Next.js 15 Edge Middleware X-Forwarded-For 客户端 IP 提取与限流治理实践

核心价值从 `X-Forwarded-For` 安全提取客户端 IP 并进行入口级速率限制，降低滥用与攻击风险。使用标准响应头表达限流窗口与重试时间，提高客户端协作性。实现import { NextResponse, NextRequest } from 'next/server' const buckets = new Map<string, { count: number; reset: number }>() const WINDOW = 10_000 const LIMIT = 30 function getIP(req: NextRequest) { const xff = req.headers.get('x-forwarded-for') || '' const ip = xff.split(',')[0].trim() return ip || req.ip || 'unknown' } export function middleware(req: NextRequest) { const ip = getIP(req) const now = Date.now() const b = buckets.get(ip) || { count: 0, reset: now + WINDOW } if (now > b.reset) { b.count = 0; b.reset = now + WINDOW } b.count += 1 buckets.set(ip, b) if (b.count > LIMIT) { const retry = Math.ceil((b.reset - now) / 1000) return new NextResponse('Too Many Requests', { status: 429, headers: { 'Retry-After': String(retry) }, }) } return NextResponse.next() } export const config = { matcher: ['/((?!_next|api/public).*)'] } 治理建议生产环境建议使用持久化存储或网关级限流；示例为轻量入口治理，适合低流量保护。对静态资源与公开 API 排除限流（如通过 `matcher` 白名单），避免影响正常访问。结论入口限流是前端安全的基础防线之一。结合 IP 提取与标准限流响应头，可提升可预期性并降低滥用风险。