JWT 토큰

REST API 서비스와 Stateless 아키텍처

REST API

• API 서비스 개발을 위한 가장 일반적인 접근 방법이며 (사실상) 표준
• 엄격하게 REST API 디자인 원칙을 따르는 것는 쉽지 않음
• 어쨋든 통상적으로 REST API 라고 부르고 있음 — 본 과정에서는 사회통념을 따르도록 함

• Java, Python, Go 등 다양한 언어로 풍부한 레퍼런스가 존재 — 구현이 쉬움

• HTTP 프로토콜 기반만 따르면 어떤 기술이든 응용 가능(XML, JSON)

• 앞에서 알아본 3-Tier Architecture 구조와 REST API 서비스를 궁합이 좋음
• 3-Tier Architecture의 장점 대부분은 REST API 서비스를 개발/운영할때 여전히 유효함

• REST API 서비스에서 Session을 꼭 써야 하는가에 대해서는 서비스 성격에 따라 고민이 필요함

JWT (Json Web Token)

JWT 작동원리 (Token-based Authentication 의 작동원리임)

• 서버에서 사용자가 성공적으로 인증되면 JWT를 반환함

• 클라이언트는 JWT를 로컬 영역에 저장하고(local storage 혹은 쿠키에 저장될 수도 있음) 이후 서버에 요청을 보낼 때 JWT를 HTTP 헤더에 포함시킴

• 서버는 클라이언트가 전달한 JWT를 통해 사용자를 식별할 수 있음

REST API with JWT 제대로 해보기

@ConfigurationProperties(prefix="jwt")
@Configuration
@Setter
@Getter
public class JwtConfigure {

    private String secretKey;

    private Long expirySeconds;

    private String issuer;

}

// ----------------
jwt:
  issuer: todo-spring
  secret-key: secretsecret
  expiry-seconds: 3600

@Getter
@RequiredArgsConstructor
public class JwtPrincipal {

  private final String token;

  private final Long userId;
}

@Override
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
    String token = getToken((HttpServletRequest) request);
    if(token == null || SecurityContextHolder.getContext().getAuthentication() != null){
        chain.doFilter(request, response);
        return;
    }
    HttpServletRequest req = (HttpServletRequest) request;

    try{
        Jwt.Claims claims = jwt.verify(token);

        String username = claims.getUsername();
        List<GrantedAuthority> authorities = getAuthorities(claims);

        if (StringUtils.hasText(username) && authorities != null && !authorities.isEmpty()){
            JwtAuthenticationToken authentication = new JwtAuthenticationToken(
                    new JwtPrincipal(username, token),
                    null,
                    authorities);
            authentication.setDetails(new WebAuthenticationDetailsSource().buildDetails(req));
            SecurityContextHolder.getContext().setAuthentication(authentication);
        }

        chain.doFilter(request, response);
    }
    catch (JWTVerificationException e){
        log.warn("Jwt processing failed : {}", e.getMessage());
    }
}

@Override
public boolean supports(Class<?> authentication) {
  return JwtAuthenticationToken.class.isAssignableFrom(authentication);
}

@Override
public Authentication authenticate(Authentication authentication) throws AuthenticationException {
  JwtAuthenticationToken jwtAuthentication = (JwtAuthenticationToken) authentication;
  return processUserAuthentication(
    String.valueOf(jwtAuthentication.getPrincipal()),
    jwtAuthentication.getCredentials()
  );
}

private Authentication processUserAuthentication(String principal, String credentials) {
  try {
    User user = userService.login(principal, credentials);
    List<GrantedAuthority> authorities = user.getGroup().getAuthorities();
    String token = getToken(user.getLoginId(), authorities);
    JwtAuthenticationToken authenticated =
      new JwtAuthenticationToken(
				new JwtPrincipal(token, user.getLoginId()),
				null,
				authorities);
    authenticated.setDetails(user);
    return authenticated;
  } catch (IllegalArgumentException e) {
    throw new BadCredentialsException(e.getMessage());
  } catch (DataAccessException e) {
    throw new AuthenticationServiceException(e.getMessage(), e);
  }
}

@Bean
public JwtAuthenticationProvider jwtAuthenticationProvider(
													Jwt jwt,
													UserService userService
) {
  return new JwtAuthenticationProvider(jwt, userService);
}

@Autowired
public void configureAuthentication(
					AuthenticationManagerBuilder builder,
					JwtAuthenticationProvider authenticationProvider
) {
  builder.authenticationProvider(authenticationProvider);
}

@Bean
@Override
public AuthenticationManager authenticationManagerBean() throws Exception {
  return super.authenticationManagerBean();
}

• redis나 hazelcast와 같은 메모리 베이스드 캐쉬 방식을 사용해서 토큰을 관리함

• db에 저장하면 확인할 때마다 db 요청이 들어가야 하기 때문에 부담이 될 수 있음

JWT 토큰 생성과 검증

implementation("com.auth0:java-jwt:3.16.0")
implementation("io.jsonwebtoken:jjwt:0.9.1")

public class JWTSimpleTest {

    private void printToken(String token){
        String[] tokens = token.split("\\.");
        System.out.println("header : " + new String(Base64.getDecoder().decode(tokens[0])));
        System.out.println("body : " + new String(Base64.getDecoder().decode(tokens[1])));
    }

    @DisplayName("1. jjwt 를 이용한 토큰 테스트")
    @Test
    void test_1(){
        String okta_token = Jwts.builder().addClaims(
                Map.of("name", "jongwon", "price", 3000)
        ).signWith(SignatureAlgorithm.HS256, "jongwon").compact();
        System.out.println(okta_token);
        printToken(okta_token);
    }


    @DisplayName("2. java-jwt 를 이용한 토큰 테스트")
    @Test
    void test_2() {
        String oauth0_token = JWT.create().withClaim("name", "jongwon")
                .withClaim("price", 3000)
                .sign(Algorithm.HMAC256("jongwon"));
        System.out.println(oauth0_token);
        printToken(oauth0_token);
    }

}

• 이렇게 두개의 jwt 이용할 수 있는 라이브러리가 존재하는데, 이 둘은 시크릿 키를 관리하는 방법에 있어서 차이가 있음. 그래서 그 부분을 동일하게 해주어야 서로 간의 호환이 됨

• json 웹 토큰은 클라이언트가 어디든 간에 알고리즘과 키 값이 서로 일치한다면 누구든 검증가능한 토큰

@DisplayName("2. java-jwt 를 이용한 토큰 테스트")
@Test
void test_2() {

    byte[] SEC_KEY = DatatypeConverter.parseBase64Binary("jongwon");

    String oauth0_token = JWT.create().withClaim("name", "jongwon")
            .withClaim("price", 3000)
            .sign(Algorithm.HMAC256(SEC_KEY));
    System.out.println(oauth0_token);
    printToken(oauth0_token);

    DecodedJWT verified = JWT.require(Algorithm.HMAC256(SEC_KEY)).build().verify(oauth0_token);
    System.out.println(verified.getClaims());

    Jws<Claims> tokenInfo = Jwts.parser().setSigningKey(SEC_KEY).parseClaimsJws(oauth0_token);
    System.out.println(tokenInfo);
}

@Test
@DisplayName("3. 만료 시간 테스트")
void test_3() throws InterruptedException {
    val AL = Algorithm.HMAC256("jongwon");
    String token = JWT.create().withSubject("a1234")
            .withNotBefore(new Date(System.currentTimeMillis() + 1000))
            .withExpiresAt(new Date(System.currentTimeMillis() + 3000))
            .sign(Algorithm.HMAC256("jongwon"));

//        Thread.sleep(2000);
    try{
        DecodedJWT verify = JWT.require(AL).build().verify(token);
        System.out.println(verify.getClaims());
    }catch (Exception ex){
        System.out.println("유효하지 않은 토큰입니다..");
        DecodedJWT decode = JWT.decode(token);
        System.out.println(decode.getClaims());
    }
}

jwt를 이용한 필터구성 (UsernamePasswordFilter, BasicAuthenticationFilter 구현하여)

package com.sp.fc.web.config;

import com.sp.fc.user.domain.SpUser;
import com.sp.fc.user.service.SpUserService;
import org.springframework.http.HttpHeaders;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.web.authentication.www.BasicAuthenticationFilter;

import javax.security.sasl.AuthenticationException;
import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;

public class JWTCheckFilter extends BasicAuthenticationFilter {

    private SpUserService userService;

    public JWTCheckFilter(AuthenticationManager authenticationManager, SpUserService userService) {
        super(authenticationManager);
        this.userService = userService;
    }

    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws IOException, ServletException {
        String bearer = request.getHeader(HttpHeaders.AUTHORIZATION);
        if(bearer == null || !bearer.startsWith("Bearer ")){
            chain.doFilter(request, response);
            return;
        }
        String token = bearer.substring("Bearer ".length());
        VerifyResult result = JWTUtil.verify(token);
        if(result.isSuccess()){
            SpUser user = (SpUser) userService.loadUserByUsername(result.getUsername());
            UsernamePasswordAuthenticationToken userToken = new UsernamePasswordAuthenticationToken(
                    user.getUsername(), null, user.getAuthorities()
            );
            SecurityContextHolder.getContext().setAuthentication(userToken);
            chain.doFilter(request, response);
        }else{
            throw new AuthenticationException("Token is not valid");
        }
    }

}

package com.sp.fc.web.config;

import com.fasterxml.jackson.databind.ObjectMapper;
import com.sp.fc.user.domain.SpUser;
import lombok.SneakyThrows;
import org.springframework.http.HttpHeaders;
import org.springframework.http.MediaType;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;

import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;

public class JWTLoginFilter extends UsernamePasswordAuthenticationFilter {

    private ObjectMapper objectMapper = new ObjectMapper();

    public JWTLoginFilter(AuthenticationManager authenticationManager) {
        super(authenticationManager);
        setFilterProcessesUrl("/login");
    }

    @SneakyThrows
    @Override
    public Authentication attemptAuthentication(
            HttpServletRequest request,
            HttpServletResponse response) throws AuthenticationException
    {
        UserLoginForm userLogin = objectMapper.readValue(request.getInputStream(), UserLoginForm.class);
        UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken(
                userLogin.getUsername(), userLogin.getPassword(), null
        );
        // user details...
        return getAuthenticationManager().authenticate(token);
    }

    @Override
    protected void successfulAuthentication(
            HttpServletRequest request,
            HttpServletResponse response,
            FilterChain chain,
            Authentication authResult) throws IOException, ServletException
    {
        SpUser user = (SpUser) authResult.getPrincipal();
        response.setHeader("auth_token", JWTUtil.makeAuthToken(user));
        response.setHeader("refresh_token", JWTUtil.makeRefreshToken(user));
        response.setHeader(HttpHeaders.CONTENT_TYPE, MediaType.APPLICATION_JSON_VALUE);
        response.getOutputStream().write(objectMapper.writeValueAsBytes(user));
    }
}

package com.sp.fc.web.config;

import com.sp.fc.user.service.SpUserService;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.crypto.password.NoOpPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
import org.springframework.security.web.authentication.www.BasicAuthenticationFilter;

@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class AdvancedSecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private SpUserService userService;

    @Bean
    PasswordEncoder passwordEncoder(){
        return NoOpPasswordEncoder.getInstance();
    }


    @Override
    protected void configure(HttpSecurity http) throws Exception {
        JWTLoginFilter loginFilter = new JWTLoginFilter(authenticationManager());
        JWTCheckFilter checkFilter = new JWTCheckFilter(authenticationManager(), userService);
        http
                .csrf().disable()
                .sessionManagement(session->
                        session.sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                )
                .addFilterAt(loginFilter, UsernamePasswordAuthenticationFilter.class)
                .addFilterAt(checkFilter, BasicAuthenticationFilter.class)
                ;

    }
}