Skip to content

[BE] SICS1-212 [FIX] cookie 저장 실패 수정 #117

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Kosw6 merged 1 commit into from
Nov 17, 2025
Merged

[BE] SICS1-212 [FIX] cookie 저장 실패 수정 #117

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions backend/src/main/java/org/sejongisc/backend/common/auth/config/OAuth2SuccessHandler.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -108,11 +108,13 @@ public void onAuthenticationSuccess(
String domain = isProd ? "sisc-web.duckdns.org" : "localhost";



// 6. HttpOnly 쿠키로 refreshToken 저장
ResponseCookie accessCookie = ResponseCookie.from("access", accessToken)
.httpOnly(true)
.secure(secure) // 로컬=false, 배포=true
.sameSite(sameSite) // 로컬= "Lax", 배포="None"
.domain(domain)
.path("/")
.maxAge(60L * 60) // 1 hour
.build();
Expand All @@ -121,6 +123,7 @@ public void onAuthenticationSuccess(
.httpOnly(true)
.secure(secure)
.sameSite(sameSite)
.domain(domain)
.path("/")
.maxAge(60L * 60 * 24 * 14) // 2 weeks
.build();
Expand Down
21 changes: 16 additions & 5 deletions backend/src/main/java/org/sejongisc/backend/common/auth/config/SecurityConfig.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@
import org.sejongisc.backend.common.auth.springsecurity.JwtAuthenticationFilter;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.env.Environment;
import org.springframework.http.HttpMethod;
import org.springframework.security.config.Customizer;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
Expand Down Expand Up @@ -38,6 +39,12 @@ public class SecurityConfig {
private final CustomOidcUserService customOidcUserService;
private final OAuth2SuccessHandler oAuth2SuccessHandler;

private final Environment env;

private boolean isProd() {
return List.of(env.getActiveProfiles()).contains("prod");
}
Comment on lines +44 to +46
Copy link

@coderabbitai coderabbitai bot Nov 17, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion | 🟠 Major

isProd() 메서드가 깔끔하게 구현되었습니다.

환경 판별 로직이 잘 캡슐화되어 있습니다. 하지만 OAuth2SuccessHandler에서 중복 구현되고 있으니, 공통 유틸리티로 추출하는 것을 고려하세요.

🤖 Prompt for AI Agents 
In
backend/src/main/java/org/sejongisc/backend/common/auth/config/SecurityConfig.java
around lines 44 to 46, the isProd() method is implemented but duplicated in
OAuth2SuccessHandler; extract this environment-check into a shared utility
(e.g.,
backend/src/main/java/org/sejongisc/backend/common/util/EnvironmentUtils.java
with a static isProd(String[] activeProfiles) or isProd(Environment env)
method), replace both SecurityConfig.isProd() and the duplicate in
OAuth2SuccessHandler to call the new utility, update imports and unit tests if
any, and remove the duplicated method from OAuth2SuccessHandler to centralize
the logic.


@Bean
public AuthorizationRequestRepository<OAuth2AuthorizationRequest> authorizationRequestRepository() {
return new HttpSessionOAuth2AuthorizationRequestRepository();
Expand All @@ -63,9 +70,13 @@ public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Excepti
}
)
.successHandler(oAuth2SuccessHandler)
.failureHandler((req, res, ex) ->
res.sendRedirect("http://localhost:5173/oauth/fail")
)
.failureHandler((req, res, ex) -> {
if (isProd()) {
res.sendRedirect("https://sisc-web.duckdns.org/oauth/fail");
} else {
res.sendRedirect("http://localhost:5173/oauth/fail");
}
})
)

.authorizeHttpRequests(auth -> {
Expand Down Expand Up @@ -110,8 +121,8 @@ public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Excepti
@Bean
public CorsConfigurationSource corsConfigurationSource() {
CorsConfiguration config = new CorsConfiguration();
config.setAllowedOrigins(List.of(
"http://localhost:5173", // 허용할 프론트 주소
config.setAllowedOriginPatterns(List.of(
"http://localhost:5173",
"https://sisc-web.duckdns.org"
));
Comment on lines +124 to 127
Copy link

@coderabbitai coderabbitai bot Nov 17, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

setAllowedOriginPatterns 사용을 확인하세요.

setAllowedOrigins에서 setAllowedOriginPatterns로 변경되었습니다. allowCredentials(true)와 함께 사용할 때 와일드카드 패턴이 필요한 경우 setAllowedOriginPatterns가 필요하지만, 여기서는 구체적인 출처만 나열하고 있습니다.

현재 구현은 정상 작동하지만, 와일드카드를 사용하지 않는다면 setAllowedOrigins를 계속 사용해도 됩니다. setAllowedOriginPatterns는 패턴 매칭 오버헤드가 약간 있을 수 있습니다.

다음 스크립트로 CORS 설정이 올바르게 작동하는지 확인하세요:

🏁 Script executed:

#!/bin/bash
# Description: 두 출처에서 CORS preflight 요청 테스트

echo "Testing localhost origin..."
curl -X OPTIONS http://localhost:8080/api/auth/login \
  -H "Origin: http://localhost:5173" \
  -H "Access-Control-Request-Method: POST" \
  -v 2>&1 | grep -i "access-control"

echo -e "\n\nTesting production origin..."
curl -X OPTIONS https://sisc-web.duckdns.org/api/auth/login \
  -H "Origin: https://sisc-web.duckdns.org" \
  -H "Access-Control-Request-Method: POST" \
  -v 2>&1 | grep -i "access-control"

Length of output: 425

로컬호스트 CORS 요청이 실패하고 있습니다. 추가 정보가 필요합니다.

🏁 Script executed:

#!/bin/bash
# SecurityConfig 파일의 전체 CORS 설정 확인

echo "=== SecurityConfig.java 전체 내용 확인 ==="
find . -name "SecurityConfig.java" -type f | head -5

echo -e "\n=== CORS 관련 설정 확인 ==="
find . -name "SecurityConfig.java" -exec grep -A 20 -B 5 "setAllowedOriginPatterns\|setAllowedOrigins\|CORS\|cors" {} +

echo -e "\n=== 프로젝트에서 CorsConfigurationSource 검색 ==="
rg -n "CorsConfigurationSource|cors" --type=java -A 3 -B 3

Length of output: 7691

🏁 Script executed:

#!/bin/bash
# 전체 SecurityConfig.java 파일 확인 및 CORS 설정 검증

echo "=== SecurityConfig.java 파일 위치 찾기 ==="
find . -name "SecurityConfig.java" -type f

echo -e "\n=== SecurityConfig.java 전체 내용 ==="
cat ./backend/src/main/java/org/sejongisc/backend/common/auth/config/SecurityConfig.java

echo -e "\n\n=== 프로젝트 전체에서 CORS 관련 설정 검색 ==="
rg -n "CorsConfigurationSource|setAllowedOrigin|allowCredentials" --type=java -B 2 -A 2

Length of output: 9264

localhost CORS 프리플라이트 요청이 실패하고 있습니다. 즉시 수정 필요.

setAllowedOriginPatterns은 와일드카드 패턴을 위한 것("*" 및 포트 범위)이며 정확한 문자열 매칭을 위한 것이 아닙니다. 현재 코드는 문자열 리터럴로 이 메서드를 사용하고 있어서 localhost 요청이 CORS 필터링을 통과하지 못합니다.

setAllowedOrigins로 되돌리세요 (라인 124-127). setAllowedOriginPatterns은 allowCredentials(true)와 함께 사용할 수 있지만, 와일드카드 패턴을 위한 것입니다. 와일드카드가 필요 없으면 setAllowedOrigins이 올바른 선택입니다:

config.setAllowedOrigins(List.of(
        "http://localhost:5173",
        "https://sisc-web.duckdns.org"
));
🤖 Prompt for AI Agents 
In
backend/src/main/java/org/sejongisc/backend/common/auth/config/SecurityConfig.java
around lines 124-127, replace the call to config.setAllowedOriginPatterns(...)
with config.setAllowedOrigins(...) using the same list of exact origin strings
("http://localhost:5173" and "https://sisc-web.duckdns.org"); update the code so
it uses setAllowedOrigins(List.of(...)) instead of setAllowedOriginPatterns to
ensure exact-origin matching for CORS preflight requests.

config.setAllowedMethods(List.of("GET", "POST", "PUT", "DELETE", "PATCH", "OPTIONS"));
Expand Down