From 81f6677602e9ff2e1c0d4b5e718307d85e4a2971 Mon Sep 17 00:00:00 2001 From: wonseok2877 Date: Fri, 15 Sep 2023 19:33:48 +0900 Subject: [PATCH] =?UTF-8?q?style:=20Filter,=20SerurityConfig=20=EC=BD=94?= =?UTF-8?q?=EB=93=9C=20=EC=A0=95=EB=A6=AC?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../common/constant/GlobalConstants.java | 11 +++++---- .../config/security/SecurityConfig.java | 23 +++++++++--------- .../web/log/ReadableRequestBodyWrapper.java | 2 +- .../log/ReadableRequestBodyWrapperFilter.java | 24 +++++++------------ 4 files changed, 27 insertions(+), 33 deletions(-) diff --git a/src/main/java/bokjak/bokjakserver/common/constant/GlobalConstants.java b/src/main/java/bokjak/bokjakserver/common/constant/GlobalConstants.java index ce10dcc..bac37f4 100644 --- a/src/main/java/bokjak/bokjakserver/common/constant/GlobalConstants.java +++ b/src/main/java/bokjak/bokjakserver/common/constant/GlobalConstants.java @@ -4,7 +4,11 @@ public class GlobalConstants { /** * Common */ - public static final String[] APPOINTED_URIS = { + public static final String[] AUTH_WHITELIST = { + "/", + "/csrf", + "/error", + "/auth/login/admin", "/auth/reissue", "/auth/login", @@ -26,10 +30,7 @@ public class GlobalConstants { "/swagger-ui/#", "/webjars/**", "/swagger/**", - "/swagger-ui/**", - "/", - "/csrf", - "/error" + "/swagger-ui/**" }; /** diff --git a/src/main/java/bokjak/bokjakserver/config/security/SecurityConfig.java b/src/main/java/bokjak/bokjakserver/config/security/SecurityConfig.java index 8330944..ea3b4dd 100644 --- a/src/main/java/bokjak/bokjakserver/config/security/SecurityConfig.java +++ b/src/main/java/bokjak/bokjakserver/config/security/SecurityConfig.java @@ -43,7 +43,10 @@ public PasswordEncoder passwordEncoder() { @Bean public SecurityFilterChain filterChain(HttpSecurity http) throws Exception { - http.csrf().disable() + http + .csrf().disable() + .formLogin().disable() + .httpBasic().disable() .cors().configurationSource(corsConfigurationSource()) .and() @@ -55,23 +58,21 @@ public SecurityFilterChain filterChain(HttpSecurity http) throws Exception { //세션 사용 안함 .sessionManagement() .sessionCreationPolicy(SessionCreationPolicy.STATELESS) - .and() - .formLogin().disable() - .httpBasic().disable() + .authorizeHttpRequests() - .requestMatchers(GlobalConstants.APPOINTED_URIS).permitAll() - .anyRequest().authenticated(); + .requestMatchers(GlobalConstants.AUTH_WHITELIST).permitAll() + .anyRequest().authenticated() - http.addFilterBefore(jwtAuthenticationFilter(), UsernamePasswordAuthenticationFilter.class); + .and() + .addFilterBefore(jwtAuthenticationFilter(), UsernamePasswordAuthenticationFilter.class); return http.build(); } @Bean public JwtAuthenticationFilter jwtAuthenticationFilter() { - JwtAuthenticationFilter jwtAuthenticationFilter = new JwtAuthenticationFilter(jwtProvider); - return jwtAuthenticationFilter; + return new JwtAuthenticationFilter(jwtProvider); } @Bean @@ -79,13 +80,13 @@ public CorsConfigurationSource corsConfigurationSource() { //다시 알아 CorsConfiguration configuration = new CorsConfiguration(); configuration.setAllowCredentials(true); - configuration.setAllowedOrigins(Arrays.asList("*")); + configuration.setAllowedOrigins(List.of("*")); configuration.setAllowedMethods( Arrays.asList(HttpMethod.POST.name(), HttpMethod.GET.name(), HttpMethod.PUT.name(), HttpMethod.DELETE.name(), HttpMethod.OPTIONS.name()) ); - configuration.setAllowedHeaders(Arrays.asList("*")); + configuration.setAllowedHeaders(List.of("*")); UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource(); source.registerCorsConfiguration("/**", configuration); diff --git a/src/main/java/bokjak/bokjakserver/web/log/ReadableRequestBodyWrapper.java b/src/main/java/bokjak/bokjakserver/web/log/ReadableRequestBodyWrapper.java index a6426c8..8ddbb51 100644 --- a/src/main/java/bokjak/bokjakserver/web/log/ReadableRequestBodyWrapper.java +++ b/src/main/java/bokjak/bokjakserver/web/log/ReadableRequestBodyWrapper.java @@ -48,7 +48,7 @@ public ReadableRequestBodyWrapper(HttpServletRequest request) { return; } if (request.getContentType() != null && request.getContentType().contains( - ContentType.MULTIPART_FORM_DATA.getMimeType())) { // 파일 업로드시 로깅 제외 TODO: 이 경우에도 로깅해야 하지 않나? + ContentType.MULTIPART_FORM_DATA.getMimeType())) { // 파일 업로드시 로깅 제외 return; } diff --git a/src/main/java/bokjak/bokjakserver/web/log/ReadableRequestBodyWrapperFilter.java b/src/main/java/bokjak/bokjakserver/web/log/ReadableRequestBodyWrapperFilter.java index 86fc0b2..48b24a8 100644 --- a/src/main/java/bokjak/bokjakserver/web/log/ReadableRequestBodyWrapperFilter.java +++ b/src/main/java/bokjak/bokjakserver/web/log/ReadableRequestBodyWrapperFilter.java @@ -1,28 +1,20 @@ package bokjak.bokjakserver.web.log; -import jakarta.servlet.*; +import jakarta.servlet.FilterChain; +import jakarta.servlet.ServletException; import jakarta.servlet.annotation.WebFilter; import jakarta.servlet.http.HttpServletRequest; +import jakarta.servlet.http.HttpServletResponse; +import org.jetbrains.annotations.NotNull; +import org.springframework.web.filter.OncePerRequestFilter; import java.io.IOException; @WebFilter(urlPatterns = "/*") // 대상: 전체 URI -public class ReadableRequestBodyWrapperFilter implements Filter { - - @Override - public void init(FilterConfig filterConfig) { - // Do nothing - } - - @Override - public void doFilter(ServletRequest request, ServletResponse response, FilterChain filterChain) throws IOException, ServletException { - ReadableRequestBodyWrapper wrapper = new ReadableRequestBodyWrapper((HttpServletRequest) request); - filterChain.doFilter(wrapper, response); // 필터 체인에 Wrapper 추가 - } - +public class ReadableRequestBodyWrapperFilter extends OncePerRequestFilter { @Override - public void destroy() { - // Do nothing + protected void doFilterInternal(@NotNull HttpServletRequest request, @NotNull HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException { + filterChain.doFilter(new ReadableRequestBodyWrapper(request), response); // 필터 체인에 커스텀 Wrapper 추가 } }