如何设计接口反爬虫：从 Token 到行为风控的完整方案

package antibot

import (
    "crypto/rand"
    "encoding/base64"
    "sync"
    "time"
)

type tokenStore struct {
    mu     sync.RWMutex
    tokens map[string]tokenMeta
}

type tokenMeta struct {
    ip        string
    userAgent string
    issuedAt  time.Time
    ttl       time.Duration
}

var store = &tokenStore{tokens: make(map[string]tokenMeta)}

// Issue 生成并存储一个 msToken
func Issue(ip, ua string) string {
    b := make([]byte, 64)
    rand.Read(b)
    token := base64.URLEncoding.EncodeToString(b)

    store.mu.Lock()
    store.tokens[token] = tokenMeta{
        ip:        ip,
        userAgent: ua,
        issuedAt:  time.Now(),
        ttl:       30 * time.Minute,
    }
    store.mu.Unlock()
    return token
}

// Verify 校验 msToken 合法性
func Verify(token, ip, ua string) bool {
    store.mu.RLock()
    meta, ok := store.tokens[token]
    store.mu.RUnlock()

    if !ok {
        return false
    }
    if time.Since(meta.issuedAt) > meta.ttl {
        return false
    }
    // 绑定 IP 和 UA（可按需放宽）
    return meta.ip == ip && meta.userAgent == ua
}

package antibot

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/base64"
    "fmt"
    "net/url"
    "sort"
    "strings"
    "time"
)

const signSecret = "your-server-side-secret"

// BuildSignInput 按约定规则拼接待签名字符串
func BuildSignInput(params url.Values, msToken, ua, timestamp, nonce string) string {
    keys := make([]string, 0, len(params))
    for k := range params {
        keys = append(keys, k)
    }
    sort.Strings(keys)

    var parts []string
    for _, k := range keys {
        parts = append(parts, fmt.Sprintf("%s=%s", k, params.Get(k)))
    }
    paramStr := strings.Join(parts, "&")
    return strings.Join([]string{paramStr, msToken, ua, timestamp, nonce}, "|")
}

// Sign 生成签名（服务端预期值）
func Sign(input string) string {
    mac := hmac.New(sha256.New, []byte(signSecret))
    mac.Write([]byte(input))
    return base64.URLEncoding.EncodeToString(mac.Sum(nil))
}

// VerifyABogus 校验请求携带的 a_bogus
func VerifyABogus(params url.Values, msToken, ua, timestamp, nonce, aBogus string) bool {
    // 时间戳防重放：只接受 5 分钟以内的请求
    ts, err := time.Parse(time.RFC3339, timestamp)
    if err != nil || time.Since(ts).Abs() > 5*time.Minute {
        return false
    }

    input := BuildSignInput(params, msToken, ua, timestamp, nonce)
    expected := Sign(input)
    return hmac.Equal([]byte(expected), []byte(aBogus))
}

package ratelimit

import (
    "context"
    "fmt"
    "time"

    "github.com/redis/go-redis/v9"
)

var rdb *redis.Client

// Allow 判断 key（如 IP 或 uid）在 window 内是否超过 limit 次
func Allow(ctx context.Context, key string, limit int, window time.Duration) bool {
    now := time.Now().UnixMilli()
    windowStart := now - window.Milliseconds()

    redisKey := fmt.Sprintf("rl:%s", key)
    pipe := rdb.Pipeline()

    // 移除窗口外的旧记录
    pipe.ZRemRangeByScore(ctx, redisKey, "0", fmt.Sprintf("%d", windowStart))
    // 记录本次请求
    pipe.ZAdd(ctx, redisKey, redis.Z{Score: float64(now), Member: now})
    // 统计窗口内请求数
    countCmd := pipe.ZCard(ctx, redisKey)
    // 设置 key 过期
    pipe.Expire(ctx, redisKey, window*2)

    pipe.Exec(ctx)

    return countCmd.Val() <= int64(limit)
}

// FingerprintScore 根据指纹特征打风险分
// 返回 0-100，越高越可疑
func FingerprintScore(fp Fingerprint) int {
    score := 0

    // 无头浏览器通常没有 WebGL 渲染器信息
    if fp.WebGLRenderer == "" || fp.WebGLRenderer == "unknown" {
        score += 30
    }
    // Canvas 指纹全为空白是 Headless 的典型特征
    if fp.CanvasHash == "empty" {
        score += 30
    }
    // 字体数量异常少
    if fp.FontCount < 5 {
        score += 20
    }
    // UA 声称是桌面浏览器但没有触摸支持
    if fp.Platform == "desktop" && !fp.HasTouch && fp.MaxTouchPoints == 0 {
        score += 10
    }
    return score
}

package middleware

import (
    "net/http"
    "net/url"
)

func AntiCrawler(next http.Handler) http.Handler {
    return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
        ip := realIP(r)
        ua := r.UserAgent()

        // 第一层：频率限制
        if !ratelimit.Allow(r.Context(), ip, 30, 60*time.Second) {
            http.Error(w, "too many requests", http.StatusTooManyRequests)
            return
        }

        // 第二层：msToken 校验
        msToken := r.Header.Get("X-Ms-Token")
        if msToken == "" {
            msToken = r.URL.Query().Get("msToken")
        }
        if !antibot.Verify(msToken, ip, ua) {
            http.Error(w, "invalid token", http.StatusForbidden)
            return
        }

        // 第三层：a_bogus 签名校验
        q := r.URL.Query()
        aBogus := q.Get("a_bogus")
        timestamp := q.Get("_ts")
        nonce := q.Get("_nonce")
        // 从 query 中移除签名参数本身，再参与验签
        verifyParams := make(url.Values)
        for k, v := range q {
            if k != "a_bogus" && k != "_ts" && k != "_nonce" {
                verifyParams[k] = v
            }
        }
        if !antibot.VerifyABogus(verifyParams, msToken, ua, timestamp, nonce, aBogus) {
            http.Error(w, "invalid signature", http.StatusForbidden)
            return
        }

        next.ServeHTTP(w, r)
    })
}

func realIP(r *http.Request) string {
    if ip := r.Header.Get("X-Real-IP"); ip != "" {
        return ip
    }
    if ip := r.Header.Get("X-Forwarded-For"); ip != "" {
        return strings.Split(ip, ",")[0]
    }
    return r.RemoteAddr
}