[CICD] securityConfig 수정

Author: simhyunmin

src/main/java/fitfit/domain/token/filter/JwtAuthenticationFilter.java

@@ -6,23 +6,45 @@
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
 import lombok.RequiredArgsConstructor;
+import org.springframework.http.HttpMethod;
 import org.springframework.lang.NonNull;
 import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
 import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.security.core.userdetails.UserDetails;
 import org.springframework.security.core.userdetails.UserDetailsService;
 import org.springframework.security.web.authentication.WebAuthenticationDetailsSource;
 import org.springframework.stereotype.Component;
+import org.springframework.util.AntPathMatcher;
 import org.springframework.web.filter.OncePerRequestFilter;
 
 import java.io.IOException;
+import java.util.List;
 
 @Component
 @RequiredArgsConstructor
 public class JwtAuthenticationFilter extends OncePerRequestFilter {
 
     private final JwtProvider jwtProvider;
     private final UserDetailsService userDetailsService;
+    private final AntPathMatcher antPathMatcher = new AntPathMatcher();
+
+    private static final List<String> WHITE_LIST = List.of(
+            "/swagger-ui/**",
+            "/v3/api-docs/**",
+            "/swagger-resources/**",
+            "/webjars/**",
+            "/auth/**",
+            "/api/members/auth/kko",
+            "/auth/refresh"
+    );
+
+    @Override
+    protected boolean shouldNotFilter(HttpServletRequest request) {
+        if (request.getMethod().equalsIgnoreCase(HttpMethod.OPTIONS.name())) {
+            return true;
+        }
+        return WHITE_LIST.stream().anyMatch(white -> antPathMatcher.match(white, request.getRequestURI()));
+    }
 
     @Override
     protected void doFilterInternal(
@@ -53,7 +75,6 @@ protected void doFilterInternal(
                 SecurityContextHolder.getContext().setAuthentication(authToken);
             }
         } catch (Exception e) {
-            // Bearer 토큰이 있지만 유효하지 않은 경우, 컨텍스트를 비워서 인증되지 않은 상태로 만듭니다.
             SecurityContextHolder.clearContext();
         }