diff --git a/Briefing-Api/src/main/java/com/example/briefingapi/security/config/SecurityConfig.java b/Briefing-Api/src/main/java/com/example/briefingapi/security/config/SecurityConfig.java index a1cb924..339e502 100644 --- a/Briefing-Api/src/main/java/com/example/briefingapi/security/config/SecurityConfig.java +++ b/Briefing-Api/src/main/java/com/example/briefingapi/security/config/SecurityConfig.java @@ -36,7 +36,7 @@ import lombok.extern.slf4j.Slf4j; @Slf4j -@EnableWebSecurity +@EnableWebSecurity(debug = true) @RequiredArgsConstructor @Configuration public class SecurityConfig { @@ -62,6 +62,12 @@ public class SecurityConfig { @Value("${swagger.login.password}") private String swaggerPass; + private static final String[] JWT_WHITE_LIST ={ + "/pushs","/members/auth","/v2/members/auth", + "briefings", "/v2/briefings","/chattings", + "/briefings/temp" + }; + @Bean public PasswordEncoder passwordEncoder() { return new BCryptPasswordEncoder(); @@ -77,13 +83,11 @@ public WebSecurityCustomizer webSecurityCustomizer() { return (web) -> web.ignoring() .requestMatchers( - "", - "/", + "","/", "/schedule", "/v3/api-docs", "/v3/api-docs/**", - "/docs/**","/fcms/**","/members/auth/**","/v2/members/auth/**", - "/briefings/temp"); + "/docs/**"); } @Bean @@ -147,7 +151,7 @@ public SecurityFilterChain JwtFilterChain(HttpSecurity http) throws Exception { .authenticationEntryPoint(jwtAuthenticationEntryPoint) .accessDeniedHandler(jwtAccessDeniedHandler)) .addFilterBefore( - new JwtRequestFilter(tokenProvider), + new JwtRequestFilter(tokenProvider,JWT_WHITE_LIST), UsernamePasswordAuthenticationFilter.class) .addFilterBefore(jwtAuthenticationExceptionHandler, JwtRequestFilter.class) .build(); diff --git a/Briefing-Api/src/main/java/com/example/briefingapi/security/filter/JwtRequestFilter.java b/Briefing-Api/src/main/java/com/example/briefingapi/security/filter/JwtRequestFilter.java index 0fed31b..6bbd2cb 100644 --- a/Briefing-Api/src/main/java/com/example/briefingapi/security/filter/JwtRequestFilter.java +++ b/Briefing-Api/src/main/java/com/example/briefingapi/security/filter/JwtRequestFilter.java @@ -1,6 +1,7 @@ package com.example.briefingapi.security.filter; import java.io.IOException; +import java.util.Arrays; import com.example.briefingapi.security.provider.TokenProvider; import jakarta.servlet.FilterChain; @@ -22,6 +23,7 @@ public class JwtRequestFilter extends OncePerRequestFilter { private final TokenProvider tokenProvider; + private final String[] whiteList; @Override protected void doFilterInternal( HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) @@ -39,4 +41,17 @@ protected void doFilterInternal( } filterChain.doFilter(httpServletRequest, response); } + + /** + * 필터를 무시할 대상 지정 + * @param request current HTTP request + * @return 화이트 리스트 포함 여부 + * @throws ServletException + */ + + @Override + protected boolean shouldNotFilter(HttpServletRequest request) throws ServletException { + String path = request.getRequestURI(); + return Arrays.stream(whiteList).anyMatch(path::startsWith); + } } diff --git a/Briefing-Api/src/main/java/com/example/briefingapi/security/handler/annotation/AuthUserArgumentResolver.java b/Briefing-Api/src/main/java/com/example/briefingapi/security/handler/annotation/AuthUserArgumentResolver.java index 1be7254..c26e069 100644 --- a/Briefing-Api/src/main/java/com/example/briefingapi/security/handler/annotation/AuthUserArgumentResolver.java +++ b/Briefing-Api/src/main/java/com/example/briefingapi/security/handler/annotation/AuthUserArgumentResolver.java @@ -6,6 +6,9 @@ import jakarta.servlet.http.HttpServletRequest; import org.springframework.core.MethodParameter; +import org.springframework.security.authentication.UsernamePasswordAuthenticationToken; +import org.springframework.security.core.Authentication; +import org.springframework.security.core.context.SecurityContextHolder; import org.springframework.stereotype.Component; import org.springframework.util.StringUtils; import org.springframework.web.bind.support.WebDataBinderFactory; diff --git a/Briefing-Api/src/main/resources/application.yml b/Briefing-Api/src/main/resources/application.yml index 8dd35fb..71dd1ed 100644 --- a/Briefing-Api/src/main/resources/application.yml +++ b/Briefing-Api/src/main/resources/application.yml @@ -24,6 +24,9 @@ fcm: topic: daily-push : dailyPush --- +logging: + level: + org.springframework.security.web.FilterChainProxy: DEBUG spring: config: activate: @@ -66,7 +69,7 @@ jwt: # dev server secret: ${JWT_SECRET} authorities-key: authoritiesKey - access-token-validity-in-seconds: 1200000 + access-token-validity-in-seconds: 3000 refresh-token-validity-in-seconds: 1210000000 # 14 d openai: