[RestAPI 개발기] 8. JWT

1. JwtUtil 만들기

public class JwtUtil {
    public static String create(User user) {
        String jwt = JWT.create()
                .withSubject("blog")
                .withExpiresAt(new Date(System.currentTimeMillis() + 1000 * 60 * 60))
                .withClaim("id", user.getId())
                .withClaim("username", user.getUsername())
                .sign(Algorithm.HMAC512("metacoding"));
        return jwt;
    }

    public static User verify(String jwt) {
        DecodedJWT decodedJWT = JWT.require(Algorithm.HMAC512("metacoding")).build().verify(jwt);
        int id = decodedJWT.getClaim("id").asInt();
        String username = decodedJWT.getClaim("username").asString();

        return User.builder()
                .id(id)
                .username(username)
                .build();
    }
}

2. Service

 public UserResponse.TokenDTO 로그인(UserRequest.LoginDTO loginDTO) {
        User userPS = userRepository.findByUsername(loginDTO.getUsername())
                .orElseThrow(() -> new ExceptionApi401("유저네임 혹은 비밀번호가 틀렸습니다"));

        Boolean isSame = BCrypt.checkpw(loginDTO.getPassword(), userPS.getPassword());
        if (!isSame) throw new ExceptionApi401("유저네임 혹은 비밀번호가 틀렸습니다");

        // 토큰 생성
        String ascssToken = JwtUtil.create(userPS);


        return UserResponse.TokenDTO.builder().ascssToken(ascssToken).build();
    }

• 실제 DTO는 총 2개의 데이터를 담을 수 있지만, refreshToken은 잠시 사용하지 않겠다.

    @Data
    public static class TokenDTO {
        private String ascssToken;
        private String refreshToken;

        @Builder
        public TokenDTO(String ascssToken, String refreshToken) {
            this.ascssToken = ascssToken;
            this.refreshToken = refreshToken;
        }
    }

• Controller에서 DTO를 받았기 때문에 TokenDTO 타입으로 받아줬다.

    @PostMapping("/login") // login은 민간함 정보가 들어가야하기때문에 Get 말고 Post
    public @ResponseBody Resp<?> login(@Valid @RequestBody UserRequest.LoginDTO loginDTO, Errors errors, HttpServletResponse response) {
        UserResponse.TokenDTO respDTO = userService.로그인(loginDTO);
        return Resp.ok(respDTO);
    }

3. Filter에 토큰 인증 구현

• AuthorizationFilter

public class AuthorizationFilter implements Filter {
    @Override
    public void doFilter(ServletRequest req, ServletResponse resp, FilterChain chain) throws IOException, ServletException {
        HttpServletRequest request = (HttpServletRequest) req;
        HttpServletResponse response = (HttpServletResponse) resp;

        String accessToken = request.getHeader("Authorization");

        try {
            if (accessToken == null || accessToken.isBlank()) throw new RuntimeException("토큰을 전달해주세요");
            if (!accessToken.startsWith("Bearer ")) throw new RuntimeException("Bearer 프로토콜 지켜주세요");

            accessToken = accessToken.replace("Bearer ", "");

            User user = JwtUtil.verify(accessToken);

            // 토큰을 다시 검증하기 귀찮아서, 임시로 세션에 넣어둠
            HttpSession session = request.getSession();
            session.setAttribute("sessionUser", user);

            chain.doFilter(request, response);
        } catch (TokenExpiredException e1) {
            e1.printStackTrace();
            exResponse(response, "토큰이 만료되었습니다");
        } catch (JWTDecodeException | SignatureVerificationException e2) {
            e2.printStackTrace();
            exResponse(response, "토큰 검증에 실패했어요");
        } catch (RuntimeException e3) {
            e3.printStackTrace();
            exResponse(response, e3.getMessage());
        }


    }

    private void exResponse(HttpServletResponse response, String msg) throws IOException {
        response.setContentType("application/json;charset=utf-8");
        response.setStatus(401);
        PrintWriter out = response.getWriter();

        Resp<?> resp = Resp.fail(401, msg);
        String responseBody = new ObjectMapper().writeValueAsString(resp);
        out.println(responseBody);
    }
}

• FilterConfig

@RequiredArgsConstructor
@Configuration
public class FilterConfig {

    private final UserRepository userRepository;

    @Bean
    public FilterRegistrationBean<AuthorizationFilter> authorizationFilter() {
        FilterRegistrationBean<AuthorizationFilter> registrationBean = new FilterRegistrationBean<>();
        registrationBean.setFilter(new AuthorizationFilter());
        registrationBean.addUrlPatterns("/s/*"); // 모든 요청에 적용
        registrationBean.setOrder(2); // 필터 순서 설정
        return registrationBean;
    }

    @Bean
    public FilterRegistrationBean<LogFilter> loggingFilter() {
        FilterRegistrationBean<LogFilter> registrationBean = new FilterRegistrationBean<>();
        registrationBean.setFilter(new LogFilter(userRepository));
        registrationBean.addUrlPatterns("/*"); // 모든 요청에 적용
        registrationBean.setOrder(1); // 필터 순서 설정
        return registrationBean;
    }
}

• 프로젝트를 실행하여 POSTMAN을 이용하여 정상 작동하는지 확인