🔀 Jwt Login

build.gradle

@@ -59,6 +59,9 @@ dependencies {
     // Security
     implementation 'org.springframework.boot:spring-boot-starter-security'
     testImplementation 'org.springframework.security:spring-security-test'
+    implementation 'io.jsonwebtoken:jjwt-api:0.12.3'
+    implementation 'io.jsonwebtoken:jjwt-impl:0.12.3'
+    implementation 'io.jsonwebtoken:jjwt-jackson:0.12.3'
 }
 
 test {

src/main/java/com/mycom/socket/auth/config/SecurityConfig.java

@@ -1,5 +1,8 @@
 package com.mycom.socket.auth.config;
 
+import com.mycom.socket.auth.jwt.JWTFilter;
+import com.mycom.socket.auth.jwt.JWTUtil;
+import com.mycom.socket.auth.service.MemberDetailsService;
 import lombok.RequiredArgsConstructor;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
@@ -8,26 +11,33 @@
 import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
 import org.springframework.security.config.http.SessionCreationPolicy;
 import org.springframework.security.web.SecurityFilterChain;
+import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
+import org.springframework.web.cors.CorsConfiguration;
 
 @Configuration
 @EnableWebSecurity
 @RequiredArgsConstructor
 public class SecurityConfig{
 
+    private final JWTUtil jwtUtil;
+    private final MemberDetailsService memberDetailsService;
+
     @Bean
     public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
         http
-                .cors(AbstractHttpConfigurer::disable)
+                .cors(cors -> cors.configurationSource(request -> new CorsConfiguration().applyPermitDefaultValues()))
                 .csrf(AbstractHttpConfigurer::disable)
                 .httpBasic(AbstractHttpConfigurer::disable)
                 .formLogin(AbstractHttpConfigurer::disable)
 
+                .addFilterBefore(new JWTFilter(jwtUtil, memberDetailsService), UsernamePasswordAuthenticationFilter.class)
+
                 .sessionManagement(session ->
                         session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
 
                 .authorizeHttpRequests(auth -> auth
                         .requestMatchers(
-                                "/","/api/auth/**"
+                                "/","/api/auth/**", "/swagger-ui/**", "/v3/api-docs/**"
                         ).permitAll()
                         .anyRequest()
                         .authenticated());

src/main/java/com/mycom/socket/auth/controller/AuthController.java

@@ -0,0 +1,37 @@
+package com.mycom.socket.auth.controller;
+
+import com.mycom.socket.auth.dto.request.LoginRequestDto;
+import com.mycom.socket.auth.dto.request.RegisterRequestDto;
+import com.mycom.socket.auth.dto.response.LoginResponseDto;
+import com.mycom.socket.auth.service.AuthService;
+import jakarta.servlet.http.HttpServletResponse;
+import jakarta.validation.Valid;
+import lombok.RequiredArgsConstructor;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+@RestController
+@RequestMapping("/api/auth")
+@RequiredArgsConstructor
+public class AuthController {
+
+    private final AuthService authService;
+
+    @PostMapping("/login")
+    public LoginResponseDto login(@Valid @RequestBody LoginRequestDto request,
+                                  HttpServletResponse response) {
+        return authService.login(request, response);
+    }
+
+    @PostMapping("/logout")
+    public void logout(HttpServletResponse response) {
+        authService.logout(response);
+    }
+
+    @PostMapping("/register")
+    public Long register(@Valid @RequestBody RegisterRequestDto request) {
+        return authService.register(request);
+    }
+}

src/main/java/com/mycom/socket/auth/dto/request/LoginRequestDto.java

@@ -0,0 +1,13 @@
+package com.mycom.socket.auth.dto.request;
+
+import jakarta.validation.constraints.Email;
+import jakarta.validation.constraints.NotBlank;
+
+public record LoginRequestDto(
+        @NotBlank(message = "이메일은 필수입니다")
+        @Email(message = "올바른 이메일 형식이 아닙니다")
+        String email,
+
+        @NotBlank(message = "비밀번호는 필수입니다")
+        String password
+) {}

src/main/java/com/mycom/socket/go_socket/dto/request/MemberRegisterDto.java → src/main/java/com/mycom/socket/auth/dto/request/RegisterRequestDto.java

@@ -1,10 +1,10 @@
-package com.mycom.socket.go_socket.dto.request;
+package com.mycom.socket.auth.dto.request;
 
 import jakarta.validation.constraints.Email;
 import jakarta.validation.constraints.NotBlank;
 import jakarta.validation.constraints.Size;
 
-public record MemberRegisterDto(
+public record RegisterRequestDto(
         @NotBlank(message = "이메일은 필수입니다")
         @Email(message = "올바른 이메일 형식이 아닙니다")
         String email,

src/main/java/com/mycom/socket/auth/dto/response/LoginResponseDto.java

@@ -0,0 +1,10 @@
+package com.mycom.socket.auth.dto.response;
+
+public record LoginResponseDto(
+        String email,
+        String nickname
+) {
+    public static LoginResponseDto of(String email, String nickname) {
+        return new LoginResponseDto(email, nickname);
+    }
+}

src/main/java/com/mycom/socket/auth/jwt/JWTFilter.java

@@ -0,0 +1,62 @@
+package com.mycom.socket.auth.jwt;
+
+import com.mycom.socket.auth.service.MemberDetailsService;
+import jakarta.servlet.FilterChain;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.http.Cookie;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import lombok.RequiredArgsConstructor;
+import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
+import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.security.core.userdetails.UserDetails;
+import org.springframework.util.StringUtils;
+import org.springframework.web.filter.OncePerRequestFilter;
+
+import java.io.IOException;
+
+@RequiredArgsConstructor
+public class JWTFilter extends OncePerRequestFilter {
+
+    private final JWTUtil jwtUtil;
+    private final MemberDetailsService memberDetailsService;
+
+    @Override
+    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
+            throws ServletException, IOException {
+
+        String token = resolveTokenFromCookie(request);
+
+        try {
+            if (StringUtils.hasText(token) && jwtUtil.validateToken(token)) {
+                String email = jwtUtil.getEmail(token);
+                UserDetails userDetails = memberDetailsService.loadUserByUsername(email);
+
+                UsernamePasswordAuthenticationToken authentication =
+                        new UsernamePasswordAuthenticationToken(
+                                userDetails,
+                                null,
+                                userDetails.getAuthorities()
+                        );
+
+                SecurityContextHolder.getContext().setAuthentication(authentication);
+            }
+        } catch (Exception e) {
+            SecurityContextHolder.clearContext();
+        }
+
+        filterChain.doFilter(request, response);
+    }
+
+    private String resolveTokenFromCookie(HttpServletRequest request) {
+        Cookie[] cookies = request.getCookies();
+        if (cookies != null) {
+            for (Cookie cookie : cookies) {
+                if ("Authorization".equals(cookie.getName())) {
+                    return cookie.getValue();
+                }
+            }
+        }
+        return null;
+    }
+}

src/main/java/com/mycom/socket/auth/jwt/JWTUtil.java

@@ -0,0 +1,57 @@
+package com.mycom.socket.auth.jwt;
+
+import io.jsonwebtoken.Claims;
+import io.jsonwebtoken.Jwts;
+import io.jsonwebtoken.security.Keys;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.stereotype.Component;
+
+import javax.crypto.SecretKey;
+import java.nio.charset.StandardCharsets;
+import java.util.Date;
+
+@Component
+public class JWTUtil {
+
+    private final SecretKey secretKey;
+
+    public JWTUtil(@Value("${jwt.secret}") String secret) {
+        this.secretKey = Keys.hmacShaKeyFor(secret.getBytes(StandardCharsets.UTF_8));
+    }
+
+    public String createToken(String email) {
+        Claims claims = Jwts.claims().subject(email).build();
+        Date now = new Date();
+        // 30분
+        long accessTokenValidityInMilliseconds = 1000 * 60 * 30;
+        Date validity = new Date(now.getTime() + accessTokenValidityInMilliseconds);
+
+        return Jwts.builder()
+                .claims(claims)
+                .issuedAt(now)
+                .expiration(validity)
+                .signWith(secretKey)
+                .compact();
+    }
+
+    public boolean validateToken(String token) {
+        try {
+            Jwts.parser()
+                    .verifyWith(secretKey)
+                    .build()
+                    .parseSignedClaims(token);
+            return true;
+        } catch (Exception e) {
+            return false;
+        }
+    }
+
+    public String getEmail(String token) {
+        return Jwts.parser()
+                .verifyWith(secretKey)
+                .build()
+                .parseSignedClaims(token)
+                .getPayload()
+                .getSubject();
+    }
+}

src/main/java/com/mycom/socket/auth/security/LoginFilter.java

@@ -0,0 +1,84 @@
+package com.mycom.socket.auth.security;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.mycom.socket.auth.jwt.JWTUtil;
+import com.mycom.socket.global.dto.ApiResponse;
+import com.mycom.socket.auth.dto.request.LoginRequestDto;
+import com.mycom.socket.auth.dto.response.LoginResponseDto;
+import com.mycom.socket.go_socket.entity.Member;
+import jakarta.servlet.FilterChain;
+import jakarta.servlet.http.Cookie;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import lombok.RequiredArgsConstructor;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.MediaType;
+import org.springframework.security.authentication.AuthenticationManager;
+import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.AuthenticationException;
+import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
+
+import java.io.IOException;
+
+@RequiredArgsConstructor
+public class LoginFilter extends UsernamePasswordAuthenticationFilter {
+
+    private final JWTUtil jwtUtil;  // JwtProvider 대신 JWTUtil 사용
+    private final AuthenticationManager authenticationManager;
+    private final ObjectMapper objectMapper;
+
+    @Override
+    public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response)
+            throws AuthenticationException {
+        try {
+            LoginRequestDto loginRequest = objectMapper.readValue(request.getInputStream(), LoginRequestDto.class);
+
+            UsernamePasswordAuthenticationToken authenticationToken =
+                    new UsernamePasswordAuthenticationToken(loginRequest.email(), loginRequest.password());
+
+            return authenticationManager.authenticate(authenticationToken);
+
+        } catch (IOException e) {
+            throw new RuntimeException("로그인 요청 처리 중 오류가 발생했습니다.", e);
+        }
+    }
+
+    @Override
+    protected void successfulAuthentication(HttpServletRequest request, HttpServletResponse response,
+                                            FilterChain chain, Authentication authResult) throws IOException {
+        MemberDetails memberDetails = (MemberDetails) authResult.getPrincipal();
+        Member member = memberDetails.getMember();
+
+        // JWT 토큰 생성
+        String token = jwtUtil.createToken(member.getEmail());
+
+        // HTTP Only 쿠키에 JWT 토큰 저장
+        Cookie cookie = new Cookie("Authorization", token);
+        cookie.setHttpOnly(true);  // JavaScript에서 접근 불가능하게 설정
+        cookie.setSecure(true);    // HTTPS에서만 전송되도록 설정
+        cookie.setPath("/");       // 모든 경로에서 쿠키 접근 가능
+        cookie.setMaxAge(1800);    // 쿠키 만료시간 30분
+        response.addCookie(cookie);
+
+        LoginResponseDto loginResponse = new LoginResponseDto(
+                member.getEmail(),
+                member.getNickname()
+        );
+
+        response.setContentType(MediaType.APPLICATION_JSON_VALUE);
+        response.setCharacterEncoding("UTF-8");
+        objectMapper.writeValue(response.getWriter(), ApiResponse.success("로그인 성공", loginResponse));
+    }
+
+    @Override
+    protected void unsuccessfulAuthentication(HttpServletRequest request, HttpServletResponse response,
+                                              AuthenticationException failed) throws IOException {
+        response.setStatus(HttpStatus.UNAUTHORIZED.value());
+        response.setContentType(MediaType.APPLICATION_JSON_VALUE);
+        response.setCharacterEncoding("UTF-8");
+
+        String errorMessage = "로그인에 실패했습니다. 이메일 또는 비밀번호를 확인해주세요.";
+        objectMapper.writeValue(response.getWriter(), ApiResponse.error(errorMessage));
+    }
+}

src/main/java/com/mycom/socket/auth/security/MemberDetails.java

@@ -0,0 +1,55 @@
+package com.mycom.socket.auth.security;
+
+import com.mycom.socket.go_socket.entity.Member;
+import lombok.Getter;
+import org.springframework.security.core.GrantedAuthority;
+import org.springframework.security.core.authority.SimpleGrantedAuthority;
+import org.springframework.security.core.userdetails.UserDetails;
+
+import java.util.Collection;
+import java.util.Collections;
+
+@Getter
+public class MemberDetails implements UserDetails {
+
+    private final Member member;
+
+    public MemberDetails(Member member) {
+        this.member = member;
+    }
+
+    @Override
+    public Collection<? extends GrantedAuthority> getAuthorities() {
+        return Collections.singletonList(new SimpleGrantedAuthority(member.getRole().name()));
+    }
+
+    @Override
+    public String getPassword() {
+        return member.getPassword();
+    }
+
+    @Override
+    public String getUsername() {
+        return member.getEmail();  // email을 username으로 사용
+    }
+
+    @Override
+    public boolean isAccountNonExpired() {
+        return true;
+    }
+
+    @Override
+    public boolean isAccountNonLocked() {
+        return true;
+    }
+
+    @Override
+    public boolean isCredentialsNonExpired() {
+        return true;
+    }
+
+    @Override
+    public boolean isEnabled() {
+        return true;
+    }
+}