[HOTFIX] JwtToken 인증 방식 개선 (#404)

* feat: JWT 인증 필터에서 검증 토큰 처리 로직 개선 및 쿠키 삭제 기능 추가
* feat: JWT 인증 필터에서 검증 토큰 쿠키에 보안 속성 추가
* feat: JWT 인증 필터에서 검증 토큰 처리 로직 개선
* feat: JWT 인증 필터에서 검증 토큰 처리 로직 간소화
* feat: JWT 인증 필터에서 액세스 토큰 및 검증 토큰 처리 로직 개선

Author: fivedragon5

src/main/java/org/ject/support/common/security/jwt/JwtAuthenticationFilter.java

@@ -9,8 +9,6 @@
 import org.ject.support.common.exception.GlobalErrorCode;
 import org.ject.support.common.exception.GlobalException;
 import org.ject.support.common.security.CustomUserDetails;
-import org.ject.support.domain.auth.exception.AuthErrorCode;
-import org.ject.support.domain.auth.exception.AuthException;
 import org.ject.support.domain.member.Role;
 import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
 import org.springframework.security.core.Authentication;
@@ -51,6 +49,9 @@ protected void doFilterInternal(HttpServletRequest request, HttpServletResponse
                 if (jwtTokenProvider.validateToken(accessToken)) {
                     Authentication auth = jwtTokenProvider.getAuthenticationByToken(accessToken);
                     SecurityContextHolder.getContext().setAuthentication(auth);
+
+                    chain.doFilter(request, response);
+                    return;
                 } else {
                     clearAuthCookie(response, "accessToken");
                     SecurityContextHolder.clearContext();
@@ -64,15 +65,15 @@ protected void doFilterInternal(HttpServletRequest request, HttpServletResponse
                     jwtTokenProvider.resolveVerificationToken(request);
 
             if (verificationToken != null) {
-                if (!jwtTokenProvider.validateToken(verificationToken)) {
-                    // verification token은 실패 시 에러가 맞음
-                    throw new AuthException(AuthErrorCode.INVALID_TOKEN);
-                }
+                if (jwtTokenProvider.validateToken(verificationToken)) {
+                    String email = jwtTokenProvider.extractEmailFromVerificationToken(verificationToken);
 
-                String email = jwtTokenProvider.extractEmailFromVerificationToken(verificationToken);
-
-                Authentication auth = createVerificationAuthentication(email);
-                SecurityContextHolder.getContext().setAuthentication(auth);
+                    Authentication auth = createVerificationAuthentication(email);
+                    SecurityContextHolder.getContext().setAuthentication(auth);
+                } else {
+                    clearAuthCookie(response, "verificationToken");
+                    SecurityContextHolder.clearContext();
+                }
             }
 
             chain.doFilter(request, response);

src/main/java/org/ject/support/common/security/jwt/JwtTokenProvider.java

@@ -10,6 +10,7 @@
 import jakarta.annotation.PostConstruct;
 import jakarta.servlet.http.Cookie;
 import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
 import lombok.Getter;
 import lombok.RequiredArgsConstructor;
 import org.ject.support.common.exception.GlobalException;
@@ -205,7 +206,19 @@ public String createVerificationToken(String email) {
                 .signWith(secretKey)
                 .compact();
     }
-    
+
+    /**
+     * 인증번호 검증 쿠키 삭제
+     */
+    public void deleteVerificationCookie(HttpServletResponse response) {
+        Cookie cookie = new Cookie("verificationToken", null);
+        cookie.setPath("/");
+        cookie.setHttpOnly(true);
+        cookie.setSecure(true);
+        cookie.setMaxAge(0);
+        response.addCookie(cookie);
+    }
+
     /**
      * 인증번호 검증 토큰에서 이메일 추출
      */

src/main/java/org/ject/support/domain/member/controller/MemberController.java

@@ -50,6 +50,9 @@ public boolean registerTempMember(HttpServletRequest request, HttpServletRespons
         Authentication authentication = memberService.registerTempMember(registerRequest, email);
         customSuccessHandler.onAuthenticationSuccess(request, response, authentication);
 
+        // verification 토큰은 더 이상 필요 없으므로 삭제
+        jwtTokenProvider.deleteVerificationCookie(response);
+
         return true;
     }