReplicas: 5
  maxReplicas: 100
  metrics:
  - type: Resource
    resource:
      name: cpu
      target:
        type: Utilization
        averageUtilization: 70

# 攻击成本估算（按云服务计费）
攻击流量 = 1,000,000 QPS * 3600秒 = 36亿次/小时
API网关费用 = 36亿次 * $0.015/万次 = $5,400/小时