From 2103183bf51bc0c8906741d72609c866445d4393 Mon Sep 17 00:00:00 2001
From: sdw086 <sdw086@gmail.com>
Date: Tue, 10 Mar 2026 15:10:32 +0900
Subject: [PATCH] =?UTF-8?q?[=EC=84=A4=EC=A0=95]=20SSO=20ON=20OFF=20?=
 =?UTF-8?q?=EC=B6=94=EA=B0=80?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../com/alist/api/config/SecurityConfig.java  | 25 ++++++++++++++++---
 src/main/resources/application-local.yaml     |  4 +++
 src/main/resources/application-pjt.yaml       |  4 +++
 3 files changed, 30 insertions(+), 3 deletions(-)

diff --git a/src/main/java/com/alist/api/config/SecurityConfig.java b/src/main/java/com/alist/api/config/SecurityConfig.java
index 9ef5367..fea3658 100644
--- a/src/main/java/com/alist/api/config/SecurityConfig.java
+++ b/src/main/java/com/alist/api/config/SecurityConfig.java
@@ -31,6 +31,9 @@ public class SecurityConfig {
 	@Value("${swagger.login.password}")
 	private String swaggerLoginPassword;
 
+	@Value("${app.sso.enabled:true}")
+	private boolean ssoEnabled;
+
 	@Bean
 	public JwtAuthenticationFilter jwtAuthenticationFilter(JwtTokenProvider jwtTokenProvider) {
 		return new JwtAuthenticationFilter(jwtTokenProvider);
@@ -53,9 +56,25 @@ public class SecurityConfig {
 	public SecurityFilterChain apiFilterChain(HttpSecurity http, JwtAuthenticationFilter jwtAuthenticationFilter) throws Exception {
 		http
 				.cors(Customizer.withDefaults())
-				.csrf(csrf -> csrf.disable())
-				// SSO를 위해 Spring Session 사용 (sessionManagement 설정 제거하여 기본값 사용)
-				.exceptionHandling(ex -> ex
+				.csrf(csrf -> csrf.disable());
+
+		if (!ssoEnabled) {
+			log.warn("SSO disabled mode enabled. Limited endpoints are opened for development.");
+			http
+					.authorizeHttpRequests(auth -> auth
+							.requestMatchers(
+									"/",
+									"/actuator/health",
+									"/auth/**",
+									"/test/**",
+									"/files/**"
+							).permitAll()
+							.anyRequest().authenticated()
+					);
+			return http.build();
+		}
+
+		http		.exceptionHandling(ex -> ex
 						.authenticationEntryPoint(new JwtAuthenticationEntryPoint())
 						.accessDeniedHandler(new JwtAccessDeniedHandler())
 				)
diff --git a/src/main/resources/application-local.yaml b/src/main/resources/application-local.yaml
index 355e3fd..30c05ff 100644
--- a/src/main/resources/application-local.yaml
+++ b/src/main/resources/application-local.yaml
@@ -37,6 +37,10 @@ cookie:
   domain:
   name: ALIST_SESSION
 
+app:
+  sso:
+    enabled: false
+
 swagger:
   login:
     id: alist
diff --git a/src/main/resources/application-pjt.yaml b/src/main/resources/application-pjt.yaml
index 2a536bd..c558023 100644
--- a/src/main/resources/application-pjt.yaml
+++ b/src/main/resources/application-pjt.yaml
@@ -39,6 +39,10 @@ cookie:
   domain: pjt.kr
   name: ALIST_SESSION
 
+app:
+  sso:
+    enabled: ${SSO_ENABLED:true}
+
 swagger:
   login:
     id: ${SWAGGER_ID}