Spring Cloud Gateway高并发限流——基于Redis实现方案解析

本文是一个基于 Spring Cloud Gateway 的分布式限流方案，使用Redis +
Lua实现高并发场景下的精准流量控制。该方案支持动态配置、多维度限流（API路径/IP/用户），并包含完整的代码实现和性能优化建议。

一、架构设计

二、核心代码实现

自定义限流过滤器

@Component
public class RedisRateLimitFilter implements GlobalFilter, Ordered {@Autowiredprivate RedisTemplate<String, String> redisTemplate;@Autowiredprivate RateLimitConfigService configService;@Overridepublic Mono<Void> filter(ServerWebExchange exchange, GatewayFilterChain chain) {// 获取限流配置（根据请求路径动态获取）Route route = exchange.getAttribute(ServerWebExchangeUtils.GATEWAY_ROUTE_ATTR);RateLimitRule rule = configService.getRule(route.getId());// 生成限流Key（示例：api_limit:/order:create:ip:192.168.1.1）String key = buildRateLimitKey(exchange, rule);// 执行Lua脚本boolean allowed = evalLuaScript(key, rule);if (allowed) {return chain.filter(exchange);} else {exchange.getResponse().setStatusCode(HttpStatus.TOO_MANY_REQUESTS);return exchange.getResponse().setComplete();}}private String buildRateLimitKey(ServerWebExchange exchange, RateLimitRule rule) {return String.join(":","api_limit",exchange.getRequest().getPath().value(),rule.getType(), // 限流维度：ip/user/apigetIdentifier(exchange, rule) // 获取标识（IP/用户ID等）);}
}

高性能Lua脚本（rate_limiter.lua）

local tokens_key = KEYS[1]
local timestamp_key = KEYS[2]local rate = tonumber(ARGV[1])
local capacity = tonumber(ARGV[2])
local now = tonumber(ARGV[3])
local requested = tonumber(ARGV[4])local fill_time = capacity / rate
local ttl = math.floor(fill_time * 2)local last_tokens = tonumber(redis.call("get", tokens_key) or capacity)
local last_refreshed = tonumber(redis.call("get", timestamp_key) or 0)local delta = math.max(0, now - last_refreshed)
local filled_tokens = math.min(capacity, last_tokens + (delta * rate))local allowed = filled_tokens >= requested
local new_tokens = filled_tokens
if allowed thennew_tokens = filled_tokens - requested
endredis.call("setex", tokens_key, ttl, new_tokens)
redis.call("setex", timestamp_key, ttl, now)return allowed and 1 or 0

脚本执行器

public boolean evalLuaScript(String key, RateLimitRule rule) {DefaultRedisScript<Long> script = new DefaultRedisScript<>();script.setScriptSource(new ResourceScriptSource(new ClassPathResource("rate_limiter.lua")));script.setResultType(Long.class);List<String> keys = Arrays.asList(key + ":tokens", key + ":timestamp");String rate = String.valueOf(rule.getRate());  // 每秒生成令牌数String capacity = String.valueOf(rule.getBurstCapacity()); // 桶容量String now = String.valueOf(System.currentTimeMillis() / 1000); // 当前秒级时间戳String requested = String.valueOf(rule.getRequestedTokens()); // 每次请求消耗令牌数Long result = redisTemplate.execute(script, keys, rate, capacity, now, requested);return result != null && result == 1L;
}

三、动态规则配置

规则实体类

@Data
public class RateLimitRule {private String routeId;       // 路由IDprivate String type;          // 限流维度：IP/USER/APIprivate int burstCapacity;   // 桶容量（突发流量）private double rate;          // 令牌生成速率/秒private int requestedTokens = 1; // 每次请求消耗令牌数
}

配置中心监听

@RefreshScope
@Component
public class RateLimitConfigService {private Map<String, RateLimitRule> ruleMap = new ConcurrentHashMap<>();@Autowiredprivate NacosConfigManager nacosConfigManager;@PostConstructpublic void init() {// 监听Nacos配置变化nacosConfigManager.addListener("rate_limit_rules", "DEFAULT_GROUP", event -> {String newConfig = event.getConfig().getContent();updateRules(JSON.parseObject(newConfig, new TypeReference<List<RateLimitRule>>() {}));});}private void updateRules(List<RateLimitRule> newRules) {ruleMap = newRules.stream().collect(Collectors.toConcurrentMap(RateLimitRule::getRouteId, Function.identity()));}
}

四、性能优化策略

Redis连接优化

# application.yml
spring:redis:lettuce:pool:max-active: 200      # 最大连接数max-idle: 50min-idle: 20timeout: 3000

本地缓存降级

public class RateLimitFilter {// 使用Guava Cache做本地限流降级private LoadingCache<String, Boolean> localCache = CacheBuilder.newBuilder().expireAfterWrite(1, TimeUnit.SECONDS).build(new CacheLoader<String, Boolean>() {@Overridepublic Boolean load(String key) {return true; // 默认允许访问}});public boolean checkLocalCache(String key) {try {return localCache.get(key);} catch (ExecutionException e) {return true;}}
}

监控埋点

@Autowired
private MeterRegistry meterRegistry;public boolean evalLuaScript(String key, RateLimitRule rule) {Timer.Sample sample = Timer.start(meterRegistry);boolean allowed = ...;sample.stop(meterRegistry.timer("rate.limit.time", "route", rule.getRouteId()));Counter.builder("rate.limit.requests").tag("route", rule.getRouteId()).tag("allowed", String.valueOf(allowed)).register(meterRegistry).increment();return allowed;
}

五、压测数据对比

测试环境
• 网关节点：4C8G × 3

• Redis集群：6节点（3主3从）

• 压测工具：wrk 10万并发连接

性能指标

场景	QPS	平均延迟	错误率
无限流	28,000	35ms	0%
单节点限流	19,500	48ms	0%
Redis集群限流	15,200	63ms	0.05%
限流+本地缓存降级	17,800	55ms	0.3%

六、方案对比

限流方案	优点	缺点
Redis令牌桶（本方案）	精准分布式控制	增加Redis依赖
网关内置限流（如Sentinel）	开箱即用	扩展性受限
Nginx限流	高性能	无法动态更新规则

七、部署建议