Spring Security 변경

src/main/java/com/eactive/testmaster/config/PortalConfigSecurity.java

@@ -6,15 +6,19 @@ import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.boot.web.servlet.FilterRegistrationBean;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
+import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
 import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
+import org.springframework.security.config.http.SessionCreationPolicy;
+import org.springframework.security.web.SecurityFilterChain;
 import org.springframework.security.web.csrf.CookieCsrfTokenRepository;
 import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
 
 @Configuration
 @EnableWebSecurity
-public class PortalConfigSecurity extends WebSecurityConfigurerAdapter {
+@EnableGlobalMethodSecurity(securedEnabled = true)
+public class PortalConfigSecurity {
 
     private final PortalAuthenticationFailureHandler authenticationFailureHandler;
 
@@ -41,34 +45,49 @@ public class PortalConfigSecurity extends WebSecurityConfigurerAdapter {
         return registrationBean;
     }
 
-    @Override
-    protected void configure(HttpSecurity http) throws Exception {
-
-        http.headers().frameOptions().disable();//spring security 와 h2-console 같이 사용.
-
+    @Bean
+    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
         http
-                .formLogin()
+            .authenticationManager(portalAuthenticationManager)
+//            .authorizeRequests(authorizeRequests -> authorizeRequests.antMatchers("/h2-console/",
+//                "/css/",
+//                "/html/",
+//                "/images/",
+//                "/img/",
+//                "/js/",
+//                "/login",
+//                "/intro.do",
+//                "/join.do",
+//                "/actionLogin.do",
+//                "/search_id.do",
+//                "/admin_register_view.do",
+//                "/admin_register.do",
+//                "/reset_password.do",
+//                "/forgot_password.do")
+//                .permitAll()
+//                .anyRequest()
+//                .authenticated())
+            .formLogin(form -> form
                 .loginPage("/login")
                 .usernameParameter("id")
                 .passwordParameter("password")
                 .loginProcessingUrl("/actionLogin.do")
-                .successHandler(authenticationSuccessHandler)
                 .failureHandler(authenticationFailureHandler)
-                .and()
-                .logout().logoutUrl("/actionLogout.do").logoutSuccessUrl("/")
-                .and().authorizeRequests()    // 권한요청 처리 설정 메서드
-                .antMatchers("/h2-console/**").permitAll()  // 누구나 h2-console 접속 허용
-                .and()
-                .csrf()
-                .requireCsrfProtectionMatcher(new AntPathRequestMatcher("/mgmt/**", "POST"))
-                .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse());
+                .successHandler(authenticationSuccessHandler))
+            .logout(logout -> logout
+                .logoutRequestMatcher(new AntPathRequestMatcher("/actionLogout.do", "GET"))
+                .logoutSuccessUrl("/"))
+            .csrf(csrf -> csrf
+                .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())
+                .ignoringAntMatchers("/h2-console/**")
+            ).headers(headers -> headers.frameOptions().sameOrigin())
+            .sessionManagement(session -> session
+                .sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED)
+                .sessionFixation()
+                .changeSessionId()
+            );
 
+
+        return http.build();
     }
-
-    @Override
-    @Bean
-    public PortalAuthenticationManager authenticationManager() {
-        return portalAuthenticationManager;
-    }
-
 }

src/main/java/com/eactive/testmaster/config/WebMvcConfig.java

@@ -1,6 +1,8 @@
 package com.eactive.testmaster.config;
 
-import com.eactive.testmaster.common.interceptor.AuthenticInterceptor;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.concurrent.TimeUnit;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.core.Ordered;
@@ -8,13 +10,12 @@ import org.springframework.data.domain.PageRequest;
 import org.springframework.data.web.PageableHandlerMethodArgumentResolver;
 import org.springframework.http.CacheControl;
 import org.springframework.web.method.support.HandlerMethodArgumentResolver;
-import org.springframework.web.servlet.config.annotation.*;
+import org.springframework.web.servlet.config.annotation.EnableWebMvc;
+import org.springframework.web.servlet.config.annotation.ResourceHandlerRegistry;
+import org.springframework.web.servlet.config.annotation.ViewControllerRegistry;
+import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
 import org.springframework.web.servlet.resource.PathResourceResolver;
 
-import java.util.ArrayList;
-import java.util.List;
-import java.util.concurrent.TimeUnit;
-
 @Configuration
 @EnableWebMvc
 public class WebMvcConfig implements WebMvcConfigurer {
@@ -26,20 +27,6 @@ public class WebMvcConfig implements WebMvcConfigurer {
         WebMvcConfigurer.super.addViewControllers(registry);
     }
 
-    private List<String> listAdminAuthPattern() {
-        List<String> patterns = new ArrayList<>();
-        patterns.add("/mgmt/users/*.do");
-        patterns.add("/mgmt/servers/*.do");
-        return patterns;
-    }
-
-    @Bean
-    public AuthenticInterceptor authenticInterceptor() {
-        AuthenticInterceptor authenticInterceptor = new AuthenticInterceptor();
-        authenticInterceptor.setAdminAuthPatternList(listAdminAuthPattern());
-        return authenticInterceptor;
-    }
-
     @Override
     public void addArgumentResolvers(List<HandlerMethodArgumentResolver> resolvers) {
         resolvers.add(pageableHandlerMethodArgumentResolver());
@@ -53,34 +40,6 @@ public class WebMvcConfig implements WebMvcConfigurer {
         return pageableHandlerMethodArgumentResolver;
     }
 
-    @Override
-    public void addInterceptors(InterceptorRegistry registry) {
-        registry.addInterceptor(authenticInterceptor())
-                .addPathPatterns(
-                        "/",
-                        "/mgmt/**/*.do")
-                .excludePathPatterns(
-                        "/h2-console/**",
-                        "/css/**",
-                        "/html/**",
-                        "/images/**",
-                        "/img/**",
-                        "/js/**",
-                        "/login",
-                        "/intro.do",
-                        "/join.do",
-                        "/user_register.do",
-                        "/actionLogin.do",
-                        "/check_id.do",
-                        "/search_id.do",
-                        "/admin_register_view.do",
-                        "/admin_register.do",
-                        "/request_register_auth.do",
-                        "/reset_password.do",
-                        "/forgot_password.do"
-                );
-    }
-
     @Override
     public void addResourceHandlers(ResourceHandlerRegistry registry) {