❓ 문제 상황

: Spring Security Config 파일... 어떻게 만들지?

⭐ (목표) 회원관리 API를 구현 ➡️ 회원가입, 로그인, 로그아웃
JWT를 사용해서 구현
Spring Security 사용을 위해 config파일 생성 강의를 듣고 있었다.
강사님의 SpringBoot 버전은 2.5.6
나의 SpringBoot 버전은 3.2.4... 비극의 시작이었다...😂

SpringBoot 버전에 따라서 설정 파일이 조금씩 달랐다
(SpringBoot 2.5.x 버전과 SpringBoot 2.6.x 버전의 설정도 차이가 있다)

강사님은 WebSecurityConfigurerAdapter라는 인터페이스를 상속받아 오버라이딩한 함수 내부에서 Security 관련 설정 진행하였고, SpringBoot 3.2.4에서는 아예 없는 함수들이었다.

⬇️ Spring Security Config 작성 기존 방식 (SpringBoot 2.5.x~)
extends WebSecurityConfigurerAdapter 상속받아 @Override로 작성

package zerobase.dividends.security;

import lombok.RequiredArgsConstructor;
import lombok.extern.slf4j.Slf4j;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.builders.WebSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;

@Configuration
@Slf4j
@EnableWebSecurity
@EnableMethodSecurity
@RequiredArgsConstructor
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

    private final JwtAuthenticationFilter authenticationFilter;

    @Override
    public void configure(HttpSecurity http) throws Exception {
        http
                .httpBasic().disable()
                .csrf().disable()
                .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                .and()
                    .authorizeRequests()
                .antMatchers("/**/signup", "/**/signin").permiAll()
                .and()
                    .addFilterBefore(this.authenticationFilter, UsernamePasswordAuthenticationFilter.class);
    }

    @Override
    public void configure(final WebSecurity web) throws Exception {
        web.ignoring()
                .antMatchers("/h2-consol/**");
    }

    // spring boot 2.x
    @Bean
    @Override
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }
}

---

❗해결 방법

: 대체 코드를 찾아라!!!

SpringBoot 3 Spring Security 설정하기 폭풍 구글링
WebSecurityConfigurerAdapter ➡️ SecurityFilterChain 으로 변경

첫번째 수정 : 실패... 에러 폭발 🤯

500 Error도 만나고, 중간에 parsig이 이상하다는 에러 메세지도 만나고
진짜 엄 ~ 청 에러 내면서 겨우 변경했다ㅋㅋㅋ

package zerobase.dividends.security;

import lombok.RequiredArgsConstructor;
import lombok.extern.slf4j.Slf4j;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityCustomizer;
import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;

@Configuration
@Slf4j
@EnableWebSecurity
@EnableMethodSecurity
@RequiredArgsConstructor
public class SecurityConfiguration {

    private final JwtAuthenticationFilter jwtAuthenticationFilter;

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
                .csrf(AbstractHttpConfigurer::disable)
                .sessionManagement((sessionManagement) ->
                        sessionManagement.sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                )
                .authorizeHttpRequests((authorizeRequests) ->
                        authorizeRequests
                                .requestMatchers("/**/signup", "/**/signin").permitAll())
                .addFilterBefore(this.jwtAuthenticationFilter, UsernamePasswordAuthenticationFilter.class);

        return http.build();
    }


    @Bean
    public WebSecurityCustomizer webSecurityCustomizer() {
        return (web) -> web.ignoring().requestMatchers("/h2-console/**");
    }

    @Bean
    public AuthenticationManager authenticationManager(AuthenticationConfiguration authenticationConfiguration) throws Exception {
        return authenticationConfiguration.getAuthenticationManager();
    }
}

• 두번째 수정 : 403 Error를 만났다.

코드를 어느정도 이해하고 조금씩 수정
"/**/signup" ➡️ "/*/signup"
랩핑되어있는 것들 다 벗겨주고, 변수명도 간단하게!

package zerobase.dividends.security;

import lombok.RequiredArgsConstructor;
import lombok.extern.slf4j.Slf4j;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityCustomizer;
import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;

@Configuration
@Slf4j
@EnableWebSecurity
@EnableMethodSecurity
@RequiredArgsConstructor
public class SecurityConfiguration {

    private final JwtAuthenticationFilter jwtAuthenticationFilter;

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
                .csrf(AbstractHttpConfigurer::disable)
                .sessionManagement(sessionManagement ->
                        sessionManagement.sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                )
                .authorizeHttpRequests(auth -> auth
                                .requestMatchers("/*/signup", "/*/signin").permitAll())
                .addFilterBefore(this.jwtAuthenticationFilter, UsernamePasswordAuthenticationFilter.class);

        return http.build();
    }


    @Bean
    public WebSecurityCustomizer webSecurityCustomizer() {
        return web -> web.ignoring().requestMatchers("/h2-console/**");
    }

    @Bean
    public AuthenticationManager authenticationManager(AuthenticationConfiguration authenticationConfiguration) throws Exception {
        return authenticationConfiguration.getAuthenticationManager();
    }
}

• 마지막 수정 : 성공

이거 한줄이 빠져있었다... 이게 없어서 403 Error
403에러는 진짜 극악인게 로그도 에러코드도 안나와서 4시간은 삽질했다..
원인 찾는다고 로그로 기록 다 남기고, 루트 로그 레벨도 debug 로 변경!
logging.level.root=debug

코드 변경하면서 빠졌나보다🫠

.anyRequest().authenticated 프로젝트 끝나면 한 줄 한 줄 뜯어주마

package zerobase.dividends.security;

import lombok.RequiredArgsConstructor;
import lombok.extern.slf4j.Slf4j;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityCustomizer;
import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;

@Configuration
@Slf4j
@EnableWebSecurity
@EnableMethodSecurity
@RequiredArgsConstructor
public class SecurityConfiguration {

    private final JwtAuthenticationFilter jwtAuthenticationFilter;

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
                .csrf(AbstractHttpConfigurer::disable)
                .sessionManagement(sessionManagement ->
                        sessionManagement.sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                )
                .authorizeHttpRequests(auth -> auth
                                .requestMatchers("/*/signup", "/*/signin").permitAll()
                                .anyRequest().authenticated())
                .addFilterBefore(this.jwtAuthenticationFilter, UsernamePasswordAuthenticationFilter.class);

        return http.build();
    }


    @Bean
    public WebSecurityCustomizer webSecurityCustomizer() {
        return web -> web.ignoring().requestMatchers("/h2-console/**");
    }

    @Bean
    public AuthenticationManager authenticationManager(AuthenticationConfiguration authenticationConfiguration) throws Exception {
        return authenticationConfiguration.getAuthenticationManager();
    }
}

---

💡 마무리

중간에 포기하고 싶었는데, 오기가 생겨서 밤새 코드랑 싸웠다🫠
처음 에러가 시작되고 거의 12시간만에 해결했다....
에러 하나를 해결하면 다음 에러가 나오고,
200보고 박수치고 좋아하다 다시 만난 505...403...

1. 에러코드가 다양하다는 걸 깨달았다.
2. 버전의 호환성?이 중요하다는 것도 알게 됬다.
3. 프로젝트가 끝나면 JWT(Json Web Token) 공부하기

---

⬇️ 공식 사이트

https://spring.io/blog/2022/02/21/spring-security-without-the-websecurityconfigureradapter

⬇️ 도움받은 블로그
https://velog.io/@hwsa1004/SpringBoot-3.1.0-SpringSecurity-%EC%84%A4%EC%A0%95%ED%95%98%EA%B8%B0

https://covenant.tistory.com/277

https://ttmcr.tistory.com/entry/Spring-Security-WebSecurityConfiguration-%EC%B4%9D%EC%A0%95%EB%A6%AC?category=1367905

https://www.inflearn.com/questions/1078794/spring-boot-%EC%B5%9C%EC%8B%A0-%EB%B2%84%EC%A0%84-3-1-5-%EC%97%90-%EB%8C%80%ED%95%98%EC%97%AC