09. Spring Security with JWT Part. 2

• 필터 위치 — SecurityContextPersistenceFilter 필터 바로 뒤
• SecurityContextPersistenceFilter 필터 앞에 위치하게 되면 SecurityContextPersistenceFilter 필터가 SecurityContext를 덮어 써버림

@Bean
public Jwt jwt() {
  return new Jwt(
    jwtConfigure.getIssuer(),
    jwtConfigure.getClientSecret(),
    jwtConfigure.getExpirySeconds()
  );
}

public JwtAuthenticationFilter jwtAuthenticationFilter() {
  Jwt jwt = getApplicationContext().getBean(Jwt.class);
  return new JwtAuthenticationFilter(jwtConfigure.getHeader(), jwt);
}

@Override
protected void configure(HttpSecurity http) throws Exception {
  http
    /**
     * Jwt 필터 추가
     */
    .addFilterAfter(jwtAuthenticationFilter(), SecurityContextPersistenceFilter.class)
  ;
}

• 필터 구현
• 이미 인증된 사용자 인지 확인해야 함 — 이미 인증된 사용자라면 아무처리 하지 않음
• getToken 메소드 — JWT 토큰을 HTTP 헤더에서 가져옴
• verify 메소드 — JWT 토큰을 검증하고 디코딩함
• UsernamePasswordAuthenticationToken의 principal 필드에는 loginId를 입력
• 마지막에 SecurityContextHolder.getContext().setAuthentication 메소드를 호출해 UsernamePasswordAuthenticationToken 객체 참조를 전달함

@Override
public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
  throws IOException, ServletException {
  HttpServletRequest request = (HttpServletRequest) req;
  HttpServletResponse response = (HttpServletResponse) res;

  if (SecurityContextHolder.getContext().getAuthentication() == null) {
    String token = getToken(request);
    if (token != null) {
      try {
        Jwt.Claims claims = verify(token);
        log.debug("Jwt parse result: {}", claims);

        String username = claims.username;
        List<GrantedAuthority> authorities = getAuthorities(claims);

        if (isNotEmpty(username) && authorities.size() > 0) {
          UsernamePasswordAuthenticationToken authentication =
            new UsernamePasswordAuthenticationToken(username, null, authorities);
          authentication.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
          SecurityContextHolder.getContext().setAuthentication(authentication);
        }
      } catch (Exception e) {
        log.warn("Jwt processing failed: {}", e.getMessage());
      }
    }
  } else {
    log.debug("SecurityContextHolder not populated with security token, as it already contained: '{}'",
      SecurityContextHolder.getContext().getAuthentication());
  }

  chain.doFilter(request, response);
}