feat: cors 설정 추가 (#54)

Author: soonduck-dreams

src/main/java/org/devkor/apu/saerok_server/global/security/CorsProperties.java

@@ -0,0 +1,17 @@
+package org.devkor.apu.saerok_server.global.security;
+
+import lombok.Getter;
+import lombok.Setter;
+import org.springframework.boot.context.properties.ConfigurationProperties;
+import org.springframework.stereotype.Component;
+
+import java.util.List;
+
+@Component
+@Getter
+@Setter
+@ConfigurationProperties(prefix = "cors")
+public class CorsProperties {
+
+    private List<String> allowedOrigins;
+}

src/main/java/org/devkor/apu/saerok_server/global/security/SecurityConfig.java

@@ -1,6 +1,7 @@
 package org.devkor.apu.saerok_server.global.security;
 
 import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
@@ -9,7 +10,13 @@
 import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
 import org.springframework.security.web.SecurityFilterChain;
 import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
+import org.springframework.web.cors.CorsConfiguration;
+import org.springframework.web.cors.CorsConfigurationSource;
+import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
 
+import java.util.List;
+
+@Slf4j
 @Configuration
 @EnableWebSecurity
 @EnableMethodSecurity
@@ -23,6 +30,7 @@ public class SecurityConfig {
     private final JwtAuthenticationFilter jwtAuthenticationFilter;
     private final JwtAuthenticationEntryPoint jwtAuthenticationEntryPoint;
     private final JwtAccessDeniedHandler jwtAccessDeniedHandler;
+    private final CorsProperties corsProperties;
 
     @Bean
     public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
@@ -39,6 +47,22 @@ public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
                         .anyRequest().permitAll() // 일단 HTTP 레벨에서는 다 들여보내고, 메서드별 애노테이션으로 권한 설정
                 )
                 .addFilterBefore(jwtAuthenticationFilter, UsernamePasswordAuthenticationFilter.class)
+                .cors(cors -> {})
                 .build();
     }
+
+    @Bean
+    public CorsConfigurationSource corsConfigurationSource() {
+        CorsConfiguration config = new CorsConfiguration();
+        config.setAllowedOrigins(corsProperties.getAllowedOrigins());
+        config.setAllowedMethods(List.of("GET", "POST", "PUT", "DELETE", "PATCH", "OPTIONS"));
+        config.setAllowedHeaders(List.of("*"));
+        config.setAllowCredentials(true);
+
+        log.info("cors allowed origins: {}", corsProperties.getAllowedOrigins());
+
+        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
+        source.registerCorsConfiguration("/**", config);
+        return source;
+    }
 }

src/main/resources/application-dev.yml

@@ -44,4 +44,8 @@ kakao:
 
 app:
   cookie:
-    secure: true
+    secure: true
+
+cors:
+  allowed-origins:
+    - http://localhost:3000

src/main/resources/application-local.yml

@@ -46,4 +46,7 @@ kakao:
 
 app:
   cookie:
-    secure: false
+    secure: false
+
+cors:
+  allowed-origins: []