diff --git a/src/main/java/com/bamboo/log/domain/user/oauth/service/CustomSuccessHandler.java b/src/main/java/com/bamboo/log/domain/user/oauth/service/CustomSuccessHandler.java index f92af5d..9c97ffd 100644 --- a/src/main/java/com/bamboo/log/domain/user/oauth/service/CustomSuccessHandler.java +++ b/src/main/java/com/bamboo/log/domain/user/oauth/service/CustomSuccessHandler.java @@ -9,6 +9,7 @@ import jakarta.servlet.http.HttpServletRequest; import jakarta.servlet.http.HttpServletResponse; import lombok.RequiredArgsConstructor; +import org.springframework.http.ResponseCookie; import org.springframework.security.core.Authentication; import org.springframework.security.core.GrantedAuthority; import org.springframework.security.web.authentication.SimpleUrlAuthenticationSuccessHandler; @@ -26,42 +27,48 @@ public class CustomSuccessHandler extends SimpleUrlAuthenticationSuccessHandler private final JWTUtil jwtUtil; private final RefreshRepository refreshRepository; - @Override public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException, ServletException { CustomOAuth2User customUserDetails = (CustomOAuth2User) authentication.getPrincipal(); Long userId = customUserDetails.getId(); - String name=customUserDetails.getName(); + String name = customUserDetails.getName(); String username = customUserDetails.getUsername(); Collection authorities = authentication.getAuthorities(); Iterator iterator = authorities.iterator(); GrantedAuthority auth = iterator.next(); String role = auth.getAuthority(); - String refreshToken = jwtUtil.createJwt(userId,"refresh", name, username, role, 1800000L); - String accessToken = jwtUtil.createJwt(userId,"access", name, username, role, 1209600000L); + String refreshToken = jwtUtil.createJwt(userId, "refresh", name, username, role, 1800000L); + String accessToken = jwtUtil.createJwt(userId, "access", name, username, role, 1209600000L); addRefreshEntity(name, username, refreshToken, 1209600000L); - response.addCookie(createCookie("refresh", refreshToken)); - response.addCookie(UnScretCreateCookie("access", accessToken)); + + // SameSite 속성을 추가한 쿠키 설정 + response.addHeader("Set-Cookie", createCookie("refresh", refreshToken)); + response.addHeader("Set-Cookie", UnScretCreateCookie("access", accessToken)); response.sendRedirect("http://localhost:3000/welcome"); } - private Cookie createCookie(String key, String value) { - - Cookie cookie = new Cookie(key, value); - cookie.setMaxAge(24 * 60 * 60 * 14); - cookie.setPath("/"); - cookie.setHttpOnly(true); - - return cookie; + private String createCookie(String key, String value) { + ResponseCookie cookie = ResponseCookie.from(key, value) + .maxAge(24 * 60 * 60 * 14) // 14일 + .path("/") + .httpOnly(true) + .secure(true) // HTTPS에서만 전송하도록 설정 + .sameSite("None") // SameSite=None 설정 + .build(); + return cookie.toString(); } - private Cookie UnScretCreateCookie(String key, String value) { - Cookie cookie = new Cookie(key, value); - cookie.setMaxAge(60*60); - cookie.setPath("/"); - return cookie; + private String UnScretCreateCookie(String key, String value) { + ResponseCookie cookie = ResponseCookie.from(key, value) + .maxAge(60 * 60*12) // 12시간 + .path("/") + .secure(true) // HTTPS에서만 전송하도록 설정 + .sameSite("None") // SameSite=None 설정 + .build(); + return cookie.toString(); } + private void addRefreshEntity(String name, String username, String refresh, Long expiredMs) { Date CrDate = new Date(System.currentTimeMillis()); Date ExDate = new Date(System.currentTimeMillis() + expiredMs); @@ -75,4 +82,4 @@ private void addRefreshEntity(String name, String username, String refresh, Long .build() ); } -} \ No newline at end of file +}