Handle invalid Google identity tokens

Author: jjoonleo

ontime-back/src/main/java/devkor/ontime_back/global/oauth/google/GoogleLoginFilter.java

@@ -16,6 +16,7 @@
 import jakarta.validation.Validator;
 import lombok.extern.slf4j.Slf4j;
 import org.springframework.dao.DataIntegrityViolationException;
+import org.springframework.security.authentication.BadCredentialsException;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.AuthenticationException;
 import org.springframework.security.core.context.SecurityContextHolder;
@@ -57,7 +58,14 @@ public Authentication attemptAuthentication(HttpServletRequest request, HttpServ
 
         try {
             GoogleIdToken.Payload googlePayload = googleLoginService.verifyIdentityToken(oAuthGoogleRequestDto.getIdToken());
+            if (googlePayload == null) {
+                throw new BadCredentialsException("Invalid Google identity token");
+            }
+
             String googleUserId = googlePayload.getSubject();
+            if (googleUserId == null || googleUserId.isBlank()) {
+                throw new BadCredentialsException("Google identity token has no subject");
+            }
 
             Object loginLock = LOGIN_LOCKS.computeIfAbsent(googleUserId, key -> new Object());
             synchronized (loginLock) {
@@ -84,6 +92,9 @@ public Authentication attemptAuthentication(HttpServletRequest request, HttpServ
                 }
             }
 
+        } catch (AuthenticationException e) {
+            log.warn("Google login failed: {}", e.getMessage());
+            throw e;
         } catch (Exception e) {
             log.error("Google login failed: {}", e.getClass().getSimpleName());
             throw new AuthenticationException("Google 로그인 실패") {};

ontime-back/src/test/java/devkor/ontime_back/global/oauth/OAuthLoginFilterValidationTest.java

@@ -18,11 +18,14 @@
 import org.mockito.junit.jupiter.MockitoExtension;
 import org.springframework.mock.web.MockHttpServletRequest;
 import org.springframework.mock.web.MockHttpServletResponse;
+import org.springframework.security.authentication.BadCredentialsException;
 import org.springframework.security.core.AuthenticationException;
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatThrownBy;
+import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.verifyNoInteractions;
+import static org.mockito.Mockito.when;
 
 @ExtendWith(MockitoExtension.class)
 class OAuthLoginFilterValidationTest {
@@ -65,6 +68,29 @@ void googleLoginFilterRejectsInvalidRequest() throws Exception {
         verifyNoInteractions(googleLoginService, userRepository);
     }
 
+    @Test
+    @DisplayName("구글 로그인 필터가 검증 실패한 idToken을 인증 실패로 처리한다")
+    void googleLoginFilterRejectsUnverifiedIdToken() throws Exception {
+        GoogleLoginFilter filter = new GoogleLoginFilter(
+                "/oauth2/google/login",
+                objectMapper,
+                validator,
+                googleLoginService,
+                userRepository);
+        MockHttpServletResponse response = new MockHttpServletResponse();
+
+        when(googleLoginService.verifyIdentityToken("invalid-token")).thenReturn(null);
+
+        assertThatThrownBy(() -> filter.attemptAuthentication(
+                request("/oauth2/google/login", "{\"idToken\":\"invalid-token\"}"),
+                response))
+                .isInstanceOf(BadCredentialsException.class)
+                .hasMessage("Invalid Google identity token");
+
+        verify(googleLoginService).verifyIdentityToken("invalid-token");
+        verifyNoInteractions(userRepository);
+    }
+
     @Test
     @DisplayName("카카오 로그인 필터가 잘못된 요청을 400 validation 응답으로 처리한다")
     void kakaoLoginFilterRejectsInvalidRequest() throws Exception {