JWT claims is empty

Question

JWT 토큰 검증에 대해서 아래와 같이 코드를 작성해 놓았는데, JWT claims is emtpy 에러가 발생하고 있습니다. 회원가입, 로그인, 로그아웃은 정상적으로 동작하며 refresh token으로 access token을 갱신하는 코드를 테스트 할 때 해당 에러가 발생합니다.처음에는 발급된 토큰의 문제로 생각되어서 토큰을 다시 디코딩해 보았는데 디코딩 결과로는 alg, sub, exp, iat 모두 정상적으로 출력되고 있어 claims가 비어 있다는 에러의 원인을 모르겠습니다...&#64;Slf4j &#64;RequiredArgsConstructor public class JwtTokenFilter extends OncePerRequestFilter { private final JwtTokenUtil jwtTokenUtil; &#64;Override protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException { String accessToken &#61; jwtTokenUtil.getHeaderToken(request, &#34;Access&#34;); String refreshToken &#61; jwtTokenUtil.getHeaderToken(request, &#34;Refresh&#34;); if (accessToken !&#61; null) { if (!jwtTokenUtil.tokenValidataion(accessToken)) { jwtExceptionHandler(response, &#34;AccessToken Expired&#34;, HttpStatus.BAD_REQUEST); return; } setAuthentication(jwtTokenUtil.getEmailFromToken(accessToken)); } else if (refreshToken !&#61; null) { if (!jwtTokenUtil.refreshTokenValidation(refreshToken)) { jwtExceptionHandler(response, &#34;RefreshToken Expired&#34;, HttpStatus.BAD_REQUEST); return; } setAuthentication(jwtTokenUtil.getEmailFromToken(refreshToken)); } filterChain.doFilter(request, response); } public void setAuthentication(String email) { Authentication authentication &#61; jwtTokenUtil.createAuthentication(email); SecurityContextHolder.getContext().setAuthentication(authentication); } public void jwtExceptionHandler (HttpServletResponse response, String msg, HttpStatus status) { response.setStatus(status.value()); response.setContentType(&#34;application/json&#34;); try { String json &#61; new ObjectMapper().writeValueAsString(new GlobalResDto(msg, status.value())); response.getWriter().write(json); }catch (Exception e) { log.error(e.getMessage()); } } } &#64;Slf4j &#64;Component &#64;RequiredArgsConstructor public class JwtTokenUtil { private final RefreshTokenRepository refreshTokenRepository; private final PrincipalDetailsService userDetailsService; public static final String ACCESS_TOKEN &#61; &#34;access_token&#34;; public static final String REFRESH_TOKEN &#61; &#34;refresh_token&#34;; private static final long ACCESS_TIME &#61; Duration.ofMinutes(30).toMillis(); // 만료시간 30분 private static final long REFRESH_TIME &#61; Duration.ofDays(14).toMillis(); // 만료시간 2주 &#64;Value(&#34;${jwt.secret}&#34;) private String secretKey; private Key key; &#64;PostConstruct public void init() { byte[] bytes &#61; Base64.getDecoder().decode(secretKey); key &#61; Keys.hmacShaKeyFor(bytes); } public String getHeaderToken(HttpServletRequest request, String type) { return type.equals(&#34;Access&#34;) ? request.getHeader(ACCESS_TOKEN) : request.getHeader(REFRESH_TOKEN); } public TokenDto createAllToken(String email) { return new TokenDto(createToken(email, &#34;Access&#34;), createToken(email, &#34;Refresh&#34;)); } public String createToken(String email, String type) { Date date &#61; new Date(); long time &#61; type.equals(&#34;Access&#34;) ? ACCESS_TIME : REFRESH_TIME; return Jwts.builder() .setSubject(email) .setExpiration(new Date(date.getTime() &#43; time)) .setIssuedAt(date) .signWith(SignatureAlgorithm.HS256, key) .compact(); } //refreshToken 검증 public Boolean tokenValidataion(String token) { try { Jwts.parserBuilder().setSigningKey(key).build().parseClaimsJws(token); return true; } catch (SecurityException | MalformedJwtException e) { log.error(&#34;Invalid JWT signature&#34;); return false; } catch (ExpiredJwtException e) { log.error(&#34;Expired JWT&#34;); return false; } catch (UnsupportedJwtException e) { log.error(&#34;Unsupported JWT&#34;); return false; } catch (IllegalArgumentException e) { log.error(&#34;JWT claims is empty&#34;); return false; } catch (Exception e) { log.error(e.getMessage()); return false; } } public Boolean refreshTokenValidation(String token) { //1차 검증 if (!tokenValidataion(token)) return false; //DB에 저장된 토큰 비교 Optional<RefreshToken> refreshToken &#61; refreshTokenRepository.findByUserEmail(getEmailFromToken(token)); return refreshToken.isPresent() && token.equals(refreshToken.get().getRefreshToken()); } public Authentication createAuthentication(String email) { UserDetails userDetails &#61; userDetailsService.loadUserByUsername(email); return new UsernamePasswordAuthenticationToken(userDetails, &#34;&#34;, userDetails.getAuthorities()); } public String getEmailFromToken(String token) { return Jwts.parserBuilder().setSigningKey(key).build().parseClaimsJws(token).getBody().getSubject(); } }

닉네임없음 · Answer

재발급 로직이 안보입니다.createAllToken 이거로 토큰 발급 및 재발급을 하실것 같습니다.아래 에서 if (accessToken !&#61; null) { if (!jwtTokenUtil.tokenValidataion(accessToken)) { jwtExceptionHandler(response, &#34;AccessToken Expired&#34;, HttpStatus.BAD_REQUEST); return; } setAuthentication(jwtTokenUtil.getEmailFromToken(accessToken)); } else if (refreshToken !&#61; null) { if (!jwtTokenUtil.refreshTokenValidation(refreshToken)) { jwtExceptionHandler(response, &#34;RefreshToken Expired&#34;, HttpStatus.BAD_REQUEST); return; } setAuthentication(jwtTokenUtil.getEmailFromToken(refreshToken)); }위 내용중에서 else 구문에if (!jwtTokenUtil.refreshTokenValidation(refreshToken)) { .... } else { 1. 재발급 처리 2. setAuthentication(재발급된 엑세스토큰); }이후재발급된 2개의 토큰을 응답정보(header정보등...)로 내려주는 로직 필요이러면 되지 않을까요?

JWT claims is empty

1개의 답변

Q&A 목록