Jwt 인증 로직을 어디에 넣고 로직을 어떻게 짜야 할지에 대한 문제

문제

1. 인증이 필요한 API와 필요없는 API가 있다.

2. 인증이 필요없는 API는 따로 오류가 발생하지 않는다.

3. 인증이 필요한 API는 jwt token이 헤더에 담겨있지 않거나 토큰 만료시간이 완료된 경우 에러가 발생한다.

해결 전략

1. jwt token이 헤더에 담겨있지 않은 경우

1. refresh token을 jwt token과 동일하게 헤더에 담아 가지고 다니는 방식

2. refresh token을 쿠키에 담아 가지고 다니는 방식

3. refresh token을 서버에 저장하는 방식

구현

public class JwtAuthenticationFilter extends GenericFilterBean {

	private final Logger log = LoggerFactory.getLogger(getClass());

	private final String headerKey;

	private final Jwt jwt;

	public JwtAuthenticationFilter(String headerKey, Jwt jwt) {
		this.headerKey = headerKey;
		this.jwt = jwt;
	}

	@Override
	public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
		throws IOException, ServletException {
		HttpServletRequest request = (HttpServletRequest)req;
		HttpServletResponse response = (HttpServletResponse)res;

		if (SecurityContextHolder.getContext().getAuthentication() == null) {
			String token = getToken(request);
			if (token != null) {
				try {
					Jwt.Claims claims = verify(token);
					log.debug("Jwt parse result: {}", claims);
					Long userId = claims.userId;
					GrantedAuthority authority = getAuthorities(claims);

					if (isNotEmpty(userId) && authority != null) {
						JwtAuthenticationToken authentication =
							new JwtAuthenticationToken(new JwtAuthentication(token, userId), null, List.of(authority));
						authentication.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
						SecurityContextHolder.getContext().setAuthentication(authentication);
					}
					DecodedJWT decode = JWT.decode(token);
					if (decode.getExpiresAt().before(new Date()) && !"/api/v1/user/me".equals(request.getRequestURI())) {
						throw new JWTVerificationException("jwt 만료시간 초과");
					}
				} catch (Exception e) {
					log.warn("Jwt processing failed: {}", e.getMessage());
					request.setAttribute("exception",e);
					response.setHeader("error", e.getMessage());
					response.setStatus(UNAUTHORIZED.value());
					Map<String, String> error = new HashMap<>();
					error.put("error_message", e.getMessage());
					response.setContentType(MediaType.APPLICATION_JSON_VALUE);
					new ObjectMapper().writeValue(response.getOutputStream(), error);
				}
			}
		} else {
			log.debug("SecurityContextHolder not populated with security token, as it already contained: '{}'",
				SecurityContextHolder.getContext().getAuthentication());
		}

		chain.doFilter(request, response);
	}

	private String getToken(HttpServletRequest request) {
		String token = request.getHeader(headerKey);
		if (isNotEmpty(token)) {
			log.debug("Jwt authorization api detected: {}", token);
			return URLDecoder.decode(token.split(" ")[1], StandardCharsets.UTF_8);
		}
		return null;
	}

	private Jwt.Claims verify(String token) {
		return jwt.verify(token);
	}

	private GrantedAuthority getAuthorities(Jwt.Claims claims) {
		String role = claims.role;
		return role == null ?
			null : new SimpleGrantedAuthority(role);
	}

}

@Service
@RequiredArgsConstructor
@Slf4j
public class UserAuthenticationServiceImpl implements UserAuthenticationService {
	private final UserRepository userRepository;
	private final BicycleRepository bicycleRepository;
	private final AddressCodeRepository addressCodeRepository;
	private final JwtTokenProvider jwtTokenProvider;
	private final OAuthManager communicator;
	private final JwtRefreshTokenRepository jwtRefreshTokenRepository;

	@Value("${jwt 주소}")
	private long refreshTokenExpiryTime;

	private static final int MILLISECOND_CORRECTION = 1000; //시간보정

	@Override
	@Transactional
	public UserMeResult checkUserById(Long id, String token) {
		checkArgument(isNotEmpty(id), "id must be provided.");
		User user = userRepository.findById(id)
			.orElseThrow(() -> new IllegalArgumentException("Could not found user for userId"));
		DecodedJWT decode = JWT.decode(token);
		String newToken = token;
		if (decode.getExpiresAt().before(new Date())) {
			JwtRefreshToken jwtRefreshToken = jwtRefreshTokenRepository.findByUserId(id)
				.orElseThrow(() -> new NoSuchElementException("해당하는 리프레시 토큰 없음"));
			if (jwtRefreshToken.getExp().before(new Date())) {
				log.info("jwt 만료시간 {}", jwtRefreshToken.getExp());
				jwtRefreshTokenRepository.delete(jwtRefreshToken);
				throw new JWTVerificationException("jwt 만료시간 초과");
			}
			newToken = "Bearer " + jwtTokenProvider.createToken("ROLE_USER", id);
		}
		return UserMeResult.of(user.getNickname(), user.getId(), user.isRegistered(), newToken);
	}

	@Override
	@Transactional
	public OAuthLoginResult joinOAuth(String authorizationCode) throws IOException, InterruptedException {
		checkArgument(authorizationCode != null, "authorizationCode must be provided");
		checkArgument(!authorizationCode.equals(""), "authorizationCode must be provided");
		Map<String, String> oauthInformation = communicator.convertAuthorizationCodeToInfo(authorizationCode);

		String provider = "kakao";
		String providerId = oauthInformation.get("id");

		return userRepository.findByProviderAndProviderId(provider, providerId)
			.map(user -> {
				log.warn("Already exists: {} for (provider: {}, providerId: {})", user, provider, providerId);
				String token = generateToken(user);
				Date now = new Date();
				if (jwtRefreshTokenRepository.findByUserId(user.getId()).isEmpty()) {
					jwtRefreshTokenRepository.save(new JwtRefreshToken(user.getId(), new Date(),
						new Date(now.getTime() + refreshTokenExpiryTime * MILLISECOND_CORRECTION)));
				}
				JwtRefreshToken jwtRefreshToken = jwtRefreshTokenRepository.findByUserId(user.getId())
					.orElseThrow(() -> new NoSuchElementException("토큰을 찾을 수 없습니다."));
				if (jwtRefreshToken.getExp().before(new Date())) {
					jwtRefreshTokenRepository.delete(jwtRefreshToken);
					jwtRefreshTokenRepository.save(new JwtRefreshToken(user.getId(), new Date(),
						new Date(now.getTime() + refreshTokenExpiryTime * MILLISECOND_CORRECTION)));
				}
				return OAuthLoginResult.of(token, false);
			})
			.orElseGet(() -> {
				String nickname = oauthInformation.get("nickname");
				String profileImage = oauthInformation.get("profile_image");
				User user = userRepository.save(User.builder()
					.nickname(new Nickname(nickname))
					.profileImages(profileImage)
					.providerId(providerId)
					.provider(provider)
					.manner(Manner.create())
					.isRegistered(false)
					.build());
				String token = generateToken(user);
				Date now = new Date();
				jwtRefreshTokenRepository.save(new JwtRefreshToken(user.getId(), new Date(now.getTime()),
					new Date(now.getTime() + refreshTokenExpiryTime * MILLISECOND_CORRECTION)));
				return OAuthLoginResult.of(token, true);
			});
	}

	private String generateToken(User user) {
		return jwtTokenProvider.createToken("ROLE_USER", user.getId());
	}
}