result = new HashMap<>();
+ HttpSession httpSession = request.getSession(false);
+
+ if (httpSession == null) {
+ result.put("remainingSeconds", 0);
+ return ResponseEntity.ok(result);
+ }
+
+ String sessionId = httpSession.getId();
+ userSessionService.updateLastAccessTime(sessionId);
+ long remaining = userSessionService.getRemainingSeconds(sessionId);
+ result.put("remainingSeconds", remaining);
+
+ return ResponseEntity.ok(result);
+ }
+
+ /**
+ * IP 주소 마스킹 (3번째 옥텟을 ***로 치환)
+ * 예: 192.168.240.178 → 192.168.***.178
+ */
+ private String maskIpAddress(String ip) {
+ if (ip == null || ip.isEmpty()) {
+ return "알 수 없음";
+ }
+ String[] parts = ip.split("\\.");
+ if (parts.length == 4) {
+ return parts[0] + "." + parts[1] + ".***." + parts[3];
+ }
+ // IPv6 등 다른 형식은 일부만 표시
+ if (ip.length() > 8) {
+ return ip.substring(0, 4) + "****" + ip.substring(ip.length() - 4);
+ }
+ return "***";
+ }
+}
diff --git a/src/main/java/com/eactive/apim/portal/apps/session/entity/UserSession.java b/src/main/java/com/eactive/apim/portal/apps/session/entity/UserSession.java
new file mode 100644
index 0000000..03bf888
--- /dev/null
+++ b/src/main/java/com/eactive/apim/portal/apps/session/entity/UserSession.java
@@ -0,0 +1,54 @@
+package com.eactive.apim.portal.apps.session.entity;
+
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+import javax.persistence.Column;
+import javax.persistence.Entity;
+import javax.persistence.Id;
+import javax.persistence.Table;
+import java.time.LocalDateTime;
+
+/**
+ * 사용자 세션 추적 엔티티 (EMS 스키마, PTL_USER_SESSION)
+ *
+ * 화면 세션 타이머/유휴 자동 로그아웃 및 중복로그인 강제 로그아웃에 사용된다.
+ * {@code lastAccessTime} + 타임아웃(분) 이 세션 만료의 기준이며, {@code forceLogout='Y'} 인 세션은
+ * 다음 요청 시 {@link com.eactive.apim.portal.apps.session.filter.SessionValidationFilter} 가 강제 로그아웃한다.
+ */
+@Data
+@NoArgsConstructor
+@AllArgsConstructor
+@Builder
+@Entity
+@Table(name = "PTL_USER_SESSION")
+public class UserSession {
+
+ @Id
+ @Column(name = "SESSION_ID", length = 128, nullable = false)
+ private String sessionId;
+
+ @Column(name = "USER_ID", length = 36, nullable = false)
+ private String userId;
+
+ @Column(name = "LOGIN_ID", length = 200, nullable = false)
+ private String loginId;
+
+ @Column(name = "LOGIN_TIME", nullable = false)
+ private LocalDateTime loginTime;
+
+ @Column(name = "LAST_ACCESS_TIME", nullable = false)
+ private LocalDateTime lastAccessTime;
+
+ @Column(name = "IP_ADDRESS", length = 45)
+ private String ipAddress;
+
+ @Column(name = "USER_AGENT", length = 500)
+ private String userAgent;
+
+ @Column(name = "FORCE_LOGOUT", length = 1, nullable = false)
+ @Builder.Default
+ private String forceLogout = "N";
+}
diff --git a/src/main/java/com/eactive/apim/portal/apps/session/filter/SessionValidationFilter.java b/src/main/java/com/eactive/apim/portal/apps/session/filter/SessionValidationFilter.java
new file mode 100644
index 0000000..412fc0c
--- /dev/null
+++ b/src/main/java/com/eactive/apim/portal/apps/session/filter/SessionValidationFilter.java
@@ -0,0 +1,124 @@
+package com.eactive.apim.portal.apps.session.filter;
+
+import com.eactive.apim.portal.apps.session.service.UserSessionService;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.stereotype.Component;
+import org.springframework.web.filter.OncePerRequestFilter;
+
+import javax.servlet.FilterChain;
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import javax.servlet.http.HttpSession;
+import java.io.IOException;
+import java.util.Arrays;
+import java.util.List;
+
+/**
+ * 인증 사용자 요청마다 DB 세션 상태를 검증한다.
+ *
+ *
+ * - 강제 로그아웃(forceLogout='Y') 감지 시 세션 무효화 후 {@code /login?forceLogout=true}
+ * - 잔여 시간 만료 시 세션 무효화 후 {@code /login?expired=true}
+ * - 그 외에는 60초 스로틀로 lastAccessTime 갱신 (실제 활동 반영)
+ *
+ */
+@Slf4j
+@Component
+@RequiredArgsConstructor
+public class SessionValidationFilter extends OncePerRequestFilter {
+
+ private static final String LAST_DB_UPDATE_ATTR = "SESSION_LAST_DB_UPDATE";
+ private static final long DB_UPDATE_THROTTLE_MS = 60_000; // 60초 스로틀링
+
+ private static final List EXCLUDED_PREFIXES = Arrays.asList(
+ "/api/session/",
+ "/login",
+ "/actionLogin.do",
+ "/actionLogout.do",
+ "/css/",
+ "/js/",
+ "/img/",
+ "/plugins/",
+ "/fonts/",
+ "/favicon.ico",
+ "/error",
+ "/health"
+ );
+
+ private final UserSessionService userSessionService;
+
+ @Override
+ protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response,
+ FilterChain filterChain) throws ServletException, IOException {
+
+ String path = request.getRequestURI();
+ String contextPath = request.getContextPath();
+ if (contextPath != null && !contextPath.isEmpty()) {
+ path = path.substring(contextPath.length());
+ }
+
+ // 제외 경로 체크
+ if (isExcludedPath(path)) {
+ filterChain.doFilter(request, response);
+ return;
+ }
+
+ // 인증되지 않은 요청은 통과
+ Authentication auth = SecurityContextHolder.getContext().getAuthentication();
+ if (auth == null || !auth.isAuthenticated() || "anonymousUser".equals(auth.getPrincipal())) {
+ filterChain.doFilter(request, response);
+ return;
+ }
+
+ HttpSession httpSession = request.getSession(false);
+ if (httpSession == null) {
+ filterChain.doFilter(request, response);
+ return;
+ }
+
+ String sessionId = httpSession.getId();
+
+ // 1. 강제 로그아웃 체크 (중복 로그인)
+ if (userSessionService.isForceLoggedOut(sessionId)) {
+ log.info("강제 로그아웃 감지 - sessionId: {}", sessionId);
+ userSessionService.removeSession(sessionId);
+ httpSession.invalidate();
+ SecurityContextHolder.clearContext();
+ response.sendRedirect(contextPath + "/login?forceLogout=true");
+ return;
+ }
+
+ // 2. 세션 만료 체크 (DB 레코드 없거나 잔여 0)
+ long remaining = userSessionService.getRemainingSeconds(sessionId);
+ if (remaining <= 0) {
+ userSessionService.removeSession(sessionId);
+ httpSession.invalidate();
+ SecurityContextHolder.clearContext();
+ response.sendRedirect(contextPath + "/login?expired=true");
+ return;
+ }
+
+ // 3. lastAccessTime 갱신 (60초 스로틀링)
+ Long lastUpdate = (Long) httpSession.getAttribute(LAST_DB_UPDATE_ATTR);
+ long now = System.currentTimeMillis();
+ if (lastUpdate == null || (now - lastUpdate) > DB_UPDATE_THROTTLE_MS) {
+ userSessionService.updateLastAccessTime(sessionId);
+ httpSession.setAttribute(LAST_DB_UPDATE_ATTR, now);
+ }
+
+ filterChain.doFilter(request, response);
+ }
+
+ private boolean isExcludedPath(String path) {
+ for (String prefix : EXCLUDED_PREFIXES) {
+ if (path.startsWith(prefix)) {
+ return true;
+ }
+ }
+ return false;
+ }
+}
diff --git a/src/main/java/com/eactive/apim/portal/apps/session/repository/UserSessionRepository.java b/src/main/java/com/eactive/apim/portal/apps/session/repository/UserSessionRepository.java
new file mode 100644
index 0000000..5ae002e
--- /dev/null
+++ b/src/main/java/com/eactive/apim/portal/apps/session/repository/UserSessionRepository.java
@@ -0,0 +1,29 @@
+package com.eactive.apim.portal.apps.session.repository;
+
+import com.eactive.apim.portal.apps.session.entity.UserSession;
+import org.springframework.data.jpa.repository.JpaRepository;
+import org.springframework.data.jpa.repository.Modifying;
+import org.springframework.data.jpa.repository.Query;
+import org.springframework.data.repository.query.Param;
+import org.springframework.stereotype.Repository;
+
+import java.time.LocalDateTime;
+import java.util.List;
+
+@Repository
+public interface UserSessionRepository extends JpaRepository {
+
+ List findByLoginId(String loginId);
+
+ @Modifying
+ @Query("UPDATE UserSession s SET s.forceLogout = 'Y' WHERE s.loginId = :loginId AND s.sessionId <> :currentSessionId")
+ int forceLogoutOtherSessions(@Param("loginId") String loginId, @Param("currentSessionId") String currentSessionId);
+
+ @Modifying
+ @Query("DELETE FROM UserSession s WHERE s.lastAccessTime < :cutoffTime")
+ int deleteExpiredSessions(@Param("cutoffTime") LocalDateTime cutoffTime);
+
+ @Modifying
+ @Query("UPDATE UserSession s SET s.lastAccessTime = :now WHERE s.sessionId = :sessionId")
+ int updateLastAccessTime(@Param("sessionId") String sessionId, @Param("now") LocalDateTime now);
+}
diff --git a/src/main/java/com/eactive/apim/portal/apps/session/service/UserSessionService.java b/src/main/java/com/eactive/apim/portal/apps/session/service/UserSessionService.java
new file mode 100644
index 0000000..e8b43d0
--- /dev/null
+++ b/src/main/java/com/eactive/apim/portal/apps/session/service/UserSessionService.java
@@ -0,0 +1,156 @@
+package com.eactive.apim.portal.apps.session.service;
+
+import com.eactive.apim.portal.apps.session.entity.UserSession;
+import com.eactive.apim.portal.apps.session.repository.UserSessionRepository;
+import com.eactive.apim.portal.portalproperty.service.PortalPropertyService;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.scheduling.annotation.Scheduled;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+
+import java.time.Duration;
+import java.time.LocalDateTime;
+import java.util.List;
+import java.util.Optional;
+
+@Slf4j
+@Service
+@RequiredArgsConstructor
+public class UserSessionService {
+
+ private static final String PROPERTY_GROUP = "Portal";
+ private static final String PROPERTY_NAME = "session.timeout.minutes";
+ private static final String DEFAULT_TIMEOUT_MINUTES = "15";
+
+ private final UserSessionRepository userSessionRepository;
+ private final PortalPropertyService portalPropertyService;
+
+ /**
+ * 활성 세션 존재 여부 확인 (만료되지 않고 강제 로그아웃되지 않은 세션)
+ */
+ @Transactional(readOnly = true)
+ public Optional getActiveSession(String loginId) {
+ int timeoutMinutes = getSessionTimeoutMinutes();
+ LocalDateTime cutoff = LocalDateTime.now().minusMinutes(timeoutMinutes);
+
+ List sessions = userSessionRepository.findByLoginId(loginId);
+ return sessions.stream()
+ .filter(s -> "N".equals(s.getForceLogout()))
+ .filter(s -> s.getLastAccessTime().isAfter(cutoff))
+ .findFirst();
+ }
+
+ /**
+ * 새 세션 등록
+ */
+ @Transactional
+ public void registerSession(String sessionId, String userId, String loginId, String ipAddress, String userAgent) {
+ UserSession session = UserSession.builder()
+ .sessionId(sessionId)
+ .userId(userId)
+ .loginId(loginId)
+ .loginTime(LocalDateTime.now())
+ .lastAccessTime(LocalDateTime.now())
+ .ipAddress(ipAddress)
+ .userAgent(truncate(userAgent, 500))
+ .forceLogout("N")
+ .build();
+ userSessionRepository.save(session);
+ log.info("세션 등록 - loginId: {}, sessionId: {}, ip: {}", loginId, sessionId, ipAddress);
+ }
+
+ /**
+ * 다른 세션 강제 로그아웃 플래그 설정 (중복 로그인 방지)
+ */
+ @Transactional
+ public void forceLogoutOtherSessions(String loginId, String currentSessionId) {
+ int count = userSessionRepository.forceLogoutOtherSessions(loginId, currentSessionId);
+ if (count > 0) {
+ log.info("강제 로그아웃 처리 - loginId: {}, 대상 세션 수: {}", loginId, count);
+ }
+ }
+
+ /**
+ * 현재 세션의 강제 로그아웃 여부 확인
+ */
+ @Transactional(readOnly = true)
+ public boolean isForceLoggedOut(String sessionId) {
+ return userSessionRepository.findById(sessionId)
+ .map(s -> "Y".equals(s.getForceLogout()))
+ .orElse(false);
+ }
+
+ /**
+ * 세션 삭제
+ */
+ @Transactional
+ public void removeSession(String sessionId) {
+ if (userSessionRepository.existsById(sessionId)) {
+ userSessionRepository.deleteById(sessionId);
+ log.debug("세션 삭제 - sessionId: {}", sessionId);
+ }
+ }
+
+ /**
+ * 마지막 접근 시간 갱신 (세션 연장)
+ */
+ @Transactional
+ public void updateLastAccessTime(String sessionId) {
+ userSessionRepository.updateLastAccessTime(sessionId, LocalDateTime.now());
+ }
+
+ /**
+ * DB(PortalProperty)에서 세션 타임아웃 값 조회 (분)
+ */
+ public int getSessionTimeoutMinutes() {
+ String value = portalPropertyService.getOrCreateProperty(
+ PROPERTY_GROUP,
+ PROPERTY_NAME,
+ DEFAULT_TIMEOUT_MINUTES,
+ "세션 타임아웃 시간 (분)"
+ );
+ try {
+ return Integer.parseInt(value.trim());
+ } catch (NumberFormatException e) {
+ log.warn("세션 타임아웃 값 파싱 실패: {}, 기본값 {}분 사용", value, DEFAULT_TIMEOUT_MINUTES);
+ return Integer.parseInt(DEFAULT_TIMEOUT_MINUTES);
+ }
+ }
+
+ /**
+ * 세션의 잔여 시간(초) 계산. 세션 레코드가 없으면 0.
+ */
+ @Transactional(readOnly = true)
+ public long getRemainingSeconds(String sessionId) {
+ int timeoutMinutes = getSessionTimeoutMinutes();
+ return userSessionRepository.findById(sessionId)
+ .map(s -> {
+ LocalDateTime expireTime = s.getLastAccessTime().plusMinutes(timeoutMinutes);
+ long remaining = Duration.between(LocalDateTime.now(), expireTime).getSeconds();
+ return Math.max(0, remaining);
+ })
+ .orElse(0L);
+ }
+
+ /**
+ * 만료 세션 정리 (5분 주기). 타임아웃의 2배 이상 지난 세션 삭제 (안전 마진).
+ */
+ @Scheduled(fixedRate = 300000)
+ @Transactional
+ public void cleanupExpiredSessions() {
+ int timeoutMinutes = getSessionTimeoutMinutes();
+ LocalDateTime cutoff = LocalDateTime.now().minusMinutes((long) timeoutMinutes * 2);
+ int deleted = userSessionRepository.deleteExpiredSessions(cutoff);
+ if (deleted > 0) {
+ log.info("만료 세션 정리 - 삭제 수: {}", deleted);
+ }
+ }
+
+ private String truncate(String value, int maxLength) {
+ if (value == null) {
+ return null;
+ }
+ return value.length() > maxLength ? value.substring(0, maxLength) : value;
+ }
+}
diff --git a/src/main/java/com/eactive/apim/portal/common/breadcrumb/GlobalControllerAdvice.java b/src/main/java/com/eactive/apim/portal/common/breadcrumb/GlobalControllerAdvice.java
index e1090c4..1ae1b08 100644
--- a/src/main/java/com/eactive/apim/portal/common/breadcrumb/GlobalControllerAdvice.java
+++ b/src/main/java/com/eactive/apim/portal/common/breadcrumb/GlobalControllerAdvice.java
@@ -8,6 +8,7 @@ import org.springframework.web.bind.annotation.ControllerAdvice;
import org.springframework.web.bind.annotation.ModelAttribute;
import com.eactive.apim.portal.portalproperty.service.PortalPropertyService;
import com.eactive.apim.portal.config.PortalProperties;
+import com.eactive.apim.portal.apps.session.service.UserSessionService;
@ControllerAdvice
public class GlobalControllerAdvice {
@@ -21,6 +22,9 @@ public class GlobalControllerAdvice {
@Autowired
private PortalProperties portalProperties;
+ @Autowired
+ private UserSessionService userSessionService;
+
@ModelAttribute("breadcrumb")
public List