merge from main 3

merge from main 3

Author: Paley-Z

src/main/java/com/bootsignal/global/security/jwt/JwtTokenCookieManager.java

@@ -35,14 +35,17 @@ public class JwtTokenCookieManager {
 
 	private final boolean cookieSecure;
 	private final String cookieSameSite;
+	private final String cookieDomain;
 	private final SecureRandom secureRandom = new SecureRandom();
 
 	public JwtTokenCookieManager(
 		@Value("${app.security.jwt.cookie.secure:false}") boolean cookieSecure,
-		@Value("${app.security.jwt.cookie.same-site:Lax}") String cookieSameSite
+		@Value("${app.security.jwt.cookie.same-site:Lax}") String cookieSameSite,
+		@Value("${app.security.jwt.cookie.domain:}") String cookieDomain
 	) {
 		this.cookieSecure = cookieSecure;
 		this.cookieSameSite = StringUtils.hasText(cookieSameSite) ? cookieSameSite : "Lax";
+		this.cookieDomain = StringUtils.hasText(cookieDomain) ? cookieDomain : null;
 	}
 
 	public void addTokenCookies(HttpServletResponse response, LoginResponse loginResponse) {
@@ -124,11 +127,15 @@ private void addExpiredCookie(HttpServletResponse response, String name, String
 	}
 
 	private ResponseCookie.ResponseCookieBuilder baseCookie(String name, String value, String path, boolean httpOnly) {
-		return ResponseCookie.from(name, value)
+		ResponseCookie.ResponseCookieBuilder builder = ResponseCookie.from(name, value)
 			.httpOnly(httpOnly)
 			.secure(cookieSecure)
 			.path(path)
 			.sameSite(cookieSameSite);
+		if (cookieDomain != null) {
+			builder = builder.domain(cookieDomain);
+		}
+		return builder;
 	}
 
 	private String generateCsrfToken() {

src/main/resources/application-prod.yml

@@ -26,6 +26,8 @@ app:
         # 운영 HTTPS 환경에서는 JWT 쿠키가 평문 HTTP로 전송되지 않도록 Secure 기본값을 true로 둔다.
         secure: ${JWT_COOKIE_SECURE:true}
         same-site: ${JWT_COOKIE_SAME_SITE:Lax}
+        # CSRF 쿠키를 프론트(boot-signal.com)에서 JS로 읽으려면 상위 도메인으로 발급해야 한다.
+        domain: ${JWT_COOKIE_DOMAIN:.boot-signal.com}
 
 logging:
   level: