\uc2a4\ud504\ub9c1 \ubd80\ud2b8(Spring Boot)\ub294 Java \uae30\ubc18 \uc6f9 \uc560\ud50c\ub9ac\ucf00\uc774\uc158\uc744 \uc190\uc27d\uac8c \uac1c\ubc1c\ud560 \uc218 \uc788\ub3c4\ub85d \ub3c4\uc640\uc8fc\ub294 \ud504\ub808\uc784\uc6cc\ud06c\uc785\ub2c8\ub2e4. \ucd5c\uadfc \ub4e4\uc5b4 \uc6f9 \uc560\ud50c\ub9ac\ucf00\uc774\uc158\uc5d0 \ub300\ud55c \uc218\uc694\uac00 \uae09\uc99d\ud558\uba74\uc11c, \ubcf4\uc548 \ubc0f \uc778\uc99d\uc5d0 \ub300\ud55c \uc774\ud574\uac00 \uc911\uc694\ud574\uc84c\uc2b5\ub2c8\ub2e4. \uc774 \uac15\uc88c\uc5d0\uc11c\ub294 JSON Web Token(JWT)\uc744 \uc0ac\uc6a9\ud558\uc5ec \ub85c\uadf8\uc778 \ubc0f \ub85c\uadf8\uc544\uc6c3 \uae30\ub2a5\uc744 \uad6c\ud604\ud558\uace0, \ud544\ud130\ub97c \ud1b5\ud574 JWT \ud1a0\ud070\uc744 \uac80\uc99d\ud558\ub294 \ubc29\ubc95\uc744 \uc54c\uc544\ubcf4\uaca0\uc2b5\ub2c8\ub2e4. \uc774 \uacfc\uc815\uc5d0\uc11c \uc2a4\ud504\ub9c1 \ubd80\ud2b8\uc758 \ub2e4\uc591\ud55c \uae30\ub2a5\uc744 \ud65c\uc6a9\ud558\uc5ec \ub354 \uc548\uc804\ud558\uace0 \ud6a8\uc728\uc801\uc778 \ubc31\uc5d4\ub4dc \uc560\ud50c\ub9ac\ucf00\uc774\uc158\uc744 \uad6c\ucd95\ud558\ub294 \ubc95\uc744 \ubc30\uc6b0\uac8c \ub420 \uac83\uc785\ub2c8\ub2e4.<\/p>\n
JSON Web Token(JWT)\uc740 \ub450 \uac1c\uc758 \uc5d4\ud2f0\ud2f0 \uac04\uc5d0 \uc815\ubcf4\ub97c \uc548\uc804\ud558\uac8c \uc804\uc1a1\ud558\uae30 \uc704\ud574 \uc0ac\uc6a9\ud558\ub294 JSON \uae30\ubc18\uc758 \uc624\ube0c\uc81d\ud2b8\uc785\ub2c8\ub2e4. JWT\ub294 \uc0ac\uc6a9\uc790 \uc778\uc99d\ubfd0\ub9cc \uc544\ub2c8\ub77c, \ud074\ub808\uc784 \uae30\ubc18\uc758 \uc815\ubcf4 \uc804\uc1a1\uc744 \uc704\ud55c \ud45c\uc900\uc73c\ub85c \uc790\ub9ac \uc7a1\uace0 \uc788\uc2b5\ub2c8\ub2e4. JWT\ub294 \ub2e4\uc74c\uacfc \uac19\uc774 \uc138 \uac00\uc9c0 \uad6c\uc131 \uc694\uc18c\ub85c \ub098\ub269\ub2c8\ub2e4:<\/p>\n
\uc2a4\ud504\ub9c1 \ubd80\ud2b8 \ud504\ub85c\uc81d\ud2b8\ub97c \uc2dc\uc791\ud558\ub824\uba74 \uae30\ubcf8\uc801\uc778 \uc124\uc815\ubd80\ud130 \ud574\uc57c \ud569\ub2c8\ub2e4. \uc774\ub7ec\ud55c \uc124\uc815\uc744 \uc704\ud574 \uc2a4\ud504\ub9c1 \uc774\ub2c8\uc15c\ub77c\uc774\uc800(Spring Initializr)\ub97c \uc774\uc6a9\ud560 \uc218 \uc788\uc2b5\ub2c8\ub2e4. \ud504\ub85c\uc81d\ud2b8 \uc0dd\uc131 \uc2dc \uc120\ud0dd\ud574\uc57c \ud560 \uc0ac\ud56d\uc740 \ub2e4\uc74c\uacfc \uac19\uc2b5\ub2c8\ub2e4:<\/p>\n
\ud504\ub85c\uc81d\ud2b8\uac00 \uc0dd\uc131\ub418\uba74 IDE\uc5d0\uc11c \uc5f4\uace0, \ud544\uc694\ud55c \uc758\uc874\uc131\uc744 \ucd94\uac00\ud560 \uc218 \uc788\uc2b5\ub2c8\ub2e4.<\/p>\n
\uc6b0\uc120 \uc720\uc800(User) \uc5d4\ud2f0\ud2f0\ub97c \uc815\uc758\ud574\uc57c \ud569\ub2c8\ub2e4. \uac04\ub2e8\ud55c User \uc5d4\ud2f0\ud2f0\ub294 \uc0ac\uc6a9\uc790 \uc815\ubcf4\ub97c \uc800\uc7a5\ud558\ub294 \ud074\ub798\uc2a4\uc785\ub2c8\ub2e4. \uc774\ub97c \ud1b5\ud574 \uc6b0\ub9ac\ub294 \ub370\uc774\ud130\ubca0\uc774\uc2a4\uc640 \uc0c1\ud638\uc791\uc6a9\ud560 \uc218 \uc788\uc2b5\ub2c8\ub2e4.<\/p>\n
package com.example.demo.entity;\n\nimport javax.persistence.Entity;\nimport javax.persistence.GeneratedValue;\nimport javax.persistence.GenerationType;\nimport javax.persistence.Id;\n\n@Entity\npublic class User {\n @Id\n @GeneratedValue(strategy = GenerationType.IDENTITY)\n private Long id;\n private String username;\n private String password;\n \n \/\/ Getters and Setters\n}\n<\/code><\/pre>\n\ub9ac\ud3ec\uc9c0\ud1a0\ub9ac\ub294 \uc5d4\ud2f0\ud2f0\uc640 \ub370\uc774\ud130\ubca0\uc774\uc2a4\uc758 CRUD \uc791\uc5c5\uc744 \uc218\ud589\ud558\ub294 \ub370 \ud544\uc694\ud569\ub2c8\ub2e4.<\/p>\n
package com.example.demo.repository;\n\nimport com.example.demo.entity.User;\nimport org.springframework.data.jpa.repository.JpaRepository;\n\npublic interface UserRepository extends JpaRepository<User, Long> {\n User findByUsername(String username);\n}\n<\/code><\/pre>\n5. \uc11c\ube44\uc2a4 \ud074\ub798\uc2a4 \uc0dd\uc131\ud558\uae30<\/h2>\n
\ube44\uc988\ub2c8\uc2a4 \ub85c\uc9c1\uc744 \ucc98\ub9ac\ud558\ub294 \uc11c\ube44\uc2a4 \ud074\ub798\uc2a4\uac00 \ud544\uc694\ud569\ub2c8\ub2e4. \uc774 \ud074\ub798\uc2a4\uc5d0\uc11c\ub294 \uc0ac\uc6a9\uc790 \ub4f1\ub85d, \ub85c\uadf8\uc778 \ub4f1\uc758 \uae30\ub2a5\uc744 \uad6c\ud604\ud569\ub2c8\ub2e4.<\/p>\n
package com.example.demo.service;\n\nimport com.example.demo.entity.User;\nimport com.example.demo.repository.UserRepository;\nimport org.springframework.beans.factory.annotation.Autowired;\nimport org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;\nimport org.springframework.stereotype.Service;\n\n@Service\npublic class UserService {\n @Autowired\n private UserRepository userRepository;\n\n @Autowired\n private BCryptPasswordEncoder passwordEncoder;\n \n public User register(User user) {\n user.setPassword(passwordEncoder.encode(user.getPassword()));\n return userRepository.save(user);\n }\n \n public User findUserByUsername(String username) {\n return userRepository.findByUsername(username);\n }\n}\n<\/code><\/pre>\n6. \ubcf4\uc548 \uc124\uc815 \ubc0f JWT \uc0dd\uc131\ud558\uae30<\/h2>\n
\uc2a4\ud504\ub9c1 \uc2dc\ud050\ub9ac\ud2f0\ub97c \uc0ac\uc6a9\ud558\uc5ec \uc560\ud50c\ub9ac\ucf00\uc774\uc158\uc758 \ubcf4\uc548\uc744 \uac15\ud654\ud560 \uc218 \uc788\uc2b5\ub2c8\ub2e4. \uc774\ub97c \uc704\ud574 SecurityConfig \ud074\ub798\uc2a4\ub97c \uc0dd\uc131\ud558\uace0, JWT \ud1a0\ud070\uc744 \uc0dd\uc131\ud558\ub294 \ud074\ub798\uc2a4\ub97c \ucd94\uac00\ud574\uc57c \ud569\ub2c8\ub2e4.<\/p>\n
package com.example.demo.config;\n\nimport com.example.demo.security.JwtAuthenticationFilter;\nimport org.springframework.beans.factory.annotation.Autowired;\nimport org.springframework.context.annotation.Bean;\nimport org.springframework.context.annotation.Configuration;\nimport org.springframework.security.authentication.AuthenticationManager;\nimport org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;\nimport org.springframework.security.config.annotation.web.builders.HttpSecurity;\nimport org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;\nimport org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;\nimport org.springframework.security.config.annotation.web.configuration.EnableGlobalMethodSecurity;\nimport org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;\nimport org.springframework.security.crypto.password.PasswordEncoder;\nimport org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;\n\n@Configuration\n@EnableWebSecurity\n@EnableGlobalMethodSecurity(prePostEnabled = true)\npublic class SecurityConfig extends WebSecurityConfigurerAdapter {\n \n @Autowired\n private JwtAuthenticationFilter jwtAuthenticationFilter;\n\n @Override\n protected void configure(HttpSecurity http) throws Exception {\n http.csrf().disable()\n .authorizeRequests()\n .antMatchers(\"\/api\/auth\/**\").permitAll()\n .anyRequest().authenticated()\n .and()\n .addFilterBefore(jwtAuthenticationFilter, UsernamePasswordAuthenticationFilter.class);\n }\n\n @Bean\n public PasswordEncoder passwordEncoder() {\n return new BCryptPasswordEncoder();\n }\n}\n<\/code><\/pre>\n7. JWT \uc0dd\uc131 \ubc0f \uac80\uc99d \uad6c\ud604\ud558\uae30<\/h2>\n
\ub85c\uadf8\uc778 \uc2dc \uc0ac\uc6a9\uc790\uc758 \uc815\ubcf4\ub97c \ubc14\ud0d5\uc73c\ub85c JWT\ub97c \uc0dd\uc131\ud558\uc5ec \ud074\ub77c\uc774\uc5b8\ud2b8\uc5d0 \uc804\ub2ec\ud569\ub2c8\ub2e4. \uc774\ub97c \uc704\ud574 JWT \uc720\ud2f8\ub9ac\ud2f0 \ud074\ub798\uc2a4\ub97c \uc0dd\uc131\ud558\uc5ec \ud1a0\ud070 \uc0dd\uc131 \ubc0f \uac80\uc99d \uc791\uc5c5\uc744 \uc218\ud589\ud569\ub2c8\ub2e4.<\/p>\n
package com.example.demo.security;\n\nimport io.jsonwebtoken.Claims;\nimport io.jsonwebtoken.Jwts;\nimport io.jsonwebtoken.SignatureAlgorithm;\nimport org.springframework.stereotype.Component;\n\nimport java.util.Date;\nimport java.util.HashMap;\nimport java.util.Map;\n\n@Component\npublic class JwtUtil {\n \n private final String SECRET_KEY = \"secret_key\";\n private final long EXPIRATION_TIME = 86400000; \/\/ 1 day\n\n public String generateToken(String username) {\n Map<String, Object> claims = new HashMap<>();\n return createToken(claims, username);\n }\n\n private String createToken(Map<String, Object> claims, String subject) {\n return Jwts.builder()\n .setClaims(claims)\n .setSubject(subject)\n .setIssuedAt(new Date(System.currentTimeMillis()))\n .setExpiration(new Date(System.currentTimeMillis() + EXPIRATION_TIME))\n .signWith(SignatureAlgorithm.HS256, SECRET_KEY)\n .compact();\n }\n\n public boolean validateToken(String token, String username) {\n final String extractedUsername = extractUsername(token);\n return (extractedUsername.equals(username) && !isTokenExpired(token));\n }\n\n private boolean isTokenExpired(String token) {\n return extractExpiration(token).before(new Date());\n }\n\n private Date extractExpiration(String token) {\n return Jwts.parser().setSigningKey(SECRET_KEY).parseClaimsJws(token).getBody().getExpiration();\n }\n\n public String extractUsername(String token) {\n return Jwts.parser().setSigningKey(SECRET_KEY).parseClaimsJws(token).getBody().getSubject();\n }\n}\n<\/code><\/pre>\n8. \ub85c\uadf8\uc778 \ubc0f \ub85c\uadf8\uc544\uc6c3 \uae30\ub2a5 \uad6c\ud604\ud558\uae30<\/h2>\n
\uc774\uc81c \uc0ac\uc6a9\uc790\uac00 \ub85c\uadf8\uc778\ud558\uba74 JWT\ub97c \ubc1c\uae09\ubc1b\uace0, \ub85c\uadf8\uc544\uc6c3 \uc2dc\uc5d0\ub294 \ud074\ub77c\uc774\uc5b8\ud2b8\uac00 \ud1a0\ud070\uc744 \uc0ad\uc81c\ud558\ub294 \ubc29\uc2dd\uc73c\ub85c \uad6c\ud604\ud569\ub2c8\ub2e4. \uc544\ub798\ub294 \ub85c\uadf8\uc778 API\uc758 \uc608\uc2dc\uc785\ub2c8\ub2e4.<\/p>\n
package com.example.demo.controller;\n\nimport com.example.demo.entity.User;\nimport com.example.demo.security.JwtUtil;\nimport com.example.demo.service.UserService;\nimport org.springframework.beans.factory.annotation.Autowired;\nimport org.springframework.http.ResponseEntity;\nimport org.springframework.web.bind.annotation.*;\n\n@RestController\n@RequestMapping(\"\/api\/auth\")\npublic class AuthController {\n\n @Autowired\n private UserService userService;\n\n @Autowired\n private JwtUtil jwtUtil;\n\n @PostMapping(\"\/login\")\n public ResponseEntity<String> login(@RequestBody User user) {\n User foundUser = userService.findUserByUsername(user.getUsername());\n if (foundUser != null && passwordEncoder.matches(user.getPassword(), foundUser.getPassword())) {\n return ResponseEntity.ok(jwtUtil.generateToken(foundUser.getUsername()));\n }\n return ResponseEntity.status(HttpStatus.UNAUTHORIZED).body(\"Invalid credentials\");\n }\n\n @PostMapping(\"\/logout\")\n public ResponseEntity<String> logout() {\n \/\/ \ub85c\uadf8\uc544\uc6c3 \uae30\ub2a5\uc740 \ud074\ub77c\uc774\uc5b8\ud2b8 \uce21\uc5d0\uc11c \uad6c\ud604\ud558\ub3c4\ub85d \ud569\ub2c8\ub2e4.\n return ResponseEntity.ok(\"Successfully logged out.\");\n }\n}\n<\/code><\/pre>\n9. JWT \ud544\ud130 \uad6c\ud604\ud558\uae30<\/h2>\n
JWT \ud544\ud130\ub97c \uad6c\ud604\ud558\uc5ec \ubaa8\ub4e0 \uc694\uccad\uc5d0\uc11c JWT\ub97c \uac80\uc99d\ud558\uace0, \uc778\uc99d\uc744 \ucc98\ub9ac\ud558\ub294 \uacfc\uc815\uc774 \ud544\uc694\ud569\ub2c8\ub2e4. \uc774\ub97c \uc704\ud574 JwtAuthenticationFilter \ud074\ub798\uc2a4\ub97c \uc0dd\uc131\ud569\ub2c8\ub2e4.<\/p>\n
package com.example.demo.security;\n\nimport io.jsonwebtoken.ExpiredJwtException;\nimport org.springframework.beans.factory.annotation.Autowired;\nimport org.springframework.security.authentication.UsernamePasswordAuthenticationToken;\nimport org.springframework.security.core.Authentication;\nimport org.springframework.security.core.context.SecurityContextHolder;\nimport org.springframework.web.filter.OncePerRequestFilter;\n\nimport javax.servlet.FilterChain;\nimport javax.servlet.ServletException;\nimport javax.servlet.http.HttpServletRequest;\nimport javax.servlet.http.HttpServletResponse;\nimport java.io.IOException;\n\npublic class JwtAuthenticationFilter extends OncePerRequestFilter {\n\n @Autowired\n private JwtUtil jwtUtil;\n\n @Autowired\n private UserDetailsService userDetailsService;\n\n @Override\n protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)\n throws ServletException, IOException {\n\n String authorizationHeader = request.getHeader(\"Authorization\");\n\n String username = null;\n String jwt = null;\n\n if (authorizationHeader != null && authorizationHeader.startsWith(\"Bearer \")) {\n jwt = authorizationHeader.substring(7);\n try {\n username = jwtUtil.extractUsername(jwt);\n } catch (ExpiredJwtException e) {\n System.out.println(\"JWT is expired\");\n }\n\n if (username != null && SecurityContextHolder.getContext().getAuthentication() == null) {\n UserDetails userDetails = userDetailsService.loadUserByUsername(username);\n if (jwtUtil.validateToken(jwt, userDetails.getUsername())) {\n UsernamePasswordAuthenticationToken authenticationToken = \n new UsernamePasswordAuthenticationToken(userDetails, null, userDetails.getAuthorities());\n SecurityContextHolder.getContext().setAuthentication(authenticationToken);\n }\n }\n }\n filterChain.doFilter(request, response);\n }\n}\n<\/code><\/pre>\n10. \uacb0\ub860<\/h2>\n
\uc774\ubc88 \uac15\uc88c\uc5d0\uc11c\ub294 \uc2a4\ud504\ub9c1 \ubd80\ud2b8\ub97c \uc774\uc6a9\ud558\uc5ec JWT\ub97c \ud1b5\ud55c \ub85c\uadf8\uc778 \ubc0f \ub85c\uadf8\uc544\uc6c3 \uae30\ub2a5\uc744 \uad6c\ud604\ud558\ub294 \ubc29\ubc95\uc744 \ubc30\uc6e0\uc2b5\ub2c8\ub2e4. \uc6b0\ub9ac\ub294 JWT \ud1a0\ud070\uc744 \uc0dd\uc131\ud558\uace0 \uac80\uc99d\ud558\ub294 \ubc29\ubc95, \uadf8\ub9ac\uace0 \uc2a4\ud504\ub9c1 \uc2dc\ud050\ub9ac\ud2f0\ub97c \ud65c\uc6a9\ud558\uc5ec \uc560\ud50c\ub9ac\ucf00\uc774\uc158\uc758 \ubcf4\uc548\uc744 \uac15\ud654\ud558\ub294 \ubc29\ubc95\uc5d0 \ub300\ud574\uc11c\ub3c4 \uc54c\uc544\ubcf4\uc558\uc2b5\ub2c8\ub2e4. \uc774 \uacfc\uc815\uc744 \ud1b5\ud574 \ubc31\uc5d4\ub4dc \uc560\ud50c\ub9ac\ucf00\uc774\uc158\uc758 \uc778\uc99d \ubc0f \uad8c\ud55c \uad00\ub9ac\ub97c \ub354 \uc548\uc804\ud558\uac8c \ucc98\ub9ac\ud560 \uc218 \uc788\ub294 \uae30\ubc18\uc744 \ub9c8\ub828\ud560 \uc218 \uc788\uc2b5\ub2c8\ub2e4. \ub354\ubd88\uc5b4, \uc2a4\ud504\ub9c1 \ubd80\ud2b8\uc758 \ub2e4\uc591\ud55c \uae30\ub2a5\uc744 \ud65c\uc6a9\ud558\uc5ec \ud6a8\uc728\uc801\uc774\uace0 \uc548\uc804\ud55c \uc6f9 \uc560\ud50c\ub9ac\ucf00\uc774\uc158 \uac1c\ubc1c\uc744 \uc2e4\ud604\ud560 \uc218 \uc788\uc744 \uac83\uc785\ub2c8\ub2e4.<\/p>\n
11. \ucc38\uace0 \uc790\ub8cc<\/h2>\n