-
Notifications
You must be signed in to change notification settings - Fork 3
Expand file tree
/
Copy pathSecurityConfiguration.java
More file actions
81 lines (68 loc) ยท 3.77 KB
/
SecurityConfiguration.java
File metadata and controls
81 lines (68 loc) ยท 3.77 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
package com.kt.config;
import com.fasterxml.jackson.databind.ObjectMapper;
import com.kt.common.ratelimit.filter.GlobalRateLimitFilter;
import com.kt.security.JwtAuthenticationFilter;
import com.kt.security.JwtTokenProvider;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.HttpMethod;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.SecurityFilterChain;
import lombok.RequiredArgsConstructor;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
@Configuration
@EnableWebSecurity
@EnableMethodSecurity
@RequiredArgsConstructor
public class SecurityConfiguration {
private static final String[] GET_PERMIT_ALL = {"/api/health/**", "/swagger-ui.html","/swagger-ui/**", "/v3/api-docs/**", "/actuator/**", "/payment-*.html", "/api/payments/client-key", "/*.css"};
private static final String[] POST_PERMIT_ALL = {"/api/users/auth/signup", "/api/users/auth/login","/api/admin/users/auth/signup", "/api/admin/users/auth/login","/api/users/reissue", "/api/payments/confirm"};
private static final String[] PUT_PERMIT_ALL = {"/api/v1/public/**"};
private static final String[] PATCH_PERMIT_ALL = {"/api/v1/public/**"};
private static final String[] DELETE_PERMIT_ALL = {"/api/v1/public/**"};
private final JwtTokenProvider jwtTokenProvider;
private final ObjectMapper objectMapper;
private final GlobalRateLimitFilter globalRateLimitFilter;
@Bean
public PasswordEncoder passwordEncoder() {
return new BCryptPasswordEncoder();
}
@Bean
public AuthenticationManager authenticationManager(AuthenticationConfiguration configuration) throws Exception {
return configuration.getAuthenticationManager();
}
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
// ๊ธฐ๋ฅ ๊ฐ๋ฐ ๋ฐ ํ
์คํธ๋ฅผ ์ํด ์ฃผ์์ฒ๋ฆฌ (์ฃผ์ํด์ )
// jwt๋ฅผ ์ฌ์ฉํด์ ์ธ์ฆ์ ์งํํ๊ธฐ๋๋ฌธ์ csrf protection์ ์ ์ฉํ ํ์์๊ธฐ๋๋ฌธ์ csrf๋ฅผ disable
http.sessionManagement(
session ->
session.sessionCreationPolicy(SessionCreationPolicy.STATELESS)
)
.authorizeHttpRequests(
request -> {
request.requestMatchers(HttpMethod.GET, GET_PERMIT_ALL).permitAll();
request.requestMatchers(HttpMethod.POST, POST_PERMIT_ALL).permitAll();
request.requestMatchers(HttpMethod.PATCH, PATCH_PERMIT_ALL).permitAll();
request.requestMatchers(HttpMethod.PUT, PUT_PERMIT_ALL).permitAll();
request.requestMatchers(HttpMethod.DELETE, DELETE_PERMIT_ALL).permitAll();
request.anyRequest().authenticated();
}
)
.formLogin(form -> form.disable())
.httpBasic(basic -> basic.disable())
.logout(logout -> logout.disable())
.csrf(AbstractHttpConfigurer::disable);
http.addFilterBefore(globalRateLimitFilter, UsernamePasswordAuthenticationFilter.class);
http.addFilterBefore(new JwtAuthenticationFilter(jwtTokenProvider,objectMapper), UsernamePasswordAuthenticationFilter.class);
return http.build();
}
}