[CICD] securityConfig 수정

Author: simhyunmin

src/main/java/fitfit/domain/token/filter/JwtAuthenticationFilter.java

@@ -6,65 +6,60 @@
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
 import lombok.RequiredArgsConstructor;
-import org.springframework.http.HttpMethod;
+import org.springframework.lang.NonNull;
 import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
 import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.security.core.userdetails.UserDetails;
 import org.springframework.security.core.userdetails.UserDetailsService;
 import org.springframework.security.web.authentication.WebAuthenticationDetailsSource;
 import org.springframework.stereotype.Component;
-import org.springframework.util.AntPathMatcher;
 import org.springframework.web.filter.OncePerRequestFilter;
 
 import java.io.IOException;
-import java.util.List;
 
 @Component
 @RequiredArgsConstructor
 public class JwtAuthenticationFilter extends OncePerRequestFilter {
-    // 토큰 없이도 가능하게
-    private static final List<String> WHITE_LIST = List.of(
-            "/swagger-ui.html",
-            "/auth/**",
-            "/swagger-ui/**",
-            "/v3/api-docs/**",
-            "/api/members/auth/kko",
-            "/auth/refresh"
-    );
 
     private final JwtProvider jwtProvider;
     private final UserDetailsService userDetailsService;
-    private final AntPathMatcher antPathMatcher = new AntPathMatcher();
 
     @Override
-    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
+    protected void doFilterInternal(
+            @NonNull HttpServletRequest request,
+            @NonNull HttpServletResponse response,
+            @NonNull FilterChain filterChain
+    ) throws ServletException, IOException {
+
+        final String authHeader = request.getHeader("Authorization");
+
+        if (authHeader == null) {
+            filterChain.doFilter(request, response);
+            return;
+        }
+
+        Long memberId = null;
         try {
-            Long memberId = jwtProvider.getMemberIdAndValidateToken(request.getHeader("Authorization"));
+            memberId = jwtProvider.getMemberIdAndValidateToken(authHeader);
+        } catch (Exception e) {
+            SecurityContextHolder.clearContext();
+        }
 
-            UserDetails userDetails = userDetailsService.loadUserByUsername(memberId.toString());
-            UsernamePasswordAuthenticationToken authentication = new UsernamePasswordAuthenticationToken(
+        if (memberId != null && SecurityContextHolder.getContext().getAuthentication() == null) {
+            UserDetails userDetails = this.userDetailsService.loadUserByUsername(memberId.toString());
+
+            UsernamePasswordAuthenticationToken authToken = new UsernamePasswordAuthenticationToken(
                     userDetails,
                     null,
                     userDetails.getAuthorities()
             );
-            authentication.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
-            SecurityContextHolder.getContext().setAuthentication(authentication);
-        } catch (Exception e) {
-            response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
-            response.getWriter().write("{\"error\": \"" + e.getMessage() + "\"}");
-            return;
-        }
-
-        filterChain.doFilter(request, response);
-    }
+            authToken.setDetails(
+                    new WebAuthenticationDetailsSource().buildDetails(request)
+            );
 
-    @Override
-    protected boolean shouldNotFilter(HttpServletRequest request) throws ServletException {
-        if (request.getMethod().equalsIgnoreCase(HttpMethod.OPTIONS.name())) {
-            return true;
+            SecurityContextHolder.getContext().setAuthentication(authToken);
         }
 
-        // 더 안정적인 AntPathMatcher.match() 로 수정
-        return WHITE_LIST.stream().anyMatch(white -> antPathMatcher.match(white, request.getRequestURI()));
+        filterChain.doFilter(request, response);
     }
 }

src/main/java/fitfit/global/security/config/SecurityConfig.java

@@ -34,11 +34,14 @@ public SecurityFilterChain filterChain (HttpSecurity http) throws Exception {
                 .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
                 .authorizeHttpRequests(auth -> auth
                         .requestMatchers(
-                                HttpMethod.OPTIONS, "/**",
-                                "/swagger-ui.html",
-                                "/auth/**",
+                                HttpMethod.OPTIONS, "/**"
+                        ).permitAll()
+                        .requestMatchers(
                                 "/swagger-ui/**",
                                 "/v3/api-docs/**",
+                                "/swagger-resources/**",
+                                "/webjars/**",
+                                "/auth/**",
                                 "/api/members/auth/kko",
                                 "/auth/refresh"
                         ).permitAll()