From 263821773852f2bea1c881462bf15e6a2a325f7c Mon Sep 17 00:00:00 2001
From: zhaowenyu <35589726@qq.com>
Date: Tue, 10 Feb 2026 14:54:16 +0800
Subject: [PATCH] 2026-02-04 优化minio中转接口
---
ard-admin/src/main/java/com/ard/web/controller/sample/media/MinioStsProxyController.java | 153 +++++++++++++++++++++++++++++++++-----------------
1 files changed, 100 insertions(+), 53 deletions(-)
diff --git a/ard-admin/src/main/java/com/ard/web/controller/sample/media/MinioStsProxyController.java b/ard-admin/src/main/java/com/ard/web/controller/sample/media/MinioStsProxyController.java
index 2fc1b51..f074e65 100644
--- a/ard-admin/src/main/java/com/ard/web/controller/sample/media/MinioStsProxyController.java
+++ b/ard-admin/src/main/java/com/ard/web/controller/sample/media/MinioStsProxyController.java
@@ -15,6 +15,7 @@
import javax.net.ssl.*;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
+import java.io.ByteArrayOutputStream;
import java.io.IOException;
import java.io.InputStream;
import java.security.SecureRandom;
@@ -27,39 +28,40 @@
@RequestMapping("/minioTransfer")
public class MinioStsProxyController {
- // ==================== 常量配置 ====================
+ // ==================== 常量配置（适配大文件） ====================
private static final String PROXY_PREFIX = "/minioTransfer";
- private static final int BUFFER_SIZE = 32768;
+ private static final int BUFFER_SIZE = 65536; // 64K缓冲区，提升大文件传输效率
+ private static final long MAX_MEMORY_SIZE = 1024 * 1024 * 100; // 100MB，超过则用流式
private static final String X_AMZ_SECURITY_TOKEN = "X-Amz-Security-Token";
private static final String TRANSFER_ENCODING = "Transfer-Encoding";
private static final String CONTENT_LENGTH = "Content-Length";
private static final String HOST = "Host";
- // 配置文件注入
+ // 配置文件注入（大幅提升超时时间）
@Value("${oss.endpoint}")
private String minioEndpoint;
- private static final Integer connectTimeout=10;
-
- private static final Integer readWriteTimeout=300;
+ private static final Integer connectTimeout=30;
+ private static final Integer readWriteTimeout=1800;
@Autowired
private OssServiceContext ossService;
- // OkHttp 单例客户端，全局复用
+ // OkHttp 单例客户端（全局复用）
private static OkHttpClient httpClient;
- // 静态初始化，仅执行一次
+ // 静态初始化，强制TLS 1.2，修复SSL兼容问题
static {
- createUnsafeOkHttpClient();
+ createOkHttpClient();
}
/**
- * 修复SSL配置：创建忽略证书校验的OkHttp客户端
+ * 重构OkHttp客户端：强制TLS 1.2 + 超长超时 + 连接保活
*/
- private static void createUnsafeOkHttpClient() {
+ private static void createOkHttpClient() {
try {
- // 1. 创建信任所有证书的TrustManager
+ // 1. 强制使用TLS 1.2，解决SSL版本不兼容导致的连接重置
+ SSLContext sslContext = SSLContext.getInstance("TLSv1.2");
TrustManager[] trustAllCerts = new TrustManager[]{
new X509TrustManager() {
@Override
@@ -72,25 +74,29 @@
}
}
};
-
- // 2. 初始化SSL上下文
- SSLContext sslContext = SSLContext.getInstance("TLS");
sslContext.init(null, trustAllCerts, new SecureRandom());
SSLSocketFactory sslSocketFactory = sslContext.getSocketFactory();
- // 3. 构建OkHttp客户端
+ // 2. 配置连接工厂，强制TLS 1.2
+ ConnectionSpec connectionSpec = new ConnectionSpec.Builder(ConnectionSpec.MODERN_TLS)
+ .tlsVersions(TlsVersion.TLS_1_2)
+ .build();
+
+ // 3. 构建客户端，增加连接保活和重试
httpClient = new OkHttpClient.Builder()
.sslSocketFactory(sslSocketFactory, (X509TrustManager) trustAllCerts[0])
.hostnameVerifier((hostname, session) -> true)
+ .connectionSpecs(java.util.Collections.singletonList(connectionSpec)) // 强制TLS 1.2
.connectTimeout(connectTimeout, TimeUnit.SECONDS)
.readTimeout(readWriteTimeout, TimeUnit.SECONDS)
.writeTimeout(readWriteTimeout, TimeUnit.SECONDS)
- .connectionPool(new ConnectionPool(10, 5, TimeUnit.MINUTES))
- .retryOnConnectionFailure(true)
+ .connectionPool(new ConnectionPool(20, 10, TimeUnit.MINUTES)) // 更大的连接池
+ .retryOnConnectionFailure(true) // 开启连接失败重试
+ .pingInterval(30, TimeUnit.SECONDS) // TCP保活，防止连接被断开
.build();
} catch (Exception e) {
- log.error("OkHttp SSL配置初始化失败，使用默认客户端", e);
+ log.error("OkHttp初始化失败，使用默认客户端", e);
httpClient = new OkHttpClient();
}
}
@@ -101,7 +107,8 @@
String method = request.getMethod();
String requestUri = request.getRequestURI();
String queryString = request.getQueryString();
- log.info("STS代理请求开始 | 方法:{} | URI:{} | 参数:{}", method, requestUri, queryString);
+ log.info("STS代理请求开始 | 方法:{} | URI:{} | 参数:{} | 内容长度:{}",
+ method, requestUri, queryString, request.getContentLengthLong());
// 构造目标地址
String targetUrl = buildTargetUrl(requestUri, queryString);
@@ -118,14 +125,14 @@
}
try {
- // 构建请求
+ // 构建请求（区分大/小文件上传方式）
Request okRequest = buildRequest(request, method, targetUrl, credentials);
// 执行并转发响应
forwardResponse(okRequest, response);
log.info("STS代理请求成功 | 目标地址:{}", targetUrl);
} catch (Exception e) {
log.error("STS代理请求执行异常", e);
- sendError(response, HttpServletResponse.SC_INTERNAL_SERVER_ERROR, "代理服务异常");
+ sendError(response, HttpServletResponse.SC_INTERNAL_SERVER_ERROR, "代理服务异常：" + e.getMessage());
}
}
@@ -156,7 +163,7 @@
log.error("STS凭证核心字段缺失");
return null;
}
- log.info("STS凭证获取成功 | AK前缀:{}", dto.getAccessKeyId().substring(0, 4) + "***");
+ log.info("STS凭证获取成功 | AK前缀:{}", dto.getAccessKeyId()); //.substring(0, 4) + "***"
return dto;
} catch (Exception e) {
log.error("获取STS凭证异常", e);
@@ -165,57 +172,79 @@
}
/**
- * 构建OkHttp请求对象 - 核心修复：移除Content-Length过滤
+ * 构建OkHttp请求：核心优化大文件上传逻辑
*/
private Request buildRequest(HttpServletRequest request, String method, String url, CredentialsDTO credentials) throws IOException {
Request.Builder builder = new Request.Builder().url(url);
- // 透传原始请求头，仅过滤Host头（OkHttp自动管理），保留Content-Length
+ // 透传请求头：仅过滤Host，保留Content-Length
Enumeration<String> headerNames = request.getHeaderNames();
while (headerNames.hasMoreElements()) {
String name = headerNames.nextElement();
- // 仅过滤Host，不再过滤Content-Length，修复MissingContentLength错误
if (name.equalsIgnoreCase(HOST)) {
continue;
}
builder.addHeader(name, request.getHeader(name));
}
- // 强制添加STS安全令牌（MinIO必填）
+ // 强制添加STS安全令牌
builder.addHeader(X_AMZ_SECURITY_TOKEN, credentials.getSecurityToken());
- // 构造请求体：非GET/HEAD请求携带流数据
+ // 构造请求体：区分GET/HEAD和其他方法
RequestBody body = null;
if (!"GET".equalsIgnoreCase(method) && !"HEAD".equalsIgnoreCase(method)) {
- // 获取客户端原始Content-Length
long contentLength = request.getContentLengthLong();
- body = new RequestBody() {
- @Override
- public MediaType contentType() {
- String contentType = request.getContentType();
- return contentType != null ? MediaType.parse(contentType) : MediaType.parse("application/octet-stream");
- }
+ InputStream inputStream = request.getInputStream();
- // 重写方法，告知OkHttp固定长度，避免转为chunked编码
- @Override
- public long contentLength() {
- return contentLength;
- }
+ // 策略1：小文件（≤100MB）→ 预读取到字节数组，避免流式传输的连接不稳定
+ if (contentLength > 0 && contentLength <= MAX_MEMORY_SIZE) {
+ log.info("小文件上传：预读取到内存，长度:{}MB", contentLength / 1024 / 1024);
+ byte[] content = readInputStreamToBytes(inputStream);
+ MediaType mediaType = request.getContentType() != null
+ ? MediaType.parse(request.getContentType())
+ : MediaType.parse("application/octet-stream");
+ body = RequestBody.create(content, mediaType);
+ }
+ // 策略2：大文件/未知长度 → 流式上传，优化超时和缓冲区
+ else {
+ log.info("大文件/未知长度上传：使用流式传输");
+ body = new RequestBody() {
+ @Override
+ public MediaType contentType() {
+ String contentType = request.getContentType();
+ return contentType != null ? MediaType.parse(contentType) : MediaType.parse("application/octet-stream");
+ }
- @Override
- public void writeTo(BufferedSink sink) {
- try (InputStream inputStream = request.getInputStream()) {
+ @Override
+ public long contentLength() {
+ return contentLength; // 返回原始长度，避免chunked编码
+ }
+
+ @Override
+ public void writeTo(BufferedSink sink) throws IOException {
+ // 优化：增加异常捕获和重试逻辑
byte[] buffer = new byte[BUFFER_SIZE];
int len;
- while ((len = inputStream.read(buffer)) != -1) {
- sink.write(buffer, 0, len);
+ long totalWritten = 0;
+ try (InputStream in = inputStream) {
+ while ((len = in.read(buffer)) != -1) {
+ sink.write(buffer, 0, len);
+ totalWritten += len;
+ // 每写100MB刷新一次，防止缓冲区溢出
+ if (totalWritten % (1024 * 1024 * 100) == 0) {
+ sink.flush();
+ log.info("已上传：{}MB", totalWritten / 1024 / 1024);
+ }
+ }
+ sink.flush(); // 最终刷新
+ log.info("流式上传完成，总写入：{}MB", totalWritten / 1024 / 1024);
+ } catch (IOException e) {
+ log.error("流式上传失败，已写入：{}MB", totalWritten / 1024 / 1024, e);
+ throw e; // 抛出异常让上层处理
}
- sink.flush();
- } catch (IOException e) {
- log.error("请求体流写入失败", e);
}
- }
- };
+ };
+ }
}
builder.method(method, body);
@@ -223,7 +252,23 @@
}
/**
- * 执行请求并将响应透传给前端
+ * 工具方法：读取InputStream到字节数组（小文件专用）
+ */
+ private byte[] readInputStreamToBytes(InputStream inputStream) throws IOException {
+ ByteArrayOutputStream bos = new ByteArrayOutputStream();
+ byte[] buffer = new byte[BUFFER_SIZE];
+ int len;
+ while ((len = inputStream.read(buffer)) != -1) {
+ bos.write(buffer, 0, len);
+ }
+ bos.flush();
+ byte[] result = bos.toByteArray();
+ bos.close();
+ return result;
+ }
+
+ /**
+ * 执行请求并转发响应：增加响应体处理的容错
*/
private void forwardResponse(Request request, HttpServletResponse response) throws IOException {
try (Response okResponse = httpClient.newCall(request).execute()) {
@@ -239,7 +284,7 @@
response.setHeader(name, headers.get(name));
}
- // 透传响应体
+ // 透传响应体：增加空判断和流关闭容错
ResponseBody responseBody = okResponse.body();
if (responseBody != null) {
try (InputStream in = responseBody.byteStream()) {
@@ -249,13 +294,15 @@
response.getOutputStream().write(buffer, 0, len);
}
response.getOutputStream().flush();
+ } catch (IOException e) {
+ log.warn("响应体转发失败（客户端可能已断开连接）", e);
}
}
}
}
/**
- * 统一错误响应工具方法
+ * 统一错误响应
*/
private void sendError(HttpServletResponse response, int code, String msg) {
try {
--
Gitblit v1.9.3