main merge to publish

main merge to publish

Author: Paley-Z

.env.example

@@ -35,6 +35,9 @@ JWT_ISSUER=bootsignal
 JWT_SECRET=replace-this-with-a-strong-secret-at-least-32-bytes
 JWT_ACCESS_TOKEN_VALIDITY_SECONDS=3600
 JWT_REFRESH_TOKEN_VALIDITY_SECONDS=1209600
+# JWT 쿠키 보안 정책. 운영 HTTPS 환경은 Secure=true를 사용한다.
+JWT_COOKIE_SECURE=false
+JWT_COOKIE_SAME_SITE=Lax
 
 # Password reset and mail settings
 PASSWORD_RESET_VALIDITY_SECONDS=1800

src/main/java/com/bootsignal/domain/auth/controller/AuthController.java

@@ -13,6 +13,9 @@
 import com.bootsignal.domain.auth.dto.SignupRequest;
 import com.bootsignal.domain.auth.dto.SignupResponse;
 import com.bootsignal.domain.auth.service.AuthService;
+import com.bootsignal.global.security.jwt.JwtTokenCookieManager;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
 import jakarta.validation.Valid;
 import jakarta.validation.constraints.Email;
 import jakarta.validation.constraints.NotBlank;
@@ -22,14 +25,14 @@
 import org.springframework.validation.annotation.Validated;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.PostMapping;
-import org.springframework.web.bind.annotation.RequestParam;
 import org.springframework.web.bind.annotation.RequestBody;
 import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestParam;
 import org.springframework.web.bind.annotation.ResponseStatus;
 import org.springframework.web.bind.annotation.RestController;
 
 /**
- * 회원가입, 로그인, 소셜 로그인, 토큰 관리, 비밀번호 찾기 API를 제공하는 인증 컨트롤러입니다.
+ * 회원가입, 로그인, 소셜 로그인, HttpOnly 쿠키 기반 토큰 관리, 비밀번호 찾기 API를 제공하는 인증 컨트롤러입니다.
  */
 @RestController
 @RequestMapping("/api/auth")
@@ -38,6 +41,7 @@
 public class AuthController {
 
 	private final AuthService authService;
+	private final JwtTokenCookieManager jwtTokenCookieManager;
 
 	@GetMapping("/check-email")
 	public EmailAvailabilityResponse checkEmail(
@@ -57,23 +61,32 @@ public SignupResponse signup(@Valid @RequestBody SignupRequest request) {
 	}
 
 	@PostMapping("/login")
-	public LoginResponse login(@Valid @RequestBody LoginRequest request) {
-		return authService.login(request);
+	public LoginResponse login(@Valid @RequestBody LoginRequest request, HttpServletResponse response) {
+		LoginResponse loginResponse = authService.login(request);
+		jwtTokenCookieManager.addTokenCookies(response, loginResponse);
+		return loginResponse;
 	}
 
 	@PostMapping("/google/login")
-	public LoginResponse googleLogin(@Valid @RequestBody GoogleLoginRequest request) {
-		return authService.googleLogin(request);
+	public LoginResponse googleLogin(@Valid @RequestBody GoogleLoginRequest request, HttpServletResponse response) {
+		LoginResponse loginResponse = authService.googleLogin(request);
+		jwtTokenCookieManager.addTokenCookies(response, loginResponse);
+		return loginResponse;
 	}
 
 	@PostMapping("/kakao/login")
-	public LoginResponse kakaoLogin(@Valid @RequestBody KakaoLoginRequest request) {
-		return authService.kakaoLogin(request);
+	public LoginResponse kakaoLogin(@Valid @RequestBody KakaoLoginRequest request, HttpServletResponse response) {
+		LoginResponse loginResponse = authService.kakaoLogin(request);
+		jwtTokenCookieManager.addTokenCookies(response, loginResponse);
+		return loginResponse;
 	}
 
 	@PostMapping("/refresh")
-	public LoginResponse refresh(@Valid @RequestBody RefreshTokenRequest request) {
-		return authService.refresh(request);
+	public LoginResponse refresh(HttpServletRequest request, HttpServletResponse response) {
+		String refreshToken = jwtTokenCookieManager.requireRefreshToken(request);
+		LoginResponse loginResponse = authService.refresh(new RefreshTokenRequest(refreshToken));
+		jwtTokenCookieManager.addTokenCookies(response, loginResponse);
+		return loginResponse;
 	}
 
 	@PostMapping("/password/forgot")
@@ -88,7 +101,12 @@ public AuthActionResponse resetPassword(@Valid @RequestBody PasswordResetRequest
 
 	@PostMapping("/logout")
 	@ResponseStatus(HttpStatus.NO_CONTENT)
-	public void logout(@Valid @RequestBody RefreshTokenRequest request) {
-		authService.logout(request);
+	public void logout(HttpServletRequest request, HttpServletResponse response) {
+		try {
+			String refreshToken = jwtTokenCookieManager.requireRefreshToken(request);
+			authService.logout(new RefreshTokenRequest(refreshToken));
+		} finally {
+			jwtTokenCookieManager.clearTokenCookies(response);
+		}
 	}
 }

src/main/java/com/bootsignal/domain/auth/dto/LoginResponse.java

@@ -7,13 +7,18 @@
 import com.fasterxml.jackson.annotation.JsonIgnore;
 
 /**
- * 로그인과 토큰 재발급 성공 시 사용자 정보와 JWT 토큰 정보를 함께 반환하는 DTO입니다.
+ * 로그인과 토큰 재발급 성공 시 쿠키 발급에 필요한 JWT와 응답 본문의 사용자 정보를 함께 운반하는 DTO입니다.
  */
 public record LoginResponse(
+	@JsonIgnore
 	String accessToken,
+	@JsonIgnore
 	String tokenType,
+	@JsonIgnore
 	long expiresIn,
+	@JsonIgnore
 	String refreshToken,
+	@JsonIgnore
 	long refreshTokenExpiresIn,
 	AuthUserResponse user
 ) {

src/main/java/com/bootsignal/domain/calendar/controller/CalendarController.java

@@ -1,12 +1,11 @@
 package com.bootsignal.domain.calendar.controller;
 
+import com.bootsignal.domain.calendar.dto.CalendarConnectResponse;
 import com.bootsignal.domain.calendar.dto.CalendarEventListResponse;
 import com.bootsignal.domain.calendar.dto.CalendarStatusResponse;
 import com.bootsignal.domain.calendar.service.CalendarEventQueryService;
 import com.bootsignal.domain.calendar.service.CalendarService;
 import com.bootsignal.global.exception.BootSignalException;
-import jakarta.servlet.http.HttpServletResponse;
-import java.io.IOException;
 import java.net.URLEncoder;
 import java.nio.charset.StandardCharsets;
 import java.net.URI;
@@ -34,14 +33,11 @@ public CalendarStatusResponse getStatus() {
 		return calendarService.getStatus();
 	}
 
-	/* Google Calendar OAuth 연동 시작 */
+	/* Google Calendar OAuth 연동 시작 (redirect URL JSON 반환) */
 	@GetMapping("/connect/google")
-	public void startGoogleConnect(HttpServletResponse response) throws IOException {
-		// 구글 캘린더 OAuth 인증 URL 생성
+	public CalendarConnectResponse startGoogleConnect() {
 		String authorizationUrl = calendarService.startGoogleConnect();
-		
-		// 리다이렉트 응답 전송
-		response.sendRedirect(authorizationUrl);
+		return CalendarConnectResponse.of(authorizationUrl);
 	}
 
 	/* Google Calendar OAuth callback (연동 -> 구글 -> 콜백) */

src/main/java/com/bootsignal/domain/calendar/dto/CalendarConnectResponse.java

@@ -0,0 +1,10 @@
+package com.bootsignal.domain.calendar.dto;
+
+public record CalendarConnectResponse(
+	String redirectUrl
+) {
+
+	public static CalendarConnectResponse of(String redirectUrl) {
+		return new CalendarConnectResponse(redirectUrl);
+	}
+}

src/main/java/com/bootsignal/domain/report/entity/Report.java

@@ -51,6 +51,7 @@ public class Report extends BaseEntity {
     private ReportStatus status = ReportStatus.PENDING;
 
     @Enumerated(EnumType.STRING)
+    @Column(length = 20)
     private ReportAction action;
 
     private String processReason;

src/main/java/com/bootsignal/global/config/SecurityConfig.java

@@ -3,7 +3,9 @@
 import com.bootsignal.global.config.properties.CorsProperties;
 import com.bootsignal.global.exception.BootSignalException;
 import com.bootsignal.global.exception.ErrorCode;
+import com.bootsignal.global.security.jwt.JwtCsrfTokenFilter;
 import com.bootsignal.global.security.jwt.JwtAuthenticationFilter;
+import com.bootsignal.global.security.jwt.JwtTokenCookieManager;
 import com.bootsignal.global.security.jwt.JwtTokenProvider;
 import java.util.List;
 import java.util.Objects;
@@ -28,7 +30,7 @@
 import org.springframework.web.servlet.HandlerExceptionResolver;
 
 /**
- * JWT 기반 인증, CORS, 공개/보호 API 경계를 설정하는 보안 구성입니다.
+ * JWT 헤더/쿠키 기반 인증, CSRF 방어, CORS, 공개/보호 API 경계를 설정하는 보안 구성입니다.
  */
 @Configuration
 @EnableWebSecurity
@@ -41,10 +43,12 @@ public class SecurityConfig {
 	@Bean
 	public SecurityFilterChain securityFilterChain(
 		HttpSecurity http,
+		JwtCsrfTokenFilter jwtCsrfTokenFilter,
 		JwtAuthenticationFilter jwtAuthenticationFilter,
 		@Qualifier("handlerExceptionResolver") HandlerExceptionResolver handlerExceptionResolver
 	) throws Exception {
 		return http
+			// JWT 쿠키 인증은 별도 double-submit CSRF 필터(JwtCsrfTokenFilter)로 검증한다.
 			.csrf(AbstractHttpConfigurer::disable)
 			.httpBasic(AbstractHttpConfigurer::disable)
 			.formLogin(AbstractHttpConfigurer::disable)
@@ -95,17 +99,27 @@ public SecurityFilterChain securityFilterChain(
 					)
 				)
 			)
-			.addFilterBefore(jwtAuthenticationFilter, UsernamePasswordAuthenticationFilter.class)
+			.addFilterBefore(jwtCsrfTokenFilter, UsernamePasswordAuthenticationFilter.class)
+			.addFilterAfter(jwtAuthenticationFilter, JwtCsrfTokenFilter.class)
 			.headers(headers -> headers.frameOptions(frameOptions -> frameOptions.sameOrigin()))
 			.build();
 	}
 
+	@Bean
+	public JwtCsrfTokenFilter jwtCsrfTokenFilter(
+		JwtTokenCookieManager jwtTokenCookieManager,
+		@Qualifier("handlerExceptionResolver") HandlerExceptionResolver handlerExceptionResolver
+	) {
+		return new JwtCsrfTokenFilter(jwtTokenCookieManager, handlerExceptionResolver);
+	}
+
 	@Bean
 	public JwtAuthenticationFilter jwtAuthenticationFilter(
 		JwtTokenProvider jwtTokenProvider,
+		JwtTokenCookieManager jwtTokenCookieManager,
 		@Qualifier("handlerExceptionResolver") HandlerExceptionResolver handlerExceptionResolver
 	) {
-		return new JwtAuthenticationFilter(jwtTokenProvider, handlerExceptionResolver);
+		return new JwtAuthenticationFilter(jwtTokenProvider, jwtTokenCookieManager, handlerExceptionResolver);
 	}
 
 	@Bean

src/main/java/com/bootsignal/global/exception/ErrorCode.java

@@ -10,6 +10,7 @@ public enum ErrorCode {
 	REFRESH_TOKEN_EXPIRED(HttpStatus.UNAUTHORIZED, "REFRESH_TOKEN_EXPIRED", "만료된 Refresh Token입니다."),
 	REFRESH_TOKEN_REVOKED(HttpStatus.UNAUTHORIZED, "REFRESH_TOKEN_REVOKED", "이미 폐기된 Refresh Token입니다."),
 	REFRESH_TOKEN_REUSED(HttpStatus.UNAUTHORIZED, "REFRESH_TOKEN_REUSED", "이미 사용된 Refresh Token입니다."),
+	CSRF_TOKEN_INVALID(HttpStatus.FORBIDDEN, "CSRF_TOKEN_INVALID", "유효하지 않은 CSRF Token입니다."),
 	BAD_REQUEST(HttpStatus.BAD_REQUEST, "BAD_REQUEST", "잘못된 요청입니다."),
 	VALIDATION_ERROR(HttpStatus.BAD_REQUEST, "VALIDATION_ERROR", "요청 값이 올바르지 않습니다."),
 	UNAUTHORIZED(HttpStatus.UNAUTHORIZED, "UNAUTHORIZED", "로그인이 필요합니다."),

src/main/java/com/bootsignal/global/security/jwt/JwtAuthenticationFilter.java

@@ -15,22 +15,25 @@
 import org.springframework.web.servlet.HandlerExceptionResolver;
 
 /**
- * Authorization 헤더의 Access Token을 검증해 SecurityContext에 인증 정보를 설정하는 필터입니다.
- * 인증 API는 Refresh Token 본문 검증 흐름과 충돌하지 않도록 필터 대상에서 제외합니다.
+ * Authorization 헤더 또는 HttpOnly 쿠키의 Access Token을 검증해 SecurityContext에 인증 정보를 설정하는 필터입니다.
+ * 인증 API는 로그인과 Refresh Token 쿠키 처리 흐름과 충돌하지 않도록 필터 대상에서 제외합니다.
  */
 public class JwtAuthenticationFilter extends OncePerRequestFilter {
 
 	private static final String AUTH_API_PREFIX = "/api/auth/";
 	private static final String BEARER_PREFIX = "Bearer ";
 
 	private final JwtTokenProvider jwtTokenProvider;
+	private final JwtTokenCookieManager jwtTokenCookieManager;
 	private final HandlerExceptionResolver handlerExceptionResolver;
 
 	public JwtAuthenticationFilter(
 		JwtTokenProvider jwtTokenProvider,
+		JwtTokenCookieManager jwtTokenCookieManager,
 		HandlerExceptionResolver handlerExceptionResolver
 	) {
 		this.jwtTokenProvider = jwtTokenProvider;
+		this.jwtTokenCookieManager = jwtTokenCookieManager;
 		this.handlerExceptionResolver = handlerExceptionResolver;
 	}
 
@@ -67,7 +70,7 @@ protected void doFilterInternal(
 	private String resolveToken(HttpServletRequest request) {
 		String authorizationHeader = request.getHeader(HttpHeaders.AUTHORIZATION);
 		if (!StringUtils.hasText(authorizationHeader)) {
-			return null;
+			return jwtTokenCookieManager.resolveAccessToken(request);
 		}
 		if (!authorizationHeader.startsWith(BEARER_PREFIX)) {
 			throw new BootSignalException(ErrorCode.UNAUTHORIZED, "Bearer 인증 토큰이 필요합니다.");

src/main/java/com/bootsignal/global/security/jwt/JwtCsrfTokenFilter.java

@@ -0,0 +1,94 @@
+package com.bootsignal.global.security.jwt;
+
+import com.bootsignal.global.exception.BootSignalException;
+import com.bootsignal.global.exception.ErrorCode;
+import jakarta.servlet.FilterChain;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.security.MessageDigest;
+import java.util.Set;
+import org.springframework.http.HttpHeaders;
+import org.springframework.util.StringUtils;
+import org.springframework.web.filter.OncePerRequestFilter;
+import org.springframework.web.servlet.HandlerExceptionResolver;
+
+/**
+ * 쿠키 기반 JWT 인증 요청의 CSRF 토큰을 검증해 브라우저 자동 쿠키 전송 공격을 차단하는 필터입니다.
+ */
+public class JwtCsrfTokenFilter extends OncePerRequestFilter {
+
+	private static final Set<String> SAFE_METHODS = Set.of("GET", "HEAD", "OPTIONS", "TRACE");
+	private static final String AUTH_API_PREFIX = "/api/auth/";
+	private static final String REFRESH_API_PATH = "/api/auth/refresh";
+	private static final String LOGOUT_API_PATH = "/api/auth/logout";
+
+	private final JwtTokenCookieManager jwtTokenCookieManager;
+	private final HandlerExceptionResolver handlerExceptionResolver;
+
+	public JwtCsrfTokenFilter(
+		JwtTokenCookieManager jwtTokenCookieManager,
+		HandlerExceptionResolver handlerExceptionResolver
+	) {
+		this.jwtTokenCookieManager = jwtTokenCookieManager;
+		this.handlerExceptionResolver = handlerExceptionResolver;
+	}
+
+	@Override
+	protected void doFilterInternal(
+		HttpServletRequest request,
+		HttpServletResponse response,
+		FilterChain filterChain
+	) throws ServletException, IOException {
+		try {
+			validateCsrfTokenIfNeeded(request);
+			filterChain.doFilter(request, response);
+		} catch (BootSignalException exception) {
+			handlerExceptionResolver.resolveException(request, response, null, exception);
+		}
+	}
+
+	private void validateCsrfTokenIfNeeded(HttpServletRequest request) {
+		if (SAFE_METHODS.contains(request.getMethod())) {
+			return;
+		}
+		if (StringUtils.hasText(request.getHeader(HttpHeaders.AUTHORIZATION))) {
+			return;
+		}
+		if (isPublicAuthApi(request)) {
+			return;
+		}
+		if (!jwtTokenCookieManager.hasAuthCookie(request)) {
+			return;
+		}
+
+		String csrfCookie = jwtTokenCookieManager.resolveCsrfToken(request);
+		String csrfHeader = request.getHeader(JwtTokenCookieManager.CSRF_TOKEN_HEADER_NAME);
+		if (!StringUtils.hasText(csrfCookie) || !matches(csrfCookie, csrfHeader)) {
+			throw new BootSignalException(ErrorCode.CSRF_TOKEN_INVALID);
+		}
+	}
+
+	private boolean isPublicAuthApi(HttpServletRequest request) {
+		String requestPath = request.getRequestURI();
+		String contextPath = request.getContextPath();
+		if (StringUtils.hasText(contextPath) && requestPath.startsWith(contextPath)) {
+			requestPath = requestPath.substring(contextPath.length());
+		}
+		return requestPath.startsWith(AUTH_API_PREFIX)
+			&& !REFRESH_API_PATH.equals(requestPath)
+			&& !LOGOUT_API_PATH.equals(requestPath);
+	}
+
+	private boolean matches(String expected, String actual) {
+		if (!StringUtils.hasText(actual)) {
+			return false;
+		}
+		return MessageDigest.isEqual(
+			expected.getBytes(StandardCharsets.UTF_8),
+			actual.getBytes(StandardCharsets.UTF_8)
+		);
+	}
+}