diff --git a/src/main/java/org/ject/support/common/security/jwt/JwtAuthenticationFilter.java b/src/main/java/org/ject/support/common/security/jwt/JwtAuthenticationFilter.java index c4705d86..134607ef 100644 --- a/src/main/java/org/ject/support/common/security/jwt/JwtAuthenticationFilter.java +++ b/src/main/java/org/ject/support/common/security/jwt/JwtAuthenticationFilter.java @@ -9,8 +9,6 @@ import org.ject.support.common.exception.GlobalErrorCode; import org.ject.support.common.exception.GlobalException; import org.ject.support.common.security.CustomUserDetails; -import org.ject.support.domain.auth.exception.AuthErrorCode; -import org.ject.support.domain.auth.exception.AuthException; import org.ject.support.domain.member.Role; import org.springframework.security.authentication.UsernamePasswordAuthenticationToken; import org.springframework.security.core.Authentication; @@ -51,6 +49,9 @@ protected void doFilterInternal(HttpServletRequest request, HttpServletResponse if (jwtTokenProvider.validateToken(accessToken)) { Authentication auth = jwtTokenProvider.getAuthenticationByToken(accessToken); SecurityContextHolder.getContext().setAuthentication(auth); + + chain.doFilter(request, response); + return; } else { clearAuthCookie(response, "accessToken"); SecurityContextHolder.clearContext(); @@ -64,15 +65,15 @@ protected void doFilterInternal(HttpServletRequest request, HttpServletResponse jwtTokenProvider.resolveVerificationToken(request); if (verificationToken != null) { - if (!jwtTokenProvider.validateToken(verificationToken)) { - // verification token은 실패 시 에러가 맞음 - throw new AuthException(AuthErrorCode.INVALID_TOKEN); - } + if (jwtTokenProvider.validateToken(verificationToken)) { + String email = jwtTokenProvider.extractEmailFromVerificationToken(verificationToken); - String email = jwtTokenProvider.extractEmailFromVerificationToken(verificationToken); - - Authentication auth = createVerificationAuthentication(email); - SecurityContextHolder.getContext().setAuthentication(auth); + Authentication auth = createVerificationAuthentication(email); + SecurityContextHolder.getContext().setAuthentication(auth); + } else { + clearAuthCookie(response, "verificationToken"); + SecurityContextHolder.clearContext(); + } } chain.doFilter(request, response); diff --git a/src/main/java/org/ject/support/common/security/jwt/JwtTokenProvider.java b/src/main/java/org/ject/support/common/security/jwt/JwtTokenProvider.java index 06e54037..478bf68c 100644 --- a/src/main/java/org/ject/support/common/security/jwt/JwtTokenProvider.java +++ b/src/main/java/org/ject/support/common/security/jwt/JwtTokenProvider.java @@ -10,6 +10,7 @@ import jakarta.annotation.PostConstruct; import jakarta.servlet.http.Cookie; import jakarta.servlet.http.HttpServletRequest; +import jakarta.servlet.http.HttpServletResponse; import lombok.Getter; import lombok.RequiredArgsConstructor; import org.ject.support.common.exception.GlobalException; @@ -205,7 +206,19 @@ public String createVerificationToken(String email) { .signWith(secretKey) .compact(); } - + + /** + * 인증번호 검증 쿠키 삭제 + */ + public void deleteVerificationCookie(HttpServletResponse response) { + Cookie cookie = new Cookie("verificationToken", null); + cookie.setPath("/"); + cookie.setHttpOnly(true); + cookie.setSecure(true); + cookie.setMaxAge(0); + response.addCookie(cookie); + } + /** * 인증번호 검증 토큰에서 이메일 추출 */ diff --git a/src/main/java/org/ject/support/domain/member/controller/MemberController.java b/src/main/java/org/ject/support/domain/member/controller/MemberController.java index 5f8c21d5..89bbec49 100644 --- a/src/main/java/org/ject/support/domain/member/controller/MemberController.java +++ b/src/main/java/org/ject/support/domain/member/controller/MemberController.java @@ -50,6 +50,9 @@ public boolean registerTempMember(HttpServletRequest request, HttpServletRespons Authentication authentication = memberService.registerTempMember(registerRequest, email); customSuccessHandler.onAuthenticationSuccess(request, response, authentication); + // verification 토큰은 더 이상 필요 없으므로 삭제 + jwtTokenProvider.deleteVerificationCookie(response); + return true; }