Spring Boot : SecurityConfig.java 정리

Spring Boot 2.7 ~ 3.1 동작 확인

Basic 인증 사용 + h2 web console = true 설정한 경우

@Configuration
public class SecurityConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http,
                                                   HandlerMappingIntrospector introspector) throws Exception {
        MvcRequestMatcher.Builder mvcMatcher = new MvcRequestMatcher.Builder(introspector);
        return http
                .authorizeHttpRequests(config -> config
                        .requestMatchers(
                                PathRequest.toH2Console()
                        ).permitAll()
                        
                        .requestMatchers(
                                mvcMatcher.pattern("/users/**"),
                                mvcMatcher.pattern("/admin/users/**")
                        ).permitAll()
                        
                        .anyRequest().authenticated()
                )
                .httpBasic(withDefaults())
                .csrf(AbstractHttpConfigurer::disable)
                .headers(AbstractHttpConfigurer::disable)
                .build();
    }

    @Bean
    public UserDetailsService userDetailsService() {
        UserDetails user = User.builder()
                .username("zhyun")
                .password("{noop}qweasd")
                .roles("USER")
                .build();

        UserDetails admin = User.builder()
                .username("gimwlgus")
                .password("{noop}zxcasd")
                .roles("ADMIN")
                .build();

        return new InMemoryUserDetailsManager(user, admin);
    }
}

Basic 인증 사용 + h2 web console = false 설정한 경우

@Configuration
public class SecurityConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        return http
                .authorizeHttpRequests(config -> config
                        .requestMatchers(
                                "/users/**",
                                "/admin/users/**"
                        ).permitAll()

                        .anyRequest().authenticated()
                )
                .httpBasic(withDefaults())
                .csrf(AbstractHttpConfigurer::disable)
                .headers(AbstractHttpConfigurer::disable)
                .build();
    }

    @Bean
    public UserDetailsService userDetailsService() {
        UserDetails user = User.builder()
                .username("zhyun")
                .password("{noop}qweasd")
                .roles("USER")
                .build();

        UserDetails admin = User.builder()
                .username("gimwlgus")
                .password("{noop}zxcasd")
                .roles("ADMIN")
                .build();

        return new InMemoryUserDetailsManager(user, admin);
    }
}

Form Login 사용 + 정적 리소스 모두 허용

@Slf4j
@RequiredArgsConstructor
@EnableWebSecurity
@Configuration
public class SecurityConfiguration {

    private final AccountService accountService;
    private final UserAuthenticationSuccess userAuthenticationSuccess;

    @Value("${server.servlet.context-path}")
    private static String CONTEXT_PATH_PROPERTY;

    public static final String CONTEXT_PATH = Objects.isNull(CONTEXT_PATH_PROPERTY) ? "/mission" : CONTEXT_PATH_PROPERTY;

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity httpSecurity) throws Exception {
        return httpSecurity
                .authorizeHttpRequests(
                        auth -> auth
                                .requestMatchers(PathRequest.toStaticResources().atCommonLocations()).permitAll()
                                .requestMatchers(
                                        "/login/**",
                                        "/join/**",
                                        "/kiosk/**",
                                        "/error/**"
                                ).permitAll()
                                .requestMatchers("/", "/seller/**").hasRole("SELLER")
                                .requestMatchers("/", "/store/**", "/review/**").hasRole("CUSTOMER")
                                .anyRequest().authenticated()
                )
                .csrf(AbstractHttpConfigurer::disable) 
                .headers(AbstractHttpConfigurer::disable)
                .formLogin(
                        login -> login
                                .loginPage("/login").permitAll()
                                .successHandler(userAuthenticationSuccess)
                )
                .addFilterBefore(new SecurityExceptionHandlerFilter(), UsernamePasswordAuthenticationFilter.class)
                .addFilterBefore(new SecurityLoginFilter(accountService , passwordEncoder()), UsernamePasswordAuthenticationFilter.class)
                .logout(
                        logout -> logout
                                .logoutSuccessUrl("/")
                                .invalidateHttpSession(true)
                )
                .build();
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

}

나를 위한 로그

정말 열심히 공부할 때 만들어뒀던 코드였는데
기억이 안나서 파일을 잃어버린 줄 알고 깜짝 놀랐다;
이걸 블로그에 기록을 안해놨다니..ㄷㄷ
이제라도 기록 ✏️

security config