<div id="readability-page-1" class="page"><div>
                  <p><a href="/m/category/FrameWork/Spring"><span>FrameWork/Spring</span></a></p><h3>[Spring] Security +Google Oauth2 + JWT 구현하기 (4) - JWT 재발급 해주기</h3>
                </div><p><cite>KoB</cite>
                  <span> 2022. 6. 5. 12:44</span>
                </p><div>
                                <figure data-ke-mobilestyle="widthOrigin" data-filename="png-transparent-jwt-io-json-web-token-hd-logo.png" data-origin-width="920" data-origin-height="460">
    <span data-url="https://k.kakaocdn.net/dn/cAqAd9/btrDYMpJzfC/GAgwWkI5kHJupgHH6GBtQK/img.png" data-lightbox="lightbox">
        <img src="https://k.kakaocdn.net/dn/cAqAd9/btrDYMpJzfC/GAgwWkI5kHJupgHH6GBtQK/img.png" onerror="this.onerror=null; this.src='//t1.daumcdn.net/tistory_admin/static/images/no-image-v1.png'; this.srcset='//t1.daumcdn.net/tistory_admin/static/images/no-image-v1.png';" data-filename="png-transparent-jwt-io-json-web-token-hd-logo.png" data-origin-width="920" data-origin-height="460">
    </span>
    
</figure>

<p data-ke-size="size16">이어서 계속 구현해보겠습니다.</p>

<p data-ke-size="size16">구현 자체가 목적이므로 자세한 설명을 생략합니다.</p>

<ol data-ke-list-type="decimal">
<li><a href="https://kingofbackend.tistory.com/227">JWT 생성하기</a></li>
<li><a href="https://kingofbackend.tistory.com/228">JWT에 권한 추가해주기&nbsp;</a></li>
<li><a href="https://kingofbackend.tistory.com/229" rel="noopener">생성한 JWT에 대해 인증/인가 하기&nbsp;</a></li>
<li>JWT 재발급 해주기 (진행)</li>
</ol>
<hr contenteditable="false" data-ke-type="horizontalRule" data-ke-style="style5">
<h2 data-ke-size="size26">구현</h2>
<h4 data-ke-size="size20">AuthController</h4>
<pre id="code_1654400321069" data-ke-language="kotlin" data-ke-type="codeblock"><code>@RestController
@RequestMapping("/auth")
class AuthController(
    private val authService: AuthService
) {

    /**
     * token 생성해서 보내주기
     */
    @GetMapping("/login")
    fun login(@AuthenticationPrincipal oAuth2User: OAuth2User): ResponseEntity&lt;JwtDto&gt; {
        return ResponseEntity.ok(authService.login(oAuth2User))
    }

    @PostMapping("/reissue")
    fun reissue(@RequestBody reissueRequestDto: ReissueRequestDto): ResponseEntity&lt;JwtDto&gt; {
        return ResponseEntity.ok(authService.reissue(reissueRequestDto))
    }
}</code></pre>

<h4 data-ke-size="size20">AuthService</h4>
<pre id="code_1654400356337" data-ke-language="kotlin" data-ke-type="codeblock"><code>@Service
class AuthService(
    private val memberRepository: MemberRepository,
    private val jwtProvider: JwtProvider
) {

    @Transactional
    fun login(oAuth2User: OAuth2User) : JwtDto {
        //TODO: 1. 회원이 아니라면 회원 가입을 시켜준다.
        if(!memberRepository.existsByEmail(oAuth2User.attributes["email"] as String)) {
            val member = Member(
                email = oAuth2User.attributes["email"] as String,
                role = AuthType.ROLE_USER
            )
            memberRepository.save(member)
        }

        //TODO: 2. token 을 생성해준다.
        return jwtProvider.generateJwtDto(oAuth2User.attributes["email"] as String)
    }

    @Transactional(readOnly = true)
    fun reissue(reissueRequestDto: ReissueRequestDto): JwtDto {
        jwtProvider.validateRefreshToken(reissueRequestDto.refreshToken)

        val authentication = jwtProvider.findAuthentication(reissueRequestDto.refreshToken)

        return jwtProvider.generateJwtDto(authentication.name)
    }
}</code></pre>

<h4 data-ke-size="size20">JwtProvider</h4>
<pre id="code_1654400379234" data-ke-language="kotlin" data-ke-type="codeblock"><code>@Component
class JwtProvider(
    private val memberRepository: MemberRepository
) {

    companion object {
        private const val AUTHORITIES_KEY = "auth"
        private const val BEARER_TYPE = "bearer"
        private const val ACCESS_TOKEN_EXPIRE_TIME = (1000 * 60 * 30)
        private const val REFRESH_TOKEN_EXPIRE_TIME = (1000 * 60 * 60 * 24 * 7)
    }

    private val key: Key by lazy {
        val secretKey: String = "ZVc3Z0g4bm5TVzRQUDJxUXBIOGRBUGtjRVg2WDl0dzVYVkMyWWs1Qlk3NkZBOXh1UzNoRWUzeTd6cVdEa0x2eQo=" // base64Encoded
        Keys.hmacShaKeyFor(Decoders.BASE64.decode(secretKey))
    }

    fun generateJwtDto(email: String) : JwtDto {
        val now = Date().time
        val accessTokenExpiresIn: Date = Date(now + ACCESS_TOKEN_EXPIRE_TIME)

        val member = memberRepository.findByEmail(email)

        val accessToken = Jwts.builder()
            .setSubject(member?.email) // payload "sub": "email"
            .claim(AUTHORITIES_KEY, member?.role)  // payload "auth": "ROLE_USER"
            .setExpiration(accessTokenExpiresIn) // payload "exp": 1516239022 (예시)
            .signWith(key, SignatureAlgorithm.HS512) // header "alg": "HS512"
            .compact()

        val refreshToken = Jwts.builder()
            .setSubject(member?.email)
            .claim(AUTHORITIES_KEY, member?.role)
            .setExpiration(Date(now + REFRESH_TOKEN_EXPIRE_TIME))
            .signWith(key, SignatureAlgorithm.HS512)
            .compact()

        return JwtDto(
            grantType = BEARER_TYPE,
            accessToken = accessToken,
            refreshToken = refreshToken,
            accessTokenExpiresIn = accessTokenExpiresIn.time
        )
    }

    fun resolveToken(request: HttpServletRequest): String {
        val bearerToken = request.getHeader(HttpHeaders.AUTHORIZATION)

        if (StringUtils.hasText(bearerToken) &amp;&amp; bearerToken.startsWith(AccessTokenType.BEARER.value)) {
            return bearerToken.substring(7)
        }

        return ""
    }

    fun validateAccessToken(token: String): Boolean {
        try {
            Jwts.parserBuilder().setSigningKey(key).build().parseClaimsJws(token)
            return true
        } catch (e: SecurityException) {
            println("올바르지 못한 토큰입니다.")
        } catch (e: MalformedJwtException) {
            println("올바르지 못한 토큰입니다.")
        } catch (e: ExpiredJwtException) {
            println("만료된 토큰입니다.")
        } catch (e: UnsupportedJwtException) {
            println("지원되지 않는 토큰입니다.")
        } catch (e: IllegalArgumentException) {
            println("잘못된 토큰입니다.")
        }
        return true
    }

    fun validateRefreshToken(token: String) {
        try {
            Jwts.parserBuilder().setSigningKey(key).build().parseClaimsJws(token)
        } catch (e: SecurityException) {
            println("올바르지 못한 토큰입니다.")
        } catch (e: MalformedJwtException) {
            println("올바르지 못한 토큰입니다.")
        } catch (e: ExpiredJwtException) {
            println("만료된 토큰입니다.")
        } catch (e: UnsupportedJwtException) {
            println("지원되지 않는 토큰입니다.")
        } catch (e: IllegalArgumentException) {
            println("잘못된 토큰입니다.")
        }
    }

    fun findAuthentication(accessToken: String): Authentication {
        val claims = parseClaims(accessToken)

        val authorities = mutableListOf(claims[AUTHORITIES_KEY] as String).map { role -&gt; SimpleGrantedAuthority(role) }
        val user = User(claims[Claims.SUBJECT] as String, "", authorities)

        return UsernamePasswordAuthenticationToken(user, "", authorities)
    }

    private fun parseClaims(accessToken: String): Claims {
        return try {
            Jwts.parserBuilder().setSigningKey(key).build().parseClaimsJws(accessToken).body
        } catch (e: ExpiredJwtException) {
            e.claims
        }
    }
}</code></pre>

<h4 data-ke-size="size20">ReissueRequestDto</h4>
<pre id="code_1654400399844" data-ke-language="kotlin" data-ke-type="codeblock"><code>data class ReissueRequestDto(
    val refreshToken: String
) {
}</code></pre>

<h4 data-ke-size="size20">SecurityConfig</h4>
<pre id="code_1654400416323" data-ke-language="kotlin" data-ke-type="codeblock"><code>@Configuration
class SecurityConfig(
    private val customUserDetailService: CustomUserDetailService,
    private val jwtProvider: JwtProvider
) : WebSecurityConfigurerAdapter() {

    override fun configure(http: HttpSecurity) {
        http
            .csrf {
                it.disable()
            }
            .httpBasic {
                it.disable()
            }
            .sessionManagement {
                it.sessionCreationPolicy(SessionCreationPolicy.NEVER)
            }
            .authorizeRequests {
                it.antMatchers("/auth/reissue").permitAll()
                it.antMatchers("/guest").hasRole("USER")
                it.antMatchers("/admin").hasRole("ADMIN")
            }
            .oauth2Login {
                it.userInfoEndpoint().userService(customUserDetailService)
                it.defaultSuccessUrl("/auth/login")
                it.failureUrl("/fail")
            }
            .addFilterBefore(JwtFilter(jwtProvider), UsernamePasswordAuthenticationFilter::class.java)
    }
}</code></pre>

<hr contenteditable="false" data-ke-type="horizontalRule" data-ke-style="style6">
<h2 data-ke-size="size26">실행</h2>

<p data-ke-size="size16">1. POST /auth/reissue로 접근합니다. body에는 refreshToken이 담깁니다.</p>
<figure data-ke-mobilestyle="widthOrigin" data-filename="스크린샷 2022-06-05 오후 12.40.55.png" data-origin-width="1488" data-origin-height="654">
    <span data-url="https://k.kakaocdn.net/dn/bgXNl3/btrDYLK3Ckc/Xk3yKsxgKByvPHeWEzQjD0/img.png" data-lightbox="lightbox">
        <img src="https://k.kakaocdn.net/dn/bgXNl3/btrDYLK3Ckc/Xk3yKsxgKByvPHeWEzQjD0/img.png" onerror="this.onerror=null; this.src='//t1.daumcdn.net/tistory_admin/static/images/no-image-v1.png'; this.srcset='//t1.daumcdn.net/tistory_admin/static/images/no-image-v1.png';" data-filename="스크린샷 2022-06-05 오후 12.40.55.png" data-origin-width="1488" data-origin-height="654">
    </span>
    
</figure>

<p data-ke-size="size16">이렇게 Spring Security를 이용해서 Oauth2, JWT를 구현해보았습니다.</p>

<p data-ke-size="size16">코드는 Best Practice는 아니며 예외처리, 스트링 안티 패턴 등을 활용하여서 추가 개발하시길 바랍니다.</p>

<p data-ke-size="size16">전체 코드는 <a href="https://github.com/kingbj940429/Spring-Security-Example/tree/oauth2-jwt-kotlin" target="_blank" rel="noopener">깃헙</a>에서 확인하실 수 있습니다.</p>

            
            
                </div></div>

King of Back-end

이어서 계속 구현해보겠습니다.
 
구현 자체가 목적이므로 자세한 설명을 생략합니다.
 
JWT 생성하기
JWT에 권한 추가해주기 
생성한 JWT에 대해 인증/인가 하기 
JWT 재발급 해주기 (진행)
구현
AuthController
@RestController
@RequestMapping("/auth")
class AuthController(
    private val authService: AuthService
) {
    /**
     * token 생성해서 보내주기
     */
    @GetMapping("/login")
    fun login(@AuthenticationPrincipal oAuth2User: OAuth2User): ResponseEntity<JwtDto> {
        return ResponseEntity.ok(authService.login(oAuth2User))
    }
    @PostMapping("/reissue")
    fun reissue(@RequestBody reissueRequestDto: ReissueRequestDto): ResponseEntity<JwtDto> {
        return ResponseEntity.ok(authService.reissue(reissueRequestDto))
    }
}
 
AuthService
@Service
class AuthService(
    private val memberRepository: MemberRepository,
    private val jwtProvider: JwtProvider
) {
    @Transactional
    fun login(oAuth2User: OAuth2User) : JwtDto {
        //TODO: 1. 회원이 아니라면 회원 가입을 시켜준다.
        if(!memberRepository.existsByEmail(oAuth2User.attributes["email"] as String)) {
            val member = Member(
                email = oAuth2User.attributes["email"] as String,
                role = AuthType.ROLE_USER
            )
            memberRepository.save(member)
        }
        //TODO: 2. token 을 생성해준다.
        return jwtProvider.generateJwtDto(oAuth2User.attributes["email"] as String)
    }
    @Transactional(readOnly = true)
    fun reissue(reissueRequestDto: ReissueRequestDto): JwtDto {
        jwtProvider.validateRefreshToken(reissueRequestDto.refreshToken)
        val authentication = jwtProvider.findAuthentication(reissueRequestDto.refreshToken)
        return jwtProvider.generateJwtDto(authentication.name)
    }
}
 
JwtProvider
@Component
class JwtProvider(
    private val memberRepository: MemberRepository
) {
    companion object {
        private const val AUTHORITIES_KEY = "auth"
        private const val BEARER_TYPE = "bearer"
        private const val ACCESS_TOKEN_EXPIRE_TIME = (1000 * 60 * 30)
        private const val REFRESH_TOKEN_EXPIRE_TIME = (1000 * 60 * 60 * 24 * 7)
    }
    private val key: Key by lazy {
        val secretKey: String = "ZVc3Z0g4bm5TVzRQUDJxUXBIOGRBUGtjRVg2WDl0dzVYVkMyWWs1Qlk3NkZBOXh1UzNoRWUzeTd6cVdEa0x2eQo=" // base64Encoded
        Keys.hmacShaKeyFor(Decoders.BASE64.decode(secretKey))
    }
    fun generateJwtDto(email: String) : JwtDto {
        val now = Date().time
        val accessTokenExpiresIn: Date = Date(now + ACCESS_TOKEN_EXPIRE_TIME)
        val member = memberRepository.findByEmail(email)
        val accessToken = Jwts.builder()
            .setSubject(member?.email) // payload "sub": "email"
            .claim(AUTHORITIES_KEY, member?.role)  // payload "auth": "ROLE_USER"
            .setExpiration(accessTokenExpiresIn) // payload "exp": 1516239022 (예시)
            .signWith(key, SignatureAlgorithm.HS512) // header "alg": "HS512"
            .compact()
        val refreshToken = Jwts.builder()
            .setSubject(member?.email)
            .claim(AUTHORITIES_KEY, member?.role)
            .setExpiration(Date(now + REFRESH_TOKEN_EXPIRE_TIME))
            .signWith(key, SignatureAlgorithm.HS512)
            .compact()
        return JwtDto(
            grantType = BEARER_TYPE,
            accessToken = accessToken,
            refreshToken = refreshToken,
            accessTokenExpiresIn = accessTokenExpiresIn.time
        )
    }
    fun resolveToken(request: HttpServletRequest): String {
        val bearerToken = request.getHeader(HttpHeaders.AUTHORIZATION)
        if (StringUtils.hasText(bearerToken) && bearerToken.startsWith(AccessTokenType.BEARER.value)) {
            return bearerToken.substring(7)
        }
        return ""
    }
    fun validateAccessToken(token: String): Boolean {
        try {
            Jwts.parserBuilder().setSigningKey(key).build().parseClaimsJws(token)
            return true
        } catch (e: SecurityException) {
            println("올바르지 못한 토큰입니다.")
        } catch (e: MalformedJwtException) {
            println("올바르지 못한 토큰입니다.")
        } catch (e: ExpiredJwtException) {
            println("만료된 토큰입니다.")
        } catch (e: UnsupportedJwtException) {
            println("지원되지 않는 토큰입니다.")
        } catch (e: IllegalArgumentException) {
            println("잘못된 토큰입니다.")
        }
        return true
    }
    fun validateRefreshToken(token: String) {
        try {
            Jwts.parserBuilder().setSigningKey(key).build().parseClaimsJws(token)
        } catch (e: SecurityException) {
            println("올바르지 못한 토큰입니다.")
        } catch (e: MalformedJwtException) {
            println("올바르지 못한 토큰입니다.")
        } catch (e: ExpiredJwtException) {
            println("만료된 토큰입니다.")
        } catch (e: UnsupportedJwtException) {
            println("지원되지 않는 토큰입니다.")
        } catch (e: IllegalArgumentException) {
            println("잘못된 토큰입니다.")
        }
    }
    fun findAuthentication(accessToken: String): Authentication {
        val claims = parseClaims(accessToken)
        val authorities = mutableListOf(claims[AUTHORITIES_KEY] as String).map { role -> SimpleGrantedAuthority(role) }
        val user = User(claims[Claims.SUBJECT] as String, "", authorities)
        return UsernamePasswordAuthenticationToken(user, "", authorities)
    }
    private fun parseClaims(accessToken: String): Claims {
        return try {
            Jwts.parserBuilder().setSigningKey(key).build().parseClaimsJws(accessToken).body
        } catch (e: ExpiredJwtException) {
            e.claims
        }
    }
}
 
ReissueRequestDto
data class ReissueRequestDto(
    val refreshToken: String
) {
}
 
SecurityConfig
@Configuration
class SecurityConfig(
    private val customUserDetailService: CustomUserDetailService,
    private val jwtProvider: JwtProvider
) : WebSecurityConfigurerAdapter() {
    override fun configure(http: HttpSecurity) {
        http
            .csrf {
                it.disable()
            }
            .httpBasic {
                it.disable()
            }
            .sessionManagement {
                it.sessionCreationPolicy(SessionCreationPolicy.NEVER)
            }
            .authorizeRequests {
                it.antMatchers("/auth/reissue").permitAll()
                it.antMatchers("/guest").hasRole("USER")
                it.antMatchers("/admin").hasRole("ADMIN")
            }
            .oauth2Login {
                it.userInfoEndpoint().userService(customUserDetailService)
                it.defaultSuccessUrl("/auth/login")
                it.failureUrl("/fail")
            }
            .addFilterBefore(JwtFilter(jwtProvider), UsernamePasswordAuthenticationFilter::class.java)
    }
}
 
실행
 
1. POST /auth/reissue로 접근합니다. body에는 refreshToken이 담깁니다.
 
이렇게 Spring Security를 이용해서 Oauth2, JWT를 구현해보았습니다.
 
코드는 Best Practice는 아니며 예외처리, 스트링 안티 패턴 등을 활용하여서 추가 개발하시길 바랍니다.
 
전체 코드는 깃헙에서 확인하실 수 있습니다.

[Spring] Security +Google Oauth2 + JWT 구현하기 (4) - JWT 재발급 해주기

댓글