[설정] localhost login 가능하게 수정

src/main/java/com/alist/api/common/utils/SessionUtil.java

@@ -5,13 +5,13 @@ import org.springframework.http.ResponseCookie;
 
 public class SessionUtil {
     // 쿠키 삭제
-    public static void expireCookie(HttpServletResponse response, String name, String cookieDomain, boolean cookieSecure) {
+    public static void expireCookie(HttpServletResponse response, String name, String cookieDomain, boolean cookieSecure, String cookieSameSite) {
         ResponseCookie cookie = ResponseCookie.from(name, "")
                 .domain(cookieDomain)
                 .path("/")
                 .httpOnly(true)
                 .secure(cookieSecure)
-                .sameSite("Lax")
+                .sameSite(cookieSameSite)
                 .maxAge(0)
                 .build();
 
@@ -19,13 +19,13 @@ public class SessionUtil {
     }
 
     // 쿠키 입력
-    public static void addTokenCookie(HttpServletResponse response, String name, String value, String cookieDomain, boolean cookieSecure, long maxAgeSeconds) {
+    public static void addTokenCookie(HttpServletResponse response, String name, String value, String cookieDomain, boolean cookieSecure, String cookieSameSite, long maxAgeSeconds) {
         ResponseCookie cookie = ResponseCookie.from(name, value)
                 .domain(cookieDomain)
                 .path("/")
                 .httpOnly(true)
                 .secure(cookieSecure)
-                .sameSite("Lax")
+                .sameSite(cookieSameSite)
                 .maxAge(maxAgeSeconds)
                 .build();
         response.addHeader("Set-Cookie", cookie.toString());

src/main/java/com/alist/api/config/RedisSessionConfig.java

@@ -20,6 +20,9 @@ public class RedisSessionConfig {
     @Value("${cookie.name}")
     private String cookieName;
 
+    @Value("${cookie.same-site:Lax}")
+    private String cookieSameSite;
+
     @Bean
     public CookieSerializer cookieSerializer() {
         DefaultCookieSerializer serializer = new DefaultCookieSerializer();
@@ -30,7 +33,7 @@ public class RedisSessionConfig {
         serializer.setCookiePath("/");
         serializer.setUseSecureCookie(cookieSecure);  // 환경별 설정 (local: false, pjt: true)
         serializer.setUseHttpOnlyCookie(true);  // XSS 방지
-        serializer.setSameSite("Lax");  // CSRF 방지
+        serializer.setSameSite(cookieSameSite);  // CSRF 방지
 
         if (cookieDomain != null && !cookieDomain.isBlank()) {
             serializer.setDomainName(cookieDomain.trim());

src/main/java/com/alist/api/modules/auth/AuthController.java

@@ -37,6 +37,9 @@ public class AuthController {
 	@Value("${cookie.name}")
 	private String cookieName;
 
+	@Value("${cookie.same-site:Lax}")
+	private String cookieSameSite;
+
 	@Value("${jwt.access-token-validity-seconds}")
 	private long accessTokenValiditySeconds;
 
@@ -79,8 +82,8 @@ public class AuthController {
 			return ApiResponse.entity(Map.of("refreshed", false), ApiResponseCode.CODE_401);
 		}
 
-		SessionUtil.addTokenCookie(response, "accessToken", testLogin.getAccessToken(), cookieDomain, cookieSecure, accessTokenValiditySeconds);
+		SessionUtil.addTokenCookie(response, "accessToken", testLogin.getAccessToken(), cookieDomain, cookieSecure, cookieSameSite, accessTokenValiditySeconds);
-		SessionUtil.addTokenCookie(response, "refreshToken", testLogin.getRefreshToken(), cookieDomain, cookieSecure, refreshTokenValiditySeconds);
+		SessionUtil.addTokenCookie(response, "refreshToken", testLogin.getRefreshToken(), cookieDomain, cookieSecure, cookieSameSite, refreshTokenValiditySeconds);
 
 		return ApiResponse.entity(Map.of("refreshed", true), ApiResponseCode.CODE_200);
 	}
@@ -133,9 +136,9 @@ public class AuthController {
 
 		testAuthService.clearRefreshToken(refreshToken);
 
-		SessionUtil.expireCookie(response, cookieName, cookieDomain, cookieSecure);
+		SessionUtil.expireCookie(response, cookieName, cookieDomain, cookieSecure, cookieSameSite);
-		SessionUtil.expireCookie(response, "accessToken", cookieDomain, cookieSecure);
+		SessionUtil.expireCookie(response, "accessToken", cookieDomain, cookieSecure, cookieSameSite);
-		SessionUtil.expireCookie(response, "refreshToken", cookieDomain, cookieSecure);
+		SessionUtil.expireCookie(response, "refreshToken", cookieDomain, cookieSecure, cookieSameSite);
 
 		Map<String, Object> result = new HashMap<>();
 		result.put("message", "로그아웃되었습니다.");

src/main/java/com/alist/api/modules/auth/TestAuthController.java

@@ -27,6 +27,9 @@ public class TestAuthController {
 	@Value("${cookie.domain}")
 	private String cookieDomain;
 
+	@Value("${cookie.same-site:Lax}")
+	private String cookieSameSite;
+
 	@Value("${jwt.access-token-validity-seconds}")
 	private long accessTokenValiditySeconds;
 
@@ -60,10 +63,10 @@ public class TestAuthController {
 		session.setAttribute("userRole", "USER");
 
 		// accessToken 쿠키 설정
-		SessionUtil.addTokenCookie(response, "accessToken", testLoginDto.getAccessToken(), cookieDomain, cookieSecure, accessTokenValiditySeconds);
+		SessionUtil.addTokenCookie(response, "accessToken", testLoginDto.getAccessToken(), cookieDomain, cookieSecure, cookieSameSite, accessTokenValiditySeconds);
 
 		// refreshToken 쿠키 설정
-		SessionUtil.addTokenCookie(response, "refreshToken", testLoginDto.getRefreshToken(), cookieDomain, cookieSecure, refreshTokenValiditySeconds);
+		SessionUtil.addTokenCookie(response, "refreshToken", testLoginDto.getRefreshToken(), cookieDomain, cookieSecure, cookieSameSite, refreshTokenValiditySeconds);
 
 		// JSON 응답에서는 토큰 제거 (쿠키로만 전달)
 		testLoginDto.setAccessToken(null);

src/main/resources/application-local.yaml

@@ -36,6 +36,7 @@ cookie:
   secure: false  # 로컬 개발 환경 (HTTP)
   domain:
   name: ALIST_SESSION
+  same-site: Lax
 
 swagger:
   login:

src/main/resources/application-pjt.yaml

@@ -36,8 +36,9 @@ jwt:
 
 cookie:
   secure: true  # 프로젝트 환경 (HTTPS)
-  domain: # pjt.kr # sso 인증시 주석해제
+  domain: pjt.kr # sso 인증시 주석해제
   name: ALIST_SESSION
+  same-site: None
 
 swagger:
   login: