스프링 시큐리티 로그인 성공후 403 페이지가 뜨고 있습니다.

Question

안녕하세요. 스프링 시큐리티를 적용할 때 문제가 생겨서 질문 드립니다.문제: 로그인 성공한 후 api를 호출하면 403 에러가 발생합니다.plugins { id 'java' id 'org.springframework.boot' version '3.2.3' id 'io.spring.dependency-management' version '1.1.4' } group &#61; 'com.study' version &#61; '0.0.1-SNAPSHOT' java { sourceCompatibility &#61; '17' } configurations { compileOnly { extendsFrom annotationProcessor } } repositories { mavenCentral() } dependencies { implementation 'org.springframework.boot:spring-boot-starter-security' implementation 'org.springframework.boot:spring-boot-starter-web' compileOnly 'org.projectlombok:lombok' developmentOnly 'org.springframework.boot:spring-boot-devtools' annotationProcessor 'org.projectlombok:lombok' testImplementation 'org.springframework.boot:spring-boot-starter-test' testImplementation 'org.springframework.security:spring-security-test' } tasks.named('test') { useJUnitPlatform() }gradle 환경설정 코드입니다.package com.study.securitytest.config; import com.study.securitytest.filter.AuthenticationFilter; import lombok.RequiredArgsConstructor; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.security.authentication.AuthenticationManager; import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer; import org.springframework.security.web.SecurityFilterChain; &#64;Configuration &#64;EnableWebSecurity &#64;RequiredArgsConstructor public class SecurityConfig { private final AuthenticationConfiguration authenticationConfiguration; &#64;Bean public SecurityFilterChain config(HttpSecurity http) throws Exception { http.csrf(AbstractHttpConfigurer::disable); http.authorizeHttpRequests(auth -> auth .anyRequest().authenticated() ); http.addFilter(getAuthenticationFilter()); return http.build(); } private AuthenticationFilter getAuthenticationFilter() throws Exception { AuthenticationManager authenticationManager &#61; authenticationConfiguration.getAuthenticationManager(); return new AuthenticationFilter(authenticationManager); } }스프링 시큐리티 설정하는 코드입니다.모든 url 에 대하여 인증과정을 거치도록 설정했습니다.package com.study.securitytest.filter; import jakarta.servlet.FilterChain; import jakarta.servlet.ServletException; import jakarta.servlet.http.HttpServletRequest; import jakarta.servlet.http.HttpServletResponse; import org.springframework.security.authentication.AuthenticationManager; import org.springframework.security.authentication.UsernamePasswordAuthenticationToken; import org.springframework.security.core.Authentication; import org.springframework.security.core.AuthenticationException; import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter; import java.io.IOException; public class AuthenticationFilter extends UsernamePasswordAuthenticationFilter { public AuthenticationFilter(AuthenticationManager authenticationManager) { super(authenticationManager); } &#64;Override public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException { String username &#61; request.getParameter(&#34;username&#34;); String password &#61; request.getParameter(&#34;password&#34;); Authentication authentication &#61; new UsernamePasswordAuthenticationToken(username, password); return getAuthenticationManager().authenticate(authentication); } &#64;Override protected void successfulAuthentication(HttpServletRequest request, HttpServletResponse response, FilterChain chain, Authentication authResult) throws IOException, ServletException { } }인증 필터를 사용한 코드입니다.사용자에게 로그인 정보를 받아와서 AuthenticationManager 에게 로그인 역할을 위임했습니다.package com.study.securitytest.service; import lombok.RequiredArgsConstructor; import org.springframework.security.core.userdetails.User; import org.springframework.security.core.userdetails.UserDetails; import org.springframework.security.core.userdetails.UserDetailsService; import org.springframework.security.core.userdetails.UsernameNotFoundException; import org.springframework.security.crypto.password.PasswordEncoder; import org.springframework.stereotype.Service; &#64;Service &#64;RequiredArgsConstructor public class AccountService implements UserDetailsService { private final PasswordEncoder passwordEncoder; &#64;Override public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException { String password &#61; passwordEncoder.encode(&#34;1234&#34;); return User.builder() .username(username) .password(password) .build(); } }UserDetailsService를 구현한 서비스 코드입니다.모든 username에 대하여 비밀번호 1234 이면 인증을 통과시킵니다.package com.study.securitytest.config; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder; import org.springframework.security.crypto.password.PasswordEncoder; &#64;Configuration public class WebConfig { &#64;Bean public PasswordEncoder passwordEncoder() { return new BCryptPasswordEncoder(); } }PasswordEncoder 스프링 빈을 등록한 코드입니다.package com.study.securitytest.controller; import org.springframework.web.bind.annotation.GetMapping; import org.springframework.web.bind.annotation.RestController; &#64;RestController public class HelloApiController { &#64;GetMapping(&#34;/hello&#34;) public String hello() { return &#34;hello&#34;; } }간단한 hello api 코드입니다.긴글 읽어주셔서 감사합니다:)application.properties 파일에 logging.level.root&#61;debug 설정을 추가하여 로그를 분석해 보았습니다.로그인 성공 -> 리다이렉트 url 호출 -> 익명 사용자 403위 과정을 알게되어 로그인을 했는데 왜 익명 사용자일까에 대하여 의문이 들었습니다.원인은 스프링 시큐리티 5 에서 6으로 넘아갈때 SecurityContext 정보를 담는 역할이 제거되었다고 합니다.https://velog.io/&#64;goniieee/Spring-Security%EB%8A%94-%EC%96%B4%EB%96%BB%EA%B2%8C-%EC%9D%B8%EC%A6%9D%EB%90%9C-%EC%82%AC%EC%9A%A9%EC%9E%90%EB%A5%BC-%EA%B8%B0%EC%96%B5%ED%95%A0%EA%B9%8C벼랑끝에서올라오는중 님 답변주신 내용을 토대로 /error 에 대해서 스프링 시큐리티 설정이 필요해 보여 추가했습니다.package com.study.securitytest.config; import com.study.securitytest.filter.AuthenticationFilter; import lombok.RequiredArgsConstructor; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.security.authentication.AuthenticationManager; import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer; import org.springframework.security.web.SecurityFilterChain; &#64;Configuration &#64;EnableWebSecurity &#64;RequiredArgsConstructor public class SecurityConfig { private final AuthenticationConfiguration authenticationConfiguration; &#64;Bean public SecurityFilterChain config(HttpSecurity http) throws Exception { http.csrf(AbstractHttpConfigurer::disable); http.authorizeHttpRequests(auth -> auth //에러 페이지를 인증,인가 대상에서 제외 .requestMatchers(&#34;/error&#34;).permitAll() .anyRequest().authenticated() ); http.addFilter(getAuthenticationFilter()); return http.build(); } private AuthenticationFilter getAuthenticationFilter() throws Exception { AuthenticationManager authenticationManager &#61; authenticationConfiguration.getAuthenticationManager(); return new AuthenticationFilter(authenticationManager); } }SecurityContext 객체를 세션에 담는 역할을 successfulAuthentication(...) 에 직접 구현했습니다.https://stackoverflow.com/questions/75289494/getting-anonymous-user-after-authentication-with-custom-filterpackage com.study.securitytest.filter; import jakarta.servlet.FilterChain; import jakarta.servlet.ServletException; import jakarta.servlet.http.HttpServletRequest; import jakarta.servlet.http.HttpServletResponse; import lombok.extern.slf4j.Slf4j; import org.springframework.security.authentication.AuthenticationManager; import org.springframework.security.authentication.UsernamePasswordAuthenticationToken; import org.springframework.security.core.Authentication; import org.springframework.security.core.AuthenticationException; import org.springframework.security.core.context.SecurityContext; import org.springframework.security.core.context.SecurityContextHolder; import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter; import org.springframework.security.web.context.HttpSessionSecurityContextRepository; import java.io.IOException; &#64;Slf4j public class AuthenticationFilter extends UsernamePasswordAuthenticationFilter { public AuthenticationFilter(AuthenticationManager authenticationManager) { super(authenticationManager); } &#64;Override public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException { String username &#61; request.getParameter(&#34;username&#34;); String password &#61; request.getParameter(&#34;password&#34;); Authentication authentication &#61; new UsernamePasswordAuthenticationToken(username, password); return getAuthenticationManager().authenticate(authentication); } &#64;Override protected void successfulAuthentication(HttpServletRequest request, HttpServletResponse response, FilterChain chain, Authentication authResult) throws IOException, ServletException { //SecurityContext 객체를 세션에 담는 코드 SecurityContext context &#61; SecurityContextHolder.createEmptyContext(); context.setAuthentication(authResult); HttpSessionSecurityContextRepository repository &#61; new HttpSessionSecurityContextRepository(); repository.saveContext(context, request, response); } }답변 주신 모든 분들께 감사드립니다 :)

벼랑끝에서올라오는중 · Accepted Answer

anyRequest().authenticated()로 인해 /error도 인증이 필요한 것으로 간주되어 발생한 것이기 때문에 모두에게 허용할 URI 목록에 /error를 추가하면 단순하게 해결할 수 있다. 아래 블로그를 참고하세요 https://colabear754.tistory.com/182

FeelingXD · Answer

http.authorizeHttpRequests(auth -> auth .anyRequest().authenticated() ); 모든 요청에대해서 권한검사를 진행하는것으로 보입니다. 이 경우에는 어떻게 로그인하지않은 상태에서 로그인을 할수 있나요 ? 로그인 이전에도 로그인해야 로그인 할 수 있는 모순적인 상황으로 보여집니다. &#x1f914;

닉네임없음 · Answer

아래 메소드는 특수한 기능이 탑재되어 있는데 굳이 오버라이딩 후 내용을 비우신 이유가 있나요?▶ successfulAuthentication상속대상인 부모안에 중요한 로직들이 잔뜩있어요.

스프링 시큐리티 로그인 성공후 403 페이지가 뜨고 있습니다.

3개의 답변

Q&A 목록