SpringSecurity에서 ajax로 로그인 후 페이지 이동을 하면 인증이 사라집니다.

Question

안녕하세요.SpringSecurity와 ajax를 이용한 로그인을 만들고 있습니다.로그인 폼에서 아이디, 패스워드를 입력해서 인증을 통과하면 UsernamePasswordAuthenticationToken 기반의 Authentication 이 생성되고 SuccessHandler의 onAuthenticationSuccess까지 실행이 됩니다.이 후 로그인 페이지에서 document.location.href 로 대시보드 페이지로 이동을 시키는데 문제는 여기서 발생합니다. 대시보드 페이지로 진입하는 순간 AuthorizationFilter의 getAuthentication 메서드에서 AnonymousAuthenticationToken을 뱉으면서 다시 로그인 페이지로 돌아가는 현상입니다.AbstractAuthenticationProcessingFilter, AuthenticationProvider, AuthenticationSuccessHandler, AuthenticationFailureHandler, AuthenticationEntryPoint 를 구현했습니다.@Configuration @RequiredArgsConstructor public class SecurityConfig { private final PasswordEncoder passwordEncoder ; private final OCAAuthenticationSuccessHandler authenticationSuccessHandler ; private final OCAAuthenticationFailureHandler authenticationFailureHandler ; private final MemberService memberService ; @Bean public SecurityFilterChain filterChain(HttpSecurity http) throws Exception { return http .httpBasic(AbstractHttpConfigurer::disable) .csrf(AbstractHttpConfigurer::disable) .cors(CorsConfigurer::disable) .authorizeHttpRequests( request -> request .requestMatchers(SystemConst.WHITEPAGE_LIST).permitAll() .anyRequest().authenticated() ) .addFilterBefore(getAuthenticationProcessingFilter(), UsernamePasswordAuthenticationFilter.class) .exceptionHandling( exception -> exception.authenticationEntryPoint(new OCAAuthenticationEntryPoint()) ) .build() ; } @Bean public OCAAuthenticationProcessingFilter getAuthenticationProcessingFilter() { OCAAuthenticationProcessingFilter authenticationProcessingFilter = new OCAAuthenticationProcessingFilter() ; authenticationProcessingFilter.setAuthenticationManager(authenticationManager()) ; authenticationProcessingFilter.setAuthenticationSuccessHandler(authenticationSuccessHandler) ; authenticationProcessingFilter.setAuthenticationFailureHandler(authenticationFailureHandler) ; return authenticationProcessingFilter ; } @Bean public AuthenticationManager authenticationManager() { return new ProviderManager(new OCAAuthenticationProvider(passwordEncoder, memberService)) ; } }public class OCAAuthenticationProcessingFilter extends AbstractAuthenticationProcessingFilter { private static final String DEFAULT_LOGIN_PROCESS_URL = "/login/authorize" ; private static final String HTTP_METHOD = HttpMethod.POST.name() ; private static final String CONTENT_TYPE = "application/json" ; private final ObjectMapper objectMapper = new ObjectMapper() ; public OCAAuthenticationProcessingFilter() { super(new AntPathRequestMatcher(DEFAULT_LOGIN_PROCESS_URL, HTTP_METHOD)) ; } @Override public void setFilterProcessesUrl(String filterProcessesUrl) { super.setFilterProcessesUrl(filterProcessesUrl); } @Override public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException, IOException, ServletException { if (!StringUtils.equals(request.getContentType(), CONTENT_TYPE)) { throw new AuthenticationServiceException("Authentication Content-Type not supported: " + request.getContentType()) ; } SecurityContext sc = SecurityContextHolder.getContext() ; System.out.println(sc.getAuthentication()) ; AuthenticationDTO dto = objectMapper.readValue(StreamUtils.copyToString(request.getInputStream(), StandardCharsets.UTF_8), AuthenticationDTO.class) ; String username = dto.getMemberId() ; String password = dto.getMemberPw() ; if (username == null || password == null) { throw new AuthenticationServiceException("로그인 정보가 올바르지 않습니다. 아이디 또는 비밀번호를 확인해 주시기 바랍니다.") ; } UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(username, password) ; return this.getAuthenticationManager().authenticate(authRequest) ; } @Data private static class AuthenticationDTO { String memberId ; String memberPw ; } }public class OCAAuthenticationProvider implements AuthenticationProvider { private final PasswordEncoder passwordEncoder ; private final MemberService memberService ; public OCAAuthenticationProvider(PasswordEncoder passwordEncoder, MemberService memberService) { super() ; this.passwordEncoder = passwordEncoder ; this.memberService = memberService ; } @Override public Authentication authenticate(Authentication authentication) throws AuthenticationException { String badCredentialMessage = "로그인 정보가 올바르지 않습니다. 아이디 또는 비밀번호를 확인해 주시기 바랍니다." ; String memberId = authentication.getName() ; if (StringUtils.isBlank(memberId)) { throw new BadCredentialsException(badCredentialMessage) ; } String memberPw = (String) authentication.getCredentials() ; if (StringUtils.isBlank(memberPw)) { throw new BadCredentialsException(badCredentialMessage) ; } SystemMember member = memberService.getMemberById(memberId) ; if (member == null) { throw new BadCredentialsException(badCredentialMessage) ; } if (passwordEncoder.matches(memberPw, member.getMemberPassword())) { return new UsernamePasswordAuthenticationToken(memberId, memberPw, new ArrayList<>(List.of(new SimpleGrantedAuthority(SystemConst.ROLE_MEMBER)))) ; } throw new BadCredentialsException(badCredentialMessage) ; } @Override public boolean supports(Class authentication) { return authentication.equals(UsernamePasswordAuthenticationToken.class) ; } }@Component public class OCAAuthenticationSuccessHandler implements AuthenticationSuccessHandler { @Override public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException, ServletException { Map result = new HashMap<>() ; result.put(SystemConst.RESULT, SystemConst.RESULT_SUCCESS) ; response.setCharacterEncoding(StandardCharsets.UTF_8.name()) ; response.setStatus(HttpServletResponse.SC_OK) ; response.setContentType(MediaType.APPLICATION_JSON_VALUE) ; new ObjectMapper().writeValue(response.getWriter(), result) ; response.getWriter().flush() ; } }@Component public class OCAAuthenticationFailureHandler implements AuthenticationFailureHandler { @Override public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response, AuthenticationException exception) throws IOException, ServletException { Map result = new HashMap<>() ; result.put(SystemConst.RESULT, SystemConst.RESULT_ERROR) ; result.put(SystemConst.RESULT_MESSAGE, exception.getMessage()) ; response.setCharacterEncoding(StandardCharsets.UTF_8.name()) ; response.setStatus(HttpServletResponse.SC_UNAUTHORIZED) ; response.setContentType(MediaType.APPLICATION_JSON_VALUE) ; new ObjectMapper().writeValue(response.getWriter(), result) ; response.getWriter().flush() ; } }public class OCAAuthenticationEntryPoint implements AuthenticationEntryPoint { @Override public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException authException) throws IOException, ServletException { response.sendRedirect(SystemConst.LOGIN_URI_FOR_WEB) ; } }로그인 후 대시보드로 이동하면서 위의 AuthenticationEntryPoint에서 commence메서드를 계속 타고 있길래 디버그 걸어보니 AuthorizationFilter의 getAuthentication 메서드에서 AnonymousAuthenticationToken을 반환하고 있어서 commence 메서드가 실행되고 있었습니다.로그인을 수행할 때는 AbstractAuthenticationProcessingFilter의 successfulAuthentication메서드에서 SecurityContext에 인증 통과한 UsernamePasswordAuthenticationToken이 저장되는것은 확인했습니다.어느 부분이 문제일까요..

kenu,전독시 · Answer

ajax로 받은 토큰은 어디에 저장했나요?cookie 또는 localStorage 저장을 추천합니다.

SpringSecurity에서 ajax로 로그인 후 페이지 이동을 하면 인증이 사라집니다.

1개의 답변

Q&A 목록