From 961ea80060cdd813c24002a7b900abf98c4ff188 Mon Sep 17 00:00:00 2001 From: sdw086 Date: Tue, 10 Mar 2026 16:15:21 +0900 Subject: [PATCH] =?UTF-8?q?[=EC=84=A4=EC=A0=95]=20localhost=20login=20?= =?UTF-8?q?=EA=B0=80=EB=8A=A5=ED=95=98=EA=B2=8C=20=EC=88=98=EC=A0=95?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../com/alist/api/common/utils/SessionUtil.java | 8 ++++---- .../com/alist/api/config/RedisSessionConfig.java | 5 ++++- .../com/alist/api/modules/auth/AuthController.java | 13 ++++++++----- .../alist/api/modules/auth/TestAuthController.java | 7 +++++-- src/main/resources/application-local.yaml | 1 + src/main/resources/application-pjt.yaml | 3 ++- 6 files changed, 24 insertions(+), 13 deletions(-) diff --git a/src/main/java/com/alist/api/common/utils/SessionUtil.java b/src/main/java/com/alist/api/common/utils/SessionUtil.java index 15ed22c..586b098 100644 --- a/src/main/java/com/alist/api/common/utils/SessionUtil.java +++ b/src/main/java/com/alist/api/common/utils/SessionUtil.java @@ -5,13 +5,13 @@ import org.springframework.http.ResponseCookie; public class SessionUtil { // 쿠키 삭제 - public static void expireCookie(HttpServletResponse response, String name, String cookieDomain, boolean cookieSecure) { + public static void expireCookie(HttpServletResponse response, String name, String cookieDomain, boolean cookieSecure, String cookieSameSite) { ResponseCookie cookie = ResponseCookie.from(name, "") .domain(cookieDomain) .path("/") .httpOnly(true) .secure(cookieSecure) - .sameSite("Lax") + .sameSite(cookieSameSite) .maxAge(0) .build(); @@ -19,13 +19,13 @@ public class SessionUtil { } // 쿠키 입력 - public static void addTokenCookie(HttpServletResponse response, String name, String value, String cookieDomain, boolean cookieSecure, long maxAgeSeconds) { + public static void addTokenCookie(HttpServletResponse response, String name, String value, String cookieDomain, boolean cookieSecure, String cookieSameSite, long maxAgeSeconds) { ResponseCookie cookie = ResponseCookie.from(name, value) .domain(cookieDomain) .path("/") .httpOnly(true) .secure(cookieSecure) - .sameSite("Lax") + .sameSite(cookieSameSite) .maxAge(maxAgeSeconds) .build(); response.addHeader("Set-Cookie", cookie.toString()); diff --git a/src/main/java/com/alist/api/config/RedisSessionConfig.java b/src/main/java/com/alist/api/config/RedisSessionConfig.java index 07fd120..b922cd1 100644 --- a/src/main/java/com/alist/api/config/RedisSessionConfig.java +++ b/src/main/java/com/alist/api/config/RedisSessionConfig.java @@ -20,6 +20,9 @@ public class RedisSessionConfig { @Value("${cookie.name}") private String cookieName; + @Value("${cookie.same-site:Lax}") + private String cookieSameSite; + @Bean public CookieSerializer cookieSerializer() { DefaultCookieSerializer serializer = new DefaultCookieSerializer(); @@ -30,7 +33,7 @@ public class RedisSessionConfig { serializer.setCookiePath("/"); serializer.setUseSecureCookie(cookieSecure); // 환경별 설정 (local: false, pjt: true) serializer.setUseHttpOnlyCookie(true); // XSS 방지 - serializer.setSameSite("Lax"); // CSRF 방지 + serializer.setSameSite(cookieSameSite); // CSRF 방지 if (cookieDomain != null && !cookieDomain.isBlank()) { serializer.setDomainName(cookieDomain.trim()); diff --git a/src/main/java/com/alist/api/modules/auth/AuthController.java b/src/main/java/com/alist/api/modules/auth/AuthController.java index f1083a6..af77480 100644 --- a/src/main/java/com/alist/api/modules/auth/AuthController.java +++ b/src/main/java/com/alist/api/modules/auth/AuthController.java @@ -37,6 +37,9 @@ public class AuthController { @Value("${cookie.name}") private String cookieName; + @Value("${cookie.same-site:Lax}") + private String cookieSameSite; + @Value("${jwt.access-token-validity-seconds}") private long accessTokenValiditySeconds; @@ -79,8 +82,8 @@ public class AuthController { return ApiResponse.entity(Map.of("refreshed", false), ApiResponseCode.CODE_401); } - SessionUtil.addTokenCookie(response, "accessToken", testLogin.getAccessToken(), cookieDomain, cookieSecure, accessTokenValiditySeconds); - SessionUtil.addTokenCookie(response, "refreshToken", testLogin.getRefreshToken(), cookieDomain, cookieSecure, refreshTokenValiditySeconds); + SessionUtil.addTokenCookie(response, "accessToken", testLogin.getAccessToken(), cookieDomain, cookieSecure, cookieSameSite, accessTokenValiditySeconds); + SessionUtil.addTokenCookie(response, "refreshToken", testLogin.getRefreshToken(), cookieDomain, cookieSecure, cookieSameSite, refreshTokenValiditySeconds); return ApiResponse.entity(Map.of("refreshed", true), ApiResponseCode.CODE_200); } @@ -133,9 +136,9 @@ public class AuthController { testAuthService.clearRefreshToken(refreshToken); - SessionUtil.expireCookie(response, cookieName, cookieDomain, cookieSecure); - SessionUtil.expireCookie(response, "accessToken", cookieDomain, cookieSecure); - SessionUtil.expireCookie(response, "refreshToken", cookieDomain, cookieSecure); + SessionUtil.expireCookie(response, cookieName, cookieDomain, cookieSecure, cookieSameSite); + SessionUtil.expireCookie(response, "accessToken", cookieDomain, cookieSecure, cookieSameSite); + SessionUtil.expireCookie(response, "refreshToken", cookieDomain, cookieSecure, cookieSameSite); Map result = new HashMap<>(); result.put("message", "로그아웃되었습니다."); diff --git a/src/main/java/com/alist/api/modules/auth/TestAuthController.java b/src/main/java/com/alist/api/modules/auth/TestAuthController.java index f831433..a6ce920 100644 --- a/src/main/java/com/alist/api/modules/auth/TestAuthController.java +++ b/src/main/java/com/alist/api/modules/auth/TestAuthController.java @@ -27,6 +27,9 @@ public class TestAuthController { @Value("${cookie.domain}") private String cookieDomain; + @Value("${cookie.same-site:Lax}") + private String cookieSameSite; + @Value("${jwt.access-token-validity-seconds}") private long accessTokenValiditySeconds; @@ -60,10 +63,10 @@ public class TestAuthController { session.setAttribute("userRole", "USER"); // accessToken 쿠키 설정 - SessionUtil.addTokenCookie(response, "accessToken", testLoginDto.getAccessToken(), cookieDomain, cookieSecure, accessTokenValiditySeconds); + SessionUtil.addTokenCookie(response, "accessToken", testLoginDto.getAccessToken(), cookieDomain, cookieSecure, cookieSameSite, accessTokenValiditySeconds); // refreshToken 쿠키 설정 - SessionUtil.addTokenCookie(response, "refreshToken", testLoginDto.getRefreshToken(), cookieDomain, cookieSecure, refreshTokenValiditySeconds); + SessionUtil.addTokenCookie(response, "refreshToken", testLoginDto.getRefreshToken(), cookieDomain, cookieSecure, cookieSameSite, refreshTokenValiditySeconds); // JSON 응답에서는 토큰 제거 (쿠키로만 전달) testLoginDto.setAccessToken(null); diff --git a/src/main/resources/application-local.yaml b/src/main/resources/application-local.yaml index 355e3fd..165b919 100644 --- a/src/main/resources/application-local.yaml +++ b/src/main/resources/application-local.yaml @@ -36,6 +36,7 @@ cookie: secure: false # 로컬 개발 환경 (HTTP) domain: name: ALIST_SESSION + same-site: Lax swagger: login: diff --git a/src/main/resources/application-pjt.yaml b/src/main/resources/application-pjt.yaml index f231243..568b8d5 100644 --- a/src/main/resources/application-pjt.yaml +++ b/src/main/resources/application-pjt.yaml @@ -36,8 +36,9 @@ jwt: cookie: secure: true # 프로젝트 환경 (HTTPS) - domain: # pjt.kr # sso 인증시 주석해제 + domain: pjt.kr # sso 인증시 주석해제 name: ALIST_SESSION + same-site: None swagger: login: