-
Notifications
You must be signed in to change notification settings - Fork 4
/
SecurityConfig.java
113 lines (97 loc) · 4.97 KB
/
SecurityConfig.java
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
package band.gosrock.api.config.security;
import static band.gosrock.common.consts.DuDoongStatic.SwaggerPatterns;
import band.gosrock.common.helper.SpringEnvironmentHelper;
import lombok.RequiredArgsConstructor;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.context.annotation.Bean;
import org.springframework.http.HttpMethod;
import org.springframework.security.access.hierarchicalroles.RoleHierarchyImpl;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.access.expression.DefaultWebSecurityExpressionHandler;
@RequiredArgsConstructor
@EnableWebSecurity
public class SecurityConfig {
private final FilterConfig filterConfig;
@Value("${swagger.user}")
private String swaggerUser;
@Value("${swagger.password}")
private String swaggerPassword;
private final SpringEnvironmentHelper springEnvironmentHelper;
/** 스웨거용 인메모리 유저 설정 */
@Bean
public InMemoryUserDetailsManager userDetailsService() {
UserDetails user =
User.withUsername(swaggerUser)
.password(passwordEncoder().encode(swaggerPassword))
.roles("SWAGGER")
.build();
return new InMemoryUserDetailsManager(user);
}
@Bean
public PasswordEncoder passwordEncoder() {
return new BCryptPasswordEncoder(8);
}
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http.formLogin().disable().cors().and().csrf().disable();
http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
http.authorizeRequests().expressionHandler(expressionHandler());
// 베이직 시큐리티 설정
// 베이직 시큐리티는 ExceptionTranslationFilter 에서 authenticationEntryPoint 에서
// commence 로 401 넘겨줌. -> 응답 헤더에 www-authenticate 로 인증하라는 응답줌.
// 브라우저가 basic auth 실행 시켜줌.
// 개발 환경에서만 스웨거 비밀번호 미설정.
if (springEnvironmentHelper.isProdAndStagingProfile()) {
http.authorizeRequests().mvcMatchers(SwaggerPatterns).authenticated().and().httpBasic();
}
http.authorizeRequests()
.mvcMatchers(SwaggerPatterns)
.permitAll()
.mvcMatchers("/v1/auth/oauth/**")
.permitAll()
.mvcMatchers("/v1/auth/token/refresh")
.permitAll()
.mvcMatchers(HttpMethod.GET, "/v1/events/{eventId:[0-9]*$}")
.permitAll()
.mvcMatchers(HttpMethod.GET, "/v1/events/{eventId:[0-9]*$}/ticketItems")
.permitAll()
.mvcMatchers(HttpMethod.GET, "/v1/events/{eventId:[0-9]*$}/comments/**")
.permitAll()
.mvcMatchers(HttpMethod.GET, "/v1/events/search")
.permitAll()
.mvcMatchers(HttpMethod.GET, "/v1/examples/health")
.permitAll()
.mvcMatchers(HttpMethod.POST, "/v1/coupons/campaigns")
.hasRole("SUPER_ADMIN")
// 인증 이필요한 모든 요청은 USER 권한을 최소한 가지고있어야한다.
// 스웨거용 인메모리 유저의 권한은 SWAGGER 이다
// 따라서 스웨거용 인메모리 유저가 basic auth 필터를 통과해서 들어오더라도
// ( jwt 필터나 , basic auth 필터의 순서는 상관이없다.) --> 왜냐면 jwt는 토큰 여부 파악만하고 있으면 검증이고 없으면 넘김.
// 내부 소스까지 실행을 못함. 권한 문제 때문에.
.anyRequest()
.hasRole("USER");
http.apply(filterConfig);
return http.build();
}
@Bean
public RoleHierarchyImpl roleHierarchy() {
RoleHierarchyImpl roleHierarchy = new RoleHierarchyImpl();
roleHierarchy.setHierarchy("ROLE_SUPER_ADMIN > ROLE_ADMIN > ROLE_MANAGER > ROLE_USER");
return roleHierarchy;
}
@Bean
public DefaultWebSecurityExpressionHandler expressionHandler() {
DefaultWebSecurityExpressionHandler expressionHandler =
new DefaultWebSecurityExpressionHandler();
expressionHandler.setRoleHierarchy(roleHierarchy());
return expressionHandler;
}
}