架构实战：彻底吃透防重复提交！接口防重设计方案

防重前缀 + 用户ID + 请求URI + 请求参数Body

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-data-redis</artifactId>
</dependency>

import java.lang.annotation.*;

/**
 * 标记接口自动开启短时重复请求拦截
 */
@Target(ElementType.METHOD)
@Retention(RetentionPolicy.RUNTIME)
@Documented
public @interface NoRepeatSubmit {
    /**
     * 防重有效时间（秒）默认3秒
     */
    int expireTime() default 3;
}

import jakarta.servlet.http.HttpServletRequest;
import org.springframework.util.DigestUtils;
import org.springframework.util.StringUtils;

public class RequestFingerUtil {

    /**
     * 生成请求唯一指纹Key
     * 规则：用户ID + 请求地址 + 请求参数
     */
    public static String getFingerKey(HttpServletRequest request, String userId) {
        String uri = request.getRequestURI();
        String param = request.getQueryString();
        if (!StringUtils.hasText(param)) {
            param = "";
        }
        // 拼接唯一特征字符串
        String raw = userId + uri + param;
        // MD5压缩生指纹
        String md5 = DigestUtils.md5DigestAsHex(raw.getBytes());
        return "submit:repeat:" + md5;
    }
}

import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import org.springframework.data.redis.core.StringRedisTemplate;
import org.springframework.data.redis.core.ValueOperations;
import org.springframework.stereotype.Component;
import org.springframework.web.method.HandlerMethod;
import org.springframework.web.servlet.HandlerInterceptor;

import java.io.IOException;
import java.util.concurrent.TimeUnit;

@Component
public class RepeatSubmitInterceptor implements HandlerInterceptor {

    private final StringRedisTemplate stringRedisTemplate;

    public RepeatSubmitInterceptor(StringRedisTemplate stringRedisTemplate) {
        this.stringRedisTemplate = stringRedisTemplate;
    }

    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
        if (!(handler instanceof HandlerMethod handlerMethod)) {
            return true;
        }

        // 判断接口是否开启防重
        NoRepeatSubmit noRepeatSubmit = handlerMethod.getMethodAnnotation(NoRepeatSubmit.class);
        if (noRepeatSubmit == null) {
            return true;
        }

        // 模拟获取当前登录用户ID（实际从Token/Session获取）
        String userId = getCurrentUserId(request);
        // 生成本次请求唯一指纹
        String fingerKey = RequestFingerUtil.getFingerKey(request, userId);
        int expire = noRepeatSubmit.expireTime();

        // Redis NX 原子设置：不存在则设置，存在则返回false，彻底防并发穿透
        ValueOperations<String, String> ops = stringRedisTemplate.opsForValue();
        Boolean success = ops.setIfAbsent(fingerKey, "1", expire, TimeUnit.SECONDS);
        if (!Boolean.TRUE.equals(success)) {
            returnError(response, "请勿重复提交请求");
            return false;
        }
        return true;
    }

    /**
     * 模拟获取登录用户ID，项目中替换为JWT/Token解析
     */
    private String getCurrentUserId(HttpServletRequest request) {
        String userId = request.getHeader("user-id");
        return userId == null ? "anonymous" : userId;
    }

    private void returnError(HttpServletResponse response, String msg) throws IOException {
        response.setContentType("application/json;charset=UTF-8");
        response.getWriter().write("{\"code\":400,\"msg\":\"" + msg + "\"}");
    }
}

import org.springframework.context.annotation.Configuration;
import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;

@Configuration
public class WebConfig implements WebMvcConfigurer {

    private final RepeatSubmitInterceptor repeatSubmitInterceptor;

    public WebConfig(RepeatSubmitInterceptor repeatSubmitInterceptor) {
        this.repeatSubmitInterceptor = repeatSubmitInterceptor;
    }

    @Override
    public void addInterceptors(InterceptorRegistry registry) {
        registry.addInterceptor(repeatSubmitInterceptor).addPathPatterns("/**");
    }
}

import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RestController;

@RestController
public class OrderController {

    /**
     * 开启防重的业务提交接口
     * 无需前端传Token，纯服务端自动防重
     */
    @PostMapping("/submitOrder")
    @NoRepeatSubmit(expireTime = 3)
    public String submitOrder() {
        // 模拟下单业务逻辑
        return "业务提交成功";
    }
}

spring:
  redis:
    host: 127.0.0.1
    port: 6379
    database: 0
    timeout: 10000ms

curl --location --request POST 'http://127.0.0.1:8080/submitOrder' \
--header 'user-id: 10001' \
--header 'Content-Type: application/json' \
--data '{
    "goodsId": 10086,
    "num": 2,
    "payType": 1
}'

curl --location --request POST 'http://127.0.0.1:8080/submitOrder' \
--header 'user-id: 10001' \
--header 'Content-Type: application/json' \
--data '{
    "goodsId": 10086,
    "num": 2,
    "payType": 1
}'

@Test
void testConcurrentFinger() throws InterruptedException {
    String key = "submit:repeat:testmd5key";
    int threadNum = 100;
    ExecutorService pool = Executors.newFixedThreadPool(threadNum);
    CountDownLatch latch = new CountDownLatch(threadNum);

    for (int i = 0; i < threadNum; i++) {
        pool.submit(() -> {
            Boolean res = stringRedisTemplate.opsForValue().setIfAbsent(key, "1", 30, java.util.concurrent.TimeUnit.SECONDS);
            if (Boolean.TRUE.equals(res)) {
                System.out.println("成功执行线程：" + Thread.currentThread().getName());
            } else {
                System.out.println("重复执行线程：" + Thread.currentThread().getName());
            }
            latch.countDown();
        });
    }
    latch.await();
    pool.shutdown();
    // 只会打印1条成功，证明原子防穿透生效
}