我们熟悉的限流算法漏桶和令牌桶外，很多情况我们还需要考虑当个用户(ip)访问频率控制，避免被恶意调用。如果是开放平台限制一天调用多少次这种粗放的粒度相对好处理一些。如果需要更小时间粒度控制，譬如一个10秒时间窗口最大只允许访问10次，相对上述粗放粒度我们还需要考虑性能和边界两个问题。在这里提供一种思路给大家，这个也是我写的api网关访问频率控制的代码，经过了线上环境实践。

推荐： jeesuite开发框架，免费开源、一站式解决方案。

思路（以10秒限制10次为例）

定义一个全局map

• key为用户标识(ip or sessionId),
• value:List<10秒内访问时间戳>

private Map<String, List<Long>> accessDatas = new ConcurrentHashMap<>();

启动一个定时器，用于清除10秒前的访问时间

cleanScheduledExecutor.scheduleAtFixedRate(new Runnable() {
        @Override 
        public void run() {
          long currentTime = System.currentTimeMillis();

          List < Long > accessPoints = null;
          Iterator < String > idsIterator;
          if (gloabalScanFlag == 5) {
            //清理空记录
            if (cleanNulling = accessDatas.size() > cleanNullSize) {
                log.debug("cleanNulling...");
                Set < String > keys = accessDatas.keySet();
                for (String key: keys) {
                    List < Long > points = accessDatas.get(key);
                    if (points.isEmpty()) {
                        points = null;
                        accessDatas.remove(key);
                    }
                }
                cleanNulling = false;
            }

            idsIterator = accessDatas.keySet().iterator();
            gloabalScanFlag = 0;
        } else {
            idsIterator = maybeFullIds.iterator();
            gloabalScanFlag++;
        }

        while (idsIterator.hasNext()) {
            accessPoints = accessDatas.get(idsIterator.next());
            //
            removeExpirePoints(accessPoints, currentTime);
        }
    }

},
1000, 1000, TimeUnit.MILLISECONDS);

移除过期的请求时间戳记录

private int removeExpirePoints(List<Long> ponits,long currentTimeMillis){
        int removeNums = 0;
        if(ponits == null || ponits.isEmpty()){
            return removeNums;
        }
        Iterator<Long> pointsIterator = ponits.iterator();  
        while (pointsIterator.hasNext()) {
            if(pointsIterator.next().compareTo(currentTimeMillis - timeWindowMillis) <= 0){
                pointsIterator.remove();
                removeNums++;
            }else{
                break;
            }
        }  
        
   return removeNums;
}

频控检查

/**
 * 访问频率检查
 * @param identification 用户标识(ip or sessionId)
 * @param uri
 * @return
 * @copyright http://www.jeesuite.com
*/
private boolean requestFrequencyCheck(String identification, String uri) {

    while (cleanNulling);

    boolean result = false;
    long currentTime = System.currentTimeMillis();
    List < Long > accessPoints = accessDatas.get(identification);
    try {
        if (accessPoints == null) {
            accessPoints = new Vector < >(permits);
            accessDatas.put(identification, accessPoints);
        }

        int size;
        if ((size = accessPoints.size()) < permits) {
            if (size >= putFullQueueSize) {
                maybeFullIds.add(identification);
            }
            result = true;
        } else {
            int removeNums = removeExpirePoints(accessPoints, currentTime);
            result = removeNums > 0;
        }
        return result;
    } finally {
        accessPoints.add(currentTime);
    }
}

完整代码：https://gitee.com/vakinge/jeesuite-apigateway/blob/master/src/main/java/com/jeesuite/apigateway/helper/PerFrequencyLimiter.java