JHipster生成网关的Hazelcast配置咨询与暴力破解防护实现问题

问题描述 #

我计划在JHipster生成的网关中实现暴力破解防护服务，将登录失败的IP存入Hazelcast，但未找到Hazelcast的配置方式。我选择Hazelcast作为缓存，文档显示它是网关限流的默认缓存，但未找到RateLimitingFilter、CacheConfiguration或Hazelcast Management Center的docker-compose文件。请问是否需要按照其他微服务的方式配置？

生成的JHipster配置如下：

{
  "generator-jhipster": {
    "applicationType": "gateway",
    "authenticationType": "jwt",
    "baseName": "newFolder",
    "buildTool": "maven",
    "cacheProvider": "hazelcast",
    "clientFramework": "angular",
    "clientTestFrameworks": [],
    "clientTheme": "none",
    "creationTimestamp": 1717163178963,
    "databaseType": "sql",
    "devDatabaseType": "postgresql",
    "devServerPort": 4200,
    "enableHibernateCache": true,
    "enableSwaggerCodegen": false,
    "enableTranslation": false,
    ......
  }
}

解决方案 #

1. Hazelcast基础配置 #

JHipster网关选择hazelcast作为缓存提供者后，会自动配置Hazelcast实例，核心配置入口如下：

• 配置文件：查看src/main/resources/config/hazelcast.xml，可在此定义存储登录失败IP的缓存映射，设置过期时间、备份策略等规则。
• 代码层面：JHipster默认生成CacheConfiguration类（通常在com.yourpackage.config包下），若未找到可手动创建，通过@EnableCaching开启缓存，结合@CachePut、@CacheEvict等注解操作Hazelcast缓存。

2. 暴力破解防护的Filter实现 #

RateLimitingFilter不会自动生成，需手动实现登录失败IP的计数拦截逻辑：

• 创建自定义Filter继承OncePerRequestFilter，注入HazelcastInstance操作缓存：

@Autowired
private HazelcastInstance hazelcastInstance;

@Override
protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
    String ip = request.getRemoteAddr();
    IMap<String, Integer> loginFailures = hazelcastInstance.getMap("loginFailures");
    
    // 计数逻辑示例
    int failureCount = loginFailures.getOrDefault(ip, 0) + 1;
    loginFailures.put(ip, failureCount, 1, TimeUnit.HOURS); // 设置1小时过期
    
    if (failureCount >= 5) {
        response.sendError(HttpServletResponse.SC_FORBIDDEN, "Too many failed login attempts");
        return;
    }
    filterChain.doFilter(request, response);
}

3. Hazelcast Management Center的Docker配置 #

JHipster默认不生成该服务的docker-compose配置，需手动添加到docker-compose.yml：

hazelcast-management-center:
  image: hazelcast/management-center:5.3.6
  ports:
    - "8080:8080"
  environment:
    - MC_DEFAULT_CLUSTER=dev
    - MC_DEFAULT_CLUSTER_MEMBERS=hazelcast
  depends_on:
    - hazelcast

同时修改hazelcast.xml开启管理中心连接：

<management-center enabled="true">http://hazelcast-management-center:8080/hazelcast-mancenter</management-center>

4. 关于微服务配置的疑问 #

不需要完全照搬微服务的Hazelcast配置，网关场景更侧重缓存限流、登录防护这类网关层需求：

• 微服务的Hazelcast多用于分布式会话、实体缓存，而网关只需聚焦网关层面的缓存逻辑；
• 核心配置逻辑一致，均通过hazelcast.xml和Spring Cache注解管理缓存。

内容的提问来源于stack exchange，提问作者Dots