앱)대량호출 방어로직 및 checkusersession

Posted by HULIA(휴리아)
2018. 11. 14. 19:21 백엔드개발/자바스프링
public static void checkUserSession(HttpServletRequest request, HttpServletResponse response){
boolean isLogin = false;
HttpSession session = request.getSession();
if(session != null){
   UserInfoVO user = (UserInfoVO)session.getAttribute("USERINFO");
     if(user!= null && user.getUserID() != null){
        isLogin = true;
      }
      
      //대량 호출 방어 로직
      @SupressWarnings("unchecked")
       Map<String, Object> map = (Map<String, Object>) session.getAttribute(session.getId());
        if(map == null){
map = new HashMap<String, Object>();
map.put("rat", System.currentTimeMillis());
map.put("rac",1);
session.setAttribute(session.getId(), map);

          }else{

//최근 호출 시간 (rat)와 최근 연속호출 count(rac)를 가져온다
long recentAccessTime = (Long) map.get("rat");//recent access time
int accessCount = (Integer) map.get("rac"); //recent access count
int tooManyAccessCnt = Integer.parseInt(ComConfig.getAccessCount());

//연속 호출 건수가 임계치를 넘었다면 세션을 Invalid
if(accessCount >= tooManyAccessCnt) {
logger("to many access, redirect to login page");
session.setAttribute(session.getId(), null);
try{
      response.sendRedirect(CommConfig.getBaseUrl() + request.getContextPath() + "login/intro.do");
 return;
} catch(){
}
}

if( System.currentTimeMillis() - recentAccessTime <= 1000) { //1초안에
accessCount++;
}else{
accountCount =1;
map.put("rat",System.currentTimeMillis());
}
map.put("rac",accessCount);
session.setAttribute(session.getId(), amp);
  }
    //대량호출 방어
}
if( !isLogin){
   try{
         if(request.getHeader("AJAX") != null && request.getHeader("AJAX").equals("true")){
      response.sendError(HttpServletResponse.SC_FORBIDDEN);
}else{
      response.sendRedirect(CommConfig.getBaseUrl() + request.getContextPath() + "/login/intro.do");
}
   }catch(){
}

}



}