스프링 시큐리티 접속 권한 설정 관련 - 403 Forbidden

Question

로그인을 하여eyJhbGciOiJIUzI1NiJ9.***********************와 같이 토큰을 받고토큰이 있는 사용자들은 "/hotel" 경로에 요청 가능하도록 설정하고 싶습니다.아래와 같이 설정 및 필터 메소드를 구현했는데 403 (Forbidden) 오류가 발생합니다. 로그인한 사용자 별로 권한 부여하는 로직을 별도로 구현해야 하는 건가요?//JwtAuthencationFilter.javapackage com.example.travelappbackend.security; import com.example.travelappbackend.service.JwtService; import jakarta.servlet.FilterChain; import jakarta.servlet.ServletException; import jakarta.servlet.http.HttpServletRequest; import jakarta.servlet.http.HttpServletResponse; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.security.authentication.UsernamePasswordAuthenticationToken; import org.springframework.security.core.context.SecurityContextHolder; import org.springframework.security.web.authentication.WebAuthenticationDetailsSource; import org.springframework.stereotype.Component; import org.springframework.web.filter.OncePerRequestFilter; import java.io.IOException; import java.util.ArrayList; @Component public class JwtAuthenticationFilter extends OncePerRequestFilter { @Autowired private JwtService jwtService; @Override protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws ServletException, IOException { response.setCharacterEncoding("UTF-8"); final String authorizationHeader = request.getHeader("Authorization"); String subject = null; String jwt = null; if (authorizationHeader != null && authorizationHeader.startsWith("Bearer ")) { jwt = authorizationHeader.substring(7); subject = jwtService.extractSubject(jwt); } if (subject != null && SecurityContextHolder.getContext().getAuthentication() == null) { if (jwtService.validateToken(jwt)) { UsernamePasswordAuthenticationToken usernamePasswordAuthenticationToken = new UsernamePasswordAuthenticationToken(subject, null, new ArrayList<>()); usernamePasswordAuthenticationToken.setDetails(new WebAuthenticationDetailsSource().buildDetails(request)); SecurityContextHolder.getContext().setAuthentication(usernamePasswordAuthenticationToken); } } chain.doFilter(request, response); } catch (ExpiredJwtException e) { response.setStatus(HttpServletResponse.SC_UNAUTHORIZED); response.getWriter().write("JWT 토큰이 만료되었습니다."); response.getWriter().flush(); } catch (Exception e) { response.setStatus(HttpServletResponse.SC_UNAUTHORIZED); // 401 상태 코드 반환 response.getWriter().write("유효한 JWT 토큰이 아닙니다."); response.getWriter().flush(); } } // JwtAuthentication.javapackage com.example.travelappbackend.config; import com.example.travelappbackend.security.JwtAuthenticationFilter; import lombok.RequiredArgsConstructor; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.security.authentication.AuthenticationManager; import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer; import org.springframework.security.config.http.SessionCreationPolicy; import org.springframework.security.web.SecurityFilterChain; import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter; @Configuration @EnableWebSecurity @RequiredArgsConstructor public class SecurityConfig { @Autowired private JwtAuthenticationFilter jwtAuthenticationFilter; @Bean public AuthenticationManager authenticationManager(AuthenticationConfiguration authenticationConfiguration) throws Exception { return authenticationConfiguration.getAuthenticationManager(); } @Bean public SecurityFilterChain filterChain(HttpSecurity http) throws Exception { http.csrf(AbstractHttpConfigurer::disable) .authorizeRequests() .requestMatchers( "/hotel/**", "/flight/**", "/domestic/**").authenticated() .anyRequest().permitAll() .and() .sessionManagement((sessionManagementConfig)-> sessionManagementConfig.sessionCreationPolicy(SessionCreationPolicy.STATELESS) ); http.addFilterBefore(jwtAuthenticationFilter, UsernamePasswordAuthenticationFilter.class); return http.build(); } } /* build.gradle 설정 implementation 'org.springframework.boot:spring-boot-starter-security' implementation group: 'io.jsonwebtoken', name: 'jjwt-api', version: '0.11.5' runtimeOnly group: 'io.jsonwebtoken', name: 'jjwt-impl', version: '0.11.5' runtimeOnly group: 'io.jsonwebtoken', name: 'jjwt-jackson', version: '0.11.5' */(해결)// JwtService.javapackage com.example.travelappbackend.service; import io.jsonwebtoken.Claims; import io.jsonwebtoken.ExpiredJwtException; import io.jsonwebtoken.Jwts; import io.jsonwebtoken.SignatureAlgorithm; import io.jsonwebtoken.security.Keys; import org.springframework.stereotype.Service; import java.time.LocalDateTime; import java.time.ZoneId; import java.util.Date; import java.util.Map; @Service public class JwtService { private static String secretKey = "javaSpringBootJWT**********"; public String create(Map claims, LocalDateTime expiredAt, String userId) { try { var key = Keys.hmacShaKeyFor(secretKey.getBytes()); var _expiredAt = Date.from(expiredAt.atZone(ZoneId.systemDefault()).toInstant()); return Jwts.builder().signWith(key, SignatureAlgorithm.HS256) .setClaims(claims) .setSubject(userId) // <-------- 이 부분을 설정안해서 jwtService의 subject가 null .setExpiration(_expiredAt) .compact(); } catch(Exception e){ e.printStackTrace(); throw new RuntimeException("Failed to create JWT", e); } } public boolean validateToken(String token) { try { Jwts.parserBuilder().setSigningKey(secretKey.getBytes()).build().parseClaimsJws(token); return true; } catch (ExpiredJwtException e) { e.printStackTrace(); System.out.println("JWT expired: " + e.getMessage()); throw e; // 만료된 토큰 예외를 다시 던져 필터에서 처리 } catch (Exception e) { e.printStackTrace(); return false; } } public String extractSubject(String token) { Claims claims = Jwts.parserBuilder().setSigningKey(secretKey.getBytes()).build().parseClaimsJws(token).getBody(); return claims.getSubject(); } }

기검기검 · Answer

시큐리티 컨텍스트에 인증객체를 UsernamePasswordToken 말고 Authentication 타입 객체로 바꾸셔서 해보셨남유

xxrcn11 · Answer

당연하게도 Authentication 객체는 존재하지만 권한 코드에 아무것도 없으니 403이 표시됩니다.해결방법은 2가지 정도 있습니다.JwtAuthenticationFilter 클래스에서 토근에서 userid를 추출해서 해당 사용자의 권한 코드 목록을 조회해서 UsernamePasswordAuthenticationToken 생성 시 추가한다.토큰 자체에 권한 코드 목록을 포함하고 토큰에서 권한 코드 목록을 추출한 다음 UsernamePasswordAuthenticationToken 생성 시 추가한다.

스프링 시큐리티 접속 권한 설정 관련 - 403 Forbidden

2개의 답변

Q&A 목록