How to Prevent API Scraping in High‑Traffic Seckill Systems with Java

1. Introduction

During major promotion periods such as Double 11, 618 or year‑end sales, flash‑sale (seckill) activities are crucial for user engagement and revenue, but the high‑concurrency scenario is easily abused by malicious users who scrape the interface, leading to service avalanche, inventory anomalies, and legitimate users being unable to place orders.

The author, an experienced Java backend engineer with eight years of experience, shares a step‑by‑step analysis from a business perspective combined with practical experience.

2. Business Pain Points

What is interface scraping?

Interface scraping refers to automated, high‑frequency requests to the seckill interface to抢占资源, typically manifested as scripts, crawlers, automated tools, concurrent requests for inventory occupation, proxy IP usage to bypass rate limits, and mass account registrations.

Characteristics of flash‑sale business

High concurrency: request volume spikes dramatically in a short period.

Low latency requirement: users expect rapid responses.

Limited inventory: few items lead to fierce competition.

High fairness demand: scraping degrades normal user experience.

3. Solution Design

We can address the problem from several dimensions:

Interface rate limiting (Rate Limiting)

User behavior identification (risk control)

Captcha integration

Request signature (anti‑replay)

Seckill interface hardening (token mechanism, async order, atomic stock deduction)

4. Key Technical Implementation (Java)

1. Rate limiting with Guava Token Bucket

private static final RateLimiter rateLimiter = RateLimiter.create(50); // 每秒最多 50 个请求

@GetMapping("/seckill")
public ResponseEntity<String> doSeckill(@RequestParam Long productId) {
    if (!rateLimiter.tryAcquire()) {
        return ResponseEntity.status(HttpStatus.TOO_MANY_REQUESTS)
                             .body("请求过于频繁，请稍后再试");
    }
    // 进行秒杀逻辑
    return ResponseEntity.ok("秒杀成功");
}

2. Request signature verification

public boolean checkSignature(String userId, String timestamp, String sign) {
    String secret = "server_secret"; // 服务端秘钥
    String raw = userId + timestamp + secret;
    String expectedSign = DigestUtils.md5DigestAsHex(raw.getBytes());
    return expectedSign.equals(sign);
}

3. Captcha generation (Kaptcha)

@GetMapping("/captcha")
public void getCaptcha(HttpServletResponse response, HttpSession session) throws IOException {
    String captchaText = producer.createText();
    session.setAttribute("captcha", captchaText);
    BufferedImage image = producer.createImage(captchaText);
    ImageIO.write(image, "jpg", response.getOutputStream());
}

4. Captcha validation before seckill

@PostMapping("/seckill")
public ResponseEntity<String> doSeckill(@RequestParam String captchaInput, HttpSession session) {
    String realCaptcha = (String) session.getAttribute("captcha");
    if (!captchaInput.equalsIgnoreCase(realCaptcha)) {
        return ResponseEntity.badRequest().body("验证码错误");
    }
    // 继续处理秒杀逻辑
}

5. Asynchronous order with message queue

// API only sends message
@PostMapping("/seckill")
public ResponseEntity<String> doSeckill(@RequestBody SeckillRequest request) {
    if (!verifyToken(request.getToken())) {
        return ResponseEntity.status(HttpStatus.FORBIDDEN).body("非法请求");
    }
    mqSender.send("SECKILL_QUEUE", request);
    return ResponseEntity.ok("请求已受理");
}

// Consumer processes real order
@RabbitListener(queues = "SECKILL_QUEUE")
public void handleSeckill(SeckillRequest request) {
    // check stock, deduct, generate order
}

5. Anti‑Scraping Strategy Recommendations

Combine multiple measures according to the following priority:

Rate limiting – ★★★★★ (most fundamental and effective)

Captcha – ★★★★☆ (raises barrier for bots)

Risk control – ★★★★☆ (detects abnormal behavior)

Request signing – ★★★☆☆ (prevents forged requests)

Asynchronous order – ★★★★★ (reduces interface pressure and improves success rate)

6. Conclusion and Outlook

Preventing interface scraping is a systematic engineering effort that requires a multi‑dimensional approach: “frontend interception + middle‑layer rate limiting + backend hardening + abnormal behavior detection”. No single solution is sufficient; only a combination of techniques can truly ensure system stability and fairness.