SpringSecurity + jwt login 구현

Question

SpringSecurity와 jwt를 이용한 login 구현중입니다. 현재까지 구현 방법은 formLogin을 사용하고, loginSuccessHandler() 를 사용하여 access_token과 refresh_token을 생성합니다. 현재 겪고 있는 문제는 String authorizationHeader &#61; request.getHeader(HEADER_AUTHORIZATION); 요청 헤더에서 항상 null이 나오는 문제입니다. 프론트쪽에서 response 헤더에 있는 jwt 토큰을 자바스크립트로 따로 저장하는 로직이 필요한건가요? 아래 코드 첨부합니다. 1. securityConfig http.formLogin() .loginPage(&#34;/login&#34;) // 로그인 설정 .loginProcessingUrl(&#34;/member/login&#34;) .defaultSuccessUrl(&#34;/&#34;) .successHandler(loginSuccessHandler()) .and() .logout() // 로그아웃 설정 .logoutSuccessUrl(&#34;/login&#34;); http.addFilterBefore(new TokenAuthenticationFilter(jwtTokenProvider), UsernamePasswordAuthenticationFilter.class); 2. TokenAuthenticationFilter&#64;Slf4j &#64;RequiredArgsConstructor public class TokenAuthenticationFilter extends OncePerRequestFilter { private final JwtTokenProvider jwtTokenProvider; private final static String HEADER_AUTHORIZATION &#61; &#34;Authorization&#34;; private final static String TOKEN_PREFIX &#61; &#34;Bearer &#34;; &#64;Override protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException { // 요청 헤더의 Authorization 키의 값 조회 String authorizationHeader &#61; request.getHeader(HEADER_AUTHORIZATION); System.out.println(&#34;doFilterInternal authorizationHeader 확인: &#34; &#43; authorizationHeader); // 항상 Null 발생 // 가져온 값에서 접두사 제거 String token &#61; getAccessToken(authorizationHeader); if (token !&#61; null && jwtTokenProvider.validToken(token)) { Authentication authentication &#61; jwtTokenProvider.getAuthentication(token); SecurityContextHolder.getContext().setAuthentication(authentication); } filterChain.doFilter(request, response); } private String getAccessToken(String authorizationHeader) { if (authorizationHeader !&#61; null && authorizationHeader.startsWith(TOKEN_PREFIX)) { return authorizationHeader.substring(TOKEN_PREFIX.length()); } return null; } } 3. LoginSuccessHandler&#64;RequiredArgsConstructor public class LoginSuccessHandler extends SimpleUrlAuthenticationSuccessHandler { public static final String REFRESH_TOKEN_COOKIE_NAME &#61; &#34;refresh_token&#34;; public static final Duration REFRESH_TOKEN_DURATION &#61; Duration.ofDays(14); public static final Duration ACCESS_TOKEN_DURATION &#61; Duration.ofDays(1); public static final String REDIRECH_PATH &#61; &#34;/&#34;; private final JwtTokenProvider jwtTokenProvider; private final RefreshTokenRepository refreshTokenRepository; private final MemberService memberService; &#64;Override public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException { if (authentication !&#61; null && authentication.isAuthenticated()) { Object principal &#61; authentication.getPrincipal(); if (principal instanceof UserDetails) { // UserDetails로 캐스팅 UserDetails userDetails &#61; (UserDetails) principal; Member member &#61; memberService.findByEmail(userDetails.getUsername()); String refreshToken &#61; jwtTokenProvider.generateToken(member, REFRESH_TOKEN_DURATION); saveRefreshToken(member.getMemberId(), refreshToken); addRefreshTokenToCookie(request, response, refreshToken); String accessToken &#61; jwtTokenProvider.generateToken(member, ACCESS_TOKEN_DURATION); String targetUrl &#61; getTargetUrl(accessToken); // 리다이렉트 getRedirectStrategy().sendRedirect(request, response, targetUrl); } } } // 생성된 리프레시 토큰을 전달받아 데이터베이스에 저장 private void saveRefreshToken(Long userId, String newRefreshToken) { System.out.println(&#34;LoginSuccessHandler saveRefreshToken&#34;); RefreshToken refreshToken &#61; refreshTokenRepository.findByUserId(userId) .map(entity -> entity.update(newRefreshToken)) .orElse(new RefreshToken(userId, newRefreshToken)); refreshTokenRepository.save(refreshToken); } // 생성된 리프레시 토큰을 쿠키에 저장 private void addRefreshTokenToCookie(HttpServletRequest request, HttpServletResponse response, String refreshToken) { System.out.println(&#34;LoginSuccessHandler addRefreshTokenToCookie&#34;); int cookieMaxAge &#61; (int) REFRESH_TOKEN_DURATION.toSeconds(); CookieUtil.deleteCookie(request, response, REFRESH_TOKEN_COOKIE_NAME); CookieUtil.addCookie(response, REFRESH_TOKEN_COOKIE_NAME, refreshToken, cookieMaxAge); }

stopoff · Answer

프론트쪽에서 response 헤더에 있는 jwt 토큰을 자바스크립트로 따로 저장하는 로직이 필요한건가요? <= 프론트 단에서 jwt토큰 넣어줘야 합니다

SpringSecurity + jwt login 구현

1개의 답변

Q&A 목록