Portfolio


security:
  jwt:
    header: authorization
    issuer: monthsub
    client-secret: ${JWT_CLIENT_SECRET}
    expiry-seconds: 86400


@Component
@Getter
@Setter
@ConfigurationProperties(prefix = "security")
public class Security {

  private Jwt jwt;

  @Getter
  @Setter
  public static class Jwt {
    private String header;
    private String issuer;
    private String clientSecret;
    private int expirySeconds;
  }
}


public String sign(Claims claims) {
    Date now = new Date();
    JWTCreator.Builder builder = create();

    builder.withIssuer(issuer);
    builder.withIssuedAt(now);

    if (expirySeconds > 0) {
      builder.withExpiresAt(new Date(now.getTime() + expirySeconds * 1_000L));
    }

    builder.withClaim("username", claims.username);
    builder.withArrayClaim("roles", claims.roles);

    return builder.sign(algorithm);
  }

  public Claims verify(String token) throws JWTVerificationException {
    return new Claims(jwtVerifier.verify(token));
  }


public class JwtAuthentication {

  public final String token;
  public final Long userId;
  public final String username;

  JwtAuthentication(
    String token,
    Long userId,
    String username
  ) {
    this.token = token;
    this.userId = userId;
    this.username = username;
  }
}


public class JwtAuthenticationToken extends AbstractAuthenticationToken {

  private final Object principal;

  private String credentials;

  public JwtAuthenticationToken(String principal, String credentials) {
    super(null);
    super.setAuthenticated(false);

    this.principal = principal;
    this.credentials = credentials;
  }

  JwtAuthenticationToken(Object principal, String credentials, Collection<? extends GrantedAuthority> authorities) {
    super(authorities);
    super.setAuthenticated(true);

    this.principal = principal;
    this.credentials = credentials;
  }

	// ... 생략 

}


@Override
  public Authentication authenticate(Authentication authentication) throws AuthenticationException {
    JwtAuthenticationToken jwtAuthentication = (JwtAuthenticationToken) authentication;

    return processUserAuthentication(
      String.valueOf(jwtAuthentication.getPrincipal()),
      jwtAuthentication.getCredentials()
    );
  }

  private Authentication processUserAuthentication(
    String principal,
    String credentials
  ) {
    try {
      User user = userService.login(principal, credentials);
      List<GrantedAuthority> authorities = user.getPart().getAuthorities();
      String token = getToken(user.getUsername(), authorities); // 토큰을 만든다

      JwtAuthentication jwtAuthenticationToken = new JwtAuthentication(
        token, user.getId(), user.getUsername()
      );

      JwtAuthenticationToken authenticated = new JwtAuthenticationToken(
        jwtAuthenticationToken, null, authorities
      );

      authenticated.setDetails(user);

      return authenticated;
    } catch (IllegalArgumentException e) {
      throw new BadCredentialsException(e.getMessage());
    }
  }


private void authenticate(
    HttpServletRequest request,
    String token
  ) {
    Jwt.Claims claims = verify(token);
    log.debug("Jwt parse result: {}", claims);

    String username = claims.username;
    List<GrantedAuthority> authorities = getAuthorities(claims);

    if (isEmpty(username) || authorities.size() <= 0) {
      return;
    }

    User user = this.authenticationService.findByUserName(username);
    JwtAuthenticationToken jwtToken = new JwtAuthenticationToken(
      new JwtAuthentication(token, user.getId(), username),
      null,
      authorities
    );

    log.info("userId: {}", user.getId());

    jwtToken.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
    SecurityContextHolder.getContext().setAuthentication(jwtToken);
  }

  private String getToken(HttpServletRequest request) {
    String token = request.getHeader(headerKey);
    String decodedToken = null;

    if (isEmpty(token)) {
      return null;
    }

    log.debug("Jwt token detected: {}", token);

    if (!token.startsWith(this.BEARER)) {
      throw new UnAuthorize();
    }

    try {
      decodedToken = URLDecoder.decode(token.replace(BEARER + " ", ""), "UTF-8");
    } catch (Exception e) {
      log.error(e.getMessage(), e);
    }

    return decodedToken;
  }

  private Jwt.Claims verify(String token) {
    return jwt.verify(token);
  }

JWT

JWT (Json Web Token)

Bearer