spring security 5.7 버전에서는 successhandler를 사용하지 않는건가요??

Question

package com.example.memo.utils; import jakarta.servlet.DispatcherType; import lombok.RequiredArgsConstructor; import lombok.extern.slf4j.Slf4j; import org.springframework.boot.autoconfigure.security.servlet.PathRequest; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.security.authentication.AuthenticationManager; import org.springframework.security.config.Customizer; import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder; import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration; import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; import org.springframework.security.config.annotation.web.configuration.WebSecurityCustomizer; import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer; import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder; import org.springframework.security.crypto.password.PasswordEncoder; import org.springframework.security.web.SecurityFilterChain; import org.springframework.security.web.authentication.*; import org.springframework.web.cors.CorsConfiguration; import org.springframework.web.cors.CorsConfigurationSource; import org.springframework.web.cors.UrlBasedCorsConfigurationSource; import java.util.Arrays; &#64;Configuration &#64;EnableMethodSecurity &#64;RequiredArgsConstructor &#64;Slf4j public class SecurityConfig { private final JwtInterceptor jwtInterceptor; private final CustomUserDetailService myUserDetailService; private final CustomAuthenticationSuccessHandler successHandler; private final CustomAuthenticationFailureHandler failureHandler; &#64;Bean public WebSecurityCustomizer webSecurityCustomizer() { return web -> web.ignoring() .requestMatchers(PathRequest.toStaticResources().atCommonLocations()); } &#64;Bean public PasswordEncoder passwordEncoder() { return new BCryptPasswordEncoder(); } private static final String[] AUTH_WHITELIST &#61; { &#34;/**&#34;, }; // 여기서 전체적으로 설정을 해줌. &#64;Bean public SecurityFilterChain filterChain(HttpSecurity http) throws Exception { AuthenticationManagerBuilder sharedObject &#61; http.getSharedObject(AuthenticationManagerBuilder.class); AuthenticationManager authenticationManager &#61; sharedObject.build(); http.authenticationManager(authenticationManager); return http // csrf 설정 해제 .csrf(AbstractHttpConfigurer::disable) .authorizeHttpRequests( authorize -> authorize .dispatcherTypeMatchers(DispatcherType.ERROR).permitAll() .requestMatchers(&#34;/api/**&#34;).permitAll() // 해당하는 url 전부 접근 허용 .anyRequest().authenticated() ).formLogin(login -> login .loginProcessingUrl(&#34;/api/login&#34;) .usernameParameter(&#34;userId&#34;) .passwordParameter(&#34;password&#34;) .successHandler(successHandler) .failureHandler(failureHandler) .defaultSuccessUrl(&#34;/api/login-success&#34;, true) // 기본적으로 로그인 성공시 '/'로 리다이렉트를 함(바로 직전 url에서 넘어오는데 이게 '/') ) // 원래 default로 동작했던 UsernamePasswordAuthenticationFilter 대신에 AbstractAuthenticationProcessingFilter가 동작하도록 설정함.(필터 바꿔치핻) .addFilterAt( this.abstractAuthenticationProcessingFilter(authenticationManager), UsernamePasswordAuthenticationFilter.class) .logout(Customizer.withDefaults()) .httpBasic(Customizer.withDefaults()) .build(); } // cors 설정 &#64;Bean public CorsConfigurationSource corsConfigurationSource() { CorsConfiguration configuration &#61; new CorsConfiguration(); configuration.setAllowedOrigins(Arrays.asList(&#34;*&#34;)); configuration.setAllowedMethods(Arrays.asList(&#34;GET&#34;, &#34;POST&#34;, &#34;PUT&#34;, &#34;DELETE&#34;)); configuration.setAllowedHeaders(Arrays.asList(&#34;X-Requested-With&#34;, &#34;Content-Type&#34;, &#34;Authorization&#34;, &#34;X-XSRF-token&#34;)); configuration.setAllowCredentials(false); configuration.setMaxAge(3600L); UrlBasedCorsConfigurationSource source &#61; new UrlBasedCorsConfigurationSource(); source.registerCorsConfiguration(&#34;/**&#34;, configuration); return source; } &#64;Bean public AuthenticationManager authenticationManager(AuthenticationConfiguration authenticationConfiguration) throws Exception { return authenticationConfiguration.getAuthenticationManager(); } // 직접 만든 로그인 필터(LoginAuthenticationFilter)를 등록해준다 // /api/login를 요청하면 로그인 필터가 적용된다. public AbstractAuthenticationProcessingFilter abstractAuthenticationProcessingFilter( final AuthenticationManager authenticationManager ) { return new LoginAuthenticationFilter( &#34;/api/login&#34;, authenticationManager ); } &#64;Bean public AuthenticationSuccessHandler successHandler() { return new CustomAuthenticationSuccessHandler(); } &#64;Bean public AuthenticationFailureHandler failureHandler() { return new CustomAuthenticationFailureHandler(); } } &#64;Slf4j &#64;Component(value &#61; &#34;authenticationSuccessHandler&#34;) public class CustomAuthenticationSuccessHandler implements AuthenticationSuccessHandler { // 로그인 성공시 작동 &#64;Override public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException, ServletException { UserDetails userDetails &#61; (UserDetails) authentication.getPrincipal(); System.out.println(&#34;로그인 성공하면 뜨는거11&#34;); log.info(&#34;userId : {}&#34;, userDetails.getUsername()); log.info(&#34;password : {}&#34;, userDetails.getPassword()); } } 이렇게 했는데 실제로 적용이 안되고 있는데요...도대체 뭐가 문제인가 싶은데 spring security 5.7 버전부터는 설정 방법이 많이 바뀐거로 알고 있는데 그러면 successhandler는 어떻게 적용을 해야하는건가요??

cogmind · Answer

직접 만드신 필터가 먼저 처리되니까 formLogin에 있는 설정들을 LoginAuthenticationFilter에 추가하시면되겠네요.

spring security 5.7 버전에서는 successhandler를 사용하지 않는건가요??

1개의 답변

Q&A 목록