Skip to content

Commit 7ff605c

Browse files
apg0001apg0001
authored
Merge pull request #47 from Nexus-TruthAI/fix/#46
[fix] jwt 토큰 및 보안 설정 관련 롤백
2 parents bb72431 + a804410 commit 7ff605c

2 files changed

Lines changed: 200 additions & 64 deletions

File tree

‎src/main/java/jpabasic/truthaiserver/config/SecurityConfig.java‎

Lines changed: 53 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,49 @@
1+
//package jpabasic.truthaiserver.config;
2+
//
3+
//import jpabasic.truthaiserver.jwt.JwtFilter;
4+
//import lombok.extern.slf4j.Slf4j;
5+
//import org.springframework.beans.factory.annotation.Autowired;
6+
//import org.springframework.beans.factory.annotation.Configurable;
7+
//import org.springframework.context.annotation.Bean;
8+
//import org.springframework.context.annotation.Configuration;
9+
//import org.springframework.security.config.annotation.web.builders.HttpSecurity;
10+
//import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
11+
//import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
12+
//import org.springframework.security.config.annotation.web.configurers.HeadersConfigurer;
13+
//import org.springframework.security.web.SecurityFilterChain;
14+
//import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
15+
//
16+
//@EnableWebSecurity
17+
//@Configuration
18+
//@Slf4j
19+
//public class SecurityConfig {
20+
// @Autowired
21+
// private JwtFilter jwtFilter;
22+
//
23+
// @Bean
24+
// public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
25+
// return http.addFilterBefore(jwtFilter, UsernamePasswordAuthenticationFilter.class)
26+
// .authorizeHttpRequests(auth -> auth
27+
// // 공개 엔드포인트 (인증 불필요)
28+
// .requestMatchers(
29+
// "/auth/login",
30+
// "/auth/token/refresh",
31+
// "/swagger-ui/**",
32+
// "/v3/api-docs/**",
33+
// "/error"
34+
// ).permitAll()
35+
// // 나머지 모든 요청은 인증 필요
36+
// .anyRequest().authenticated()
37+
// )
38+
// .csrf(AbstractHttpConfigurer::disable)
39+
// .headers((headers -> headers
40+
// .frameOptions(HeadersConfigurer.FrameOptionsConfig::disable))
41+
// )
42+
// .build();
43+
// }
44+
//}
45+
46+
147
package jpabasic.truthaiserver.config;
248

349
import jpabasic.truthaiserver.jwt.JwtFilter;
@@ -24,21 +70,17 @@ public class SecurityConfig {
2470
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
2571
return http.addFilterBefore(jwtFilter, UsernamePasswordAuthenticationFilter.class)
2672
.authorizeHttpRequests(auth -> auth
27-
// 공개 엔드포인트 (인증 불필요)
28-
.requestMatchers(
29-
"/auth/login",
30-
"/auth/token/refresh",
31-
"/swagger-ui/**",
32-
"/v3/api-docs/**",
33-
"/error"
34-
).permitAll()
35-
// 나머지 모든 요청은 인증 필요
36-
.anyRequest().authenticated()
73+
// api 테스트 위해서 모든 권한 열어둠
74+
.anyRequest().permitAll()
75+
// 실제 배포 시 swagger랑 로그인만 열어둠
76+
// .requestMatchers("/api/auth", "/swagger-ui/**").permitAll()
77+
// .anyRequest().authenticated()
3778
)
79+
3880
.csrf(AbstractHttpConfigurer::disable)
3981
.headers((headers -> headers
4082
.frameOptions(HeadersConfigurer.FrameOptionsConfig::disable))
4183
)
4284
.build();
4385
}
44-
}
86+
}

‎src/main/java/jpabasic/truthaiserver/jwt/JwtFilter.java‎

Lines changed: 147 additions & 53 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,103 @@
1+
//package jpabasic.truthaiserver.jwt;
2+
//
3+
//import jakarta.servlet.FilterChain;
4+
//import jakarta.servlet.ServletException;
5+
//import jakarta.servlet.http.HttpServletRequest;
6+
//import jakarta.servlet.http.HttpServletResponse;
7+
//import jpabasic.truthaiserver.domain.User;
8+
//import jpabasic.truthaiserver.repository.UserRepository;
9+
//import jpabasic.truthaiserver.security.CustomUserDetails;
10+
//import jpabasic.truthaiserver.service.JwtService;
11+
//import lombok.RequiredArgsConstructor;
12+
//import lombok.extern.slf4j.Slf4j;
13+
//import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
14+
//import org.springframework.security.core.context.SecurityContextHolder;
15+
//import org.springframework.security.web.authentication.WebAuthenticationDetailsSource;
16+
//import org.springframework.stereotype.Component;
17+
//import org.springframework.web.filter.OncePerRequestFilter;
18+
//
19+
//import java.io.IOException;
20+
//import java.util.Optional;
21+
//
22+
//@Slf4j
23+
//@RequiredArgsConstructor
24+
//@Component
25+
//public class JwtFilter extends OncePerRequestFilter {
26+
//
27+
// private final JwtService jwtService;
28+
// private final UserRepository userRepository;
29+
//
30+
// @Override
31+
// protected void doFilterInternal(
32+
// HttpServletRequest request,
33+
// HttpServletResponse response,
34+
// FilterChain filterChain
35+
// ) throws ServletException, IOException {
36+
//
37+
// // 이미 인증되어 있으면 패스
38+
// if (SecurityContextHolder.getContext().getAuthentication() == null) {
39+
// String token = jwtService.extractToken(request);
40+
//
41+
// if (token != null) {
42+
// try {
43+
// if (jwtService.validateAccessToken(token)) {
44+
// // 토큰이 유효한 경우
45+
// authenticateUser(token, request);
46+
// } else {
47+
// // 토큰이 만료되었거나 유효하지 않은 경우
48+
// log.debug("JWT 토큰이 유효하지 않음");
49+
// response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
50+
// response.getWriter().write("{\"error\":\"토큰이 만료되었거나 유효하지 않습니다.\",\"code\":\"TOKEN_EXPIRED\"}");
51+
// return;
52+
// }
53+
// } catch (Exception e) {
54+
// // 토큰 파싱 실패 등 예외 발생 시
55+
// log.debug("JWT 토큰 검증 실패: {}", e.getMessage());
56+
// response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
57+
// response.getWriter().write("{\"error\":\"토큰 형식이 올바르지 않습니다.\",\"code\":\"INVALID_TOKEN\"}");
58+
// return;
59+
// }
60+
// } else {
61+
// // 토큰이 없는 경우
62+
// log.debug("JWT 토큰이 요청에 포함되지 않음");
63+
// response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
64+
// response.getWriter().write("{\"error\":\"인증 토큰이 필요합니다.\",\"code\":\"TOKEN_REQUIRED\"}");
65+
// return;
66+
// }
67+
// }
68+
//
69+
// filterChain.doFilter(request, response);
70+
// }
71+
//
72+
// private void authenticateUser(String token, HttpServletRequest request) {
73+
// try {
74+
// Long userId = jwtService.getUserIdByParseToken(token);
75+
// Optional<User> userOpt = userRepository.findById(userId);
76+
//
77+
// if (userOpt.isPresent()) {
78+
// User user = userOpt.get();
79+
// CustomUserDetails principal = new CustomUserDetails(user);
80+
//
81+
// UsernamePasswordAuthenticationToken authentication =
82+
// new UsernamePasswordAuthenticationToken(
83+
// principal,
84+
// null,
85+
// principal.getAuthorities()
86+
// );
87+
// authentication.setDetails(
88+
// new WebAuthenticationDetailsSource().buildDetails(request)
89+
// );
90+
//
91+
// SecurityContextHolder.getContext().setAuthentication(authentication);
92+
// log.debug("사용자 인증 성공 - userId: {}", userId);
93+
// }
94+
// } catch (Exception e) {
95+
// log.error("사용자 인증 처리 중 오류 발생: {}", e.getMessage());
96+
// }
97+
// }
98+
//}
99+
100+
1101
package jpabasic.truthaiserver.jwt;
2102

3103
import jakarta.servlet.FilterChain;
@@ -9,7 +109,6 @@
9109
import jpabasic.truthaiserver.security.CustomUserDetails;
10110
import jpabasic.truthaiserver.service.JwtService;
11111
import lombok.RequiredArgsConstructor;
12-
import lombok.extern.slf4j.Slf4j;
13112
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
14113
import org.springframework.security.core.context.SecurityContextHolder;
15114
import org.springframework.security.web.authentication.WebAuthenticationDetailsSource;
@@ -19,13 +118,38 @@
19118
import java.io.IOException;
20119
import java.util.Optional;
21120

22-
@Slf4j
121+
//@RequiredArgsConstructor
122+
//@Component
123+
//public class JwtFilter extends OncePerRequestFilter {
124+
//
125+
// private final JwtService jwtService;
126+
//
127+
// @Override
128+
// protected void doFilterInternal(HttpServletRequest request,
129+
// HttpServletResponse response,
130+
// FilterChain filterChain) throws ServletException, IOException {
131+
// String token = jwtService.extractToken(request);
132+
// if (token != null && jwtService.validateAccessToken(token)) {
133+
// var userDetails = jwtService.getUserDetailsFromToken(token);
134+
//
135+
// var authentication = new UsernamePasswordAuthenticationToken(
136+
// userDetails, null, userDetails.getAuthorities()
137+
// );
138+
// authentication.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
139+
//
140+
// SecurityContextHolder.getContext().setAuthentication(authentication);
141+
// }
142+
//
143+
// filterChain.doFilter(request, response);
144+
// }
145+
//}
146+
23147
@RequiredArgsConstructor
24148
@Component
25149
public class JwtFilter extends OncePerRequestFilter {
26150

27151
private final JwtService jwtService;
28-
private final UserRepository userRepository;
152+
private final UserRepository userRepository; // ✅ User 조회 위해 주입
29153

30154
@Override
31155
protected void doFilterInternal(
@@ -38,61 +162,31 @@ protected void doFilterInternal(
38162
if (SecurityContextHolder.getContext().getAuthentication() == null) {
39163
String token = jwtService.extractToken(request);
40164

41-
if (token != null) {
42-
try {
43-
if (jwtService.validateAccessToken(token)) {
44-
// 토큰이 유효한 경우
45-
authenticateUser(token, request);
46-
} else {
47-
// 토큰이 만료되었거나 유효하지 않은 경우
48-
log.debug("JWT 토큰이 유효하지 않음");
49-
response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
50-
response.getWriter().write("{\"error\":\"토큰이 만료되었거나 유효하지 않습니다.\",\"code\":\"TOKEN_EXPIRED\"}");
51-
return;
52-
}
53-
} catch (Exception e) {
54-
// 토큰 파싱 실패 등 예외 발생 시
55-
log.debug("JWT 토큰 검증 실패: {}", e.getMessage());
56-
response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
57-
response.getWriter().write("{\"error\":\"토큰 형식이 올바르지 않습니다.\",\"code\":\"INVALID_TOKEN\"}");
58-
return;
59-
}
60-
} else {
61-
// 토큰이 없는 경우
62-
log.debug("JWT 토큰이 요청에 포함되지 않음");
63-
response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
64-
response.getWriter().write("{\"error\":\"인증 토큰이 필요합니다.\",\"code\":\"TOKEN_REQUIRED\"}");
65-
return;
66-
}
67-
}
165+
if (token != null && jwtService.validateAccessToken(token)) {
166+
Long userId = jwtService.getUserIdByParseToken(token);
68167

69-
filterChain.doFilter(request, response);
70-
}
168+
Optional<User> userOpt = userRepository.findById(userId);
169+
if (userOpt.isPresent()) {
170+
User user = userOpt.get();
71171

72-
private void authenticateUser(String token, HttpServletRequest request) {
73-
try {
74-
Long userId = jwtService.getUserIdByParseToken(token);
75-
Optional<User> userOpt = userRepository.findById(userId);
76-
77-
if (userOpt.isPresent()) {
78-
User user = userOpt.get();
79-
CustomUserDetails principal = new CustomUserDetails(user);
172+
// ✅ 엔티티 포함한 UserDetails
173+
CustomUserDetails principal = new CustomUserDetails(user);
80174

81-
UsernamePasswordAuthenticationToken authentication =
82-
new UsernamePasswordAuthenticationToken(
83-
principal,
84-
null,
85-
principal.getAuthorities()
86-
);
87-
authentication.setDetails(
88-
new WebAuthenticationDetailsSource().buildDetails(request)
89-
);
175+
UsernamePasswordAuthenticationToken authentication =
176+
new UsernamePasswordAuthenticationToken(
177+
principal,
178+
null,
179+
principal.getAuthorities()
180+
);
181+
authentication.setDetails(
182+
new WebAuthenticationDetailsSource().buildDetails(request)
183+
);
90184

91-
SecurityContextHolder.getContext().setAuthentication(authentication);
92-
log.debug("사용자 인증 성공 - userId: {}", userId);
185+
SecurityContextHolder.getContext().setAuthentication(authentication);
186+
}
93187
}
94-
} catch (Exception e) {
95-
log.error("사용자 인증 처리 중 오류 발생: {}", e.getMessage());
96188
}
189+
190+
filterChain.doFilter(request, response);
97191
}
98192
}

0 commit comments

Comments
 (0)