From cef4a58ce5e9599e73dd4671367f4346b89121b9 Mon Sep 17 00:00:00 2001 From: hgkim Date: Sat, 21 Jun 2025 01:02:34 +0900 Subject: [PATCH 1/2] feat: update access token expiration time to 48 hours Signed-off-by: hgkim --- .../global/security/jwt/JwtTokenProvider.java | 44 +++++++++---------- 1 file changed, 22 insertions(+), 22 deletions(-) diff --git a/src/main/java/app/bottlenote/global/security/jwt/JwtTokenProvider.java b/src/main/java/app/bottlenote/global/security/jwt/JwtTokenProvider.java index add3c8fe9..d208cc767 100644 --- a/src/main/java/app/bottlenote/global/security/jwt/JwtTokenProvider.java +++ b/src/main/java/app/bottlenote/global/security/jwt/JwtTokenProvider.java @@ -19,8 +19,8 @@ @Component public class JwtTokenProvider { - public static final int ACCESS_TOKEN_EXPIRE_TIME = 1000 * 60 * 60 * 24; // 24시간 - public static final int REFRESH_TOKEN_EXPIRE_TIME = 1000 * 60 * 60 * 24 * 14; // 14일 + public static final int ACCESS_TOKEN_EXPIRE_TIME = 1000 * 60 * 60 * 24 * 2; + public static final int REFRESH_TOKEN_EXPIRE_TIME = 1000 * 60 * 60 * 24 * 14; public static final String KEY_ROLES = "roles"; private final Key secretKey; @@ -30,7 +30,7 @@ public class JwtTokenProvider { * @param secret 토큰 생성용 시크릿 키 */ public JwtTokenProvider( - @Value("${security.jwt.secret-key}") String secret + @Value("${security.jwt.secret-key}") String secret ) { byte[] keyBytes = Decoders.BASE64.decode(secret); this.secretKey = Keys.hmacShaKeyFor(keyBytes); @@ -48,9 +48,9 @@ public TokenItem generateToken(String userEmail, UserType role, Long userId) { String accessToken = createAccessToken(userEmail, role, userId); String refreshToken = createRefreshToken(userEmail, role, userId); return TokenItem.builder() - .accessToken(accessToken) - .refreshToken(refreshToken) - .build(); + .accessToken(accessToken) + .refreshToken(refreshToken) + .build(); } /** @@ -65,11 +65,11 @@ public String createAccessToken(String userEmail, UserType role, Long userId) { Claims claims = createClaims(userEmail, role, userId); Date now = new Date(); return Jwts.builder() - .setClaims(claims) - .setIssuedAt(now) - .setExpiration(new Date(now.getTime() + ACCESS_TOKEN_EXPIRE_TIME)) - .signWith(secretKey, SignatureAlgorithm.HS512) - .compact(); + .setClaims(claims) + .setIssuedAt(now) + .setExpiration(new Date(now.getTime() + ACCESS_TOKEN_EXPIRE_TIME)) + .signWith(secretKey, SignatureAlgorithm.HS512) + .compact(); } public String createGuestToken(Long userId, int expireTime) { @@ -78,12 +78,12 @@ public String createGuestToken(Long userId, int expireTime) { claims.put(KEY_ROLES, UserType.ROLE_GUEST.name()); Date now = new Date(); return Jwts.builder() - .setClaims(claims) - .setSubject("guest") - .setIssuedAt(now) - .setExpiration(new Date(now.getTime() + expireTime)) - .signWith(secretKey, SignatureAlgorithm.HS512) - .compact(); + .setClaims(claims) + .setSubject("guest") + .setIssuedAt(now) + .setExpiration(new Date(now.getTime() + expireTime)) + .signWith(secretKey, SignatureAlgorithm.HS512) + .compact(); } /** @@ -98,11 +98,11 @@ public String createRefreshToken(String userEmail, UserType role, Long userId) { Claims claims = createClaims(userEmail, role, userId); Date now = new Date(); return Jwts.builder() - .setClaims(claims) - .setIssuedAt(now) - .setExpiration(new Date(now.getTime() + REFRESH_TOKEN_EXPIRE_TIME)) - .signWith(secretKey, SignatureAlgorithm.HS512) - .compact(); + .setClaims(claims) + .setIssuedAt(now) + .setExpiration(new Date(now.getTime() + REFRESH_TOKEN_EXPIRE_TIME)) + .signWith(secretKey, SignatureAlgorithm.HS512) + .compact(); } /** From 713c22949d9ee62db7c96e0e816d3f728b3fd547 Mon Sep 17 00:00:00 2001 From: hgkim Date: Sat, 21 Jun 2025 01:09:27 +0900 Subject: [PATCH 2/2] feat: add JwtProperties class and update application.yml for JWT configuration Signed-off-by: hgkim --- .../security/jwt/JwtAuthenticationFilter.java | 4 ++++ .../global/security/jwt/JwtProperties.java | 23 +++++++++++++++++++ src/main/resources/application.yml | 3 +++ 3 files changed, 30 insertions(+) create mode 100644 src/main/java/app/bottlenote/global/security/jwt/JwtProperties.java diff --git a/src/main/java/app/bottlenote/global/security/jwt/JwtAuthenticationFilter.java b/src/main/java/app/bottlenote/global/security/jwt/JwtAuthenticationFilter.java index 9370be491..d063db410 100644 --- a/src/main/java/app/bottlenote/global/security/jwt/JwtAuthenticationFilter.java +++ b/src/main/java/app/bottlenote/global/security/jwt/JwtAuthenticationFilter.java @@ -154,6 +154,10 @@ protected boolean shouldNotFilter(HttpServletRequest request) { * 다만 내가 픽했는지 여부등을 파악하기 위해 선택적으로 제공 *

* 수정 : 2024-11-10 + * + * TODO: 현재 하드코딩된 경로 관리 방식을 애노테이션 기반으로 개선 필요 + * TODO: @AccessPolicy 또는 @OptionalAuth 애노테이션을 활용하여 컨트롤러에서 선언적으로 관리 + * TODO: 경로 추가 시마다 두 곳(SecurityConfig + 여기)을 수정해야 하는 문제 해결 필요 */ private boolean skipFilter(String method, String url) { final String targetPath = method + ":" + url; diff --git a/src/main/java/app/bottlenote/global/security/jwt/JwtProperties.java b/src/main/java/app/bottlenote/global/security/jwt/JwtProperties.java new file mode 100644 index 000000000..66f8f8294 --- /dev/null +++ b/src/main/java/app/bottlenote/global/security/jwt/JwtProperties.java @@ -0,0 +1,23 @@ +package app.bottlenote.global.security.jwt; + +import lombok.AccessLevel; +import lombok.AllArgsConstructor; +import lombok.Getter; +import lombok.NoArgsConstructor; +import lombok.Setter; +import org.springframework.boot.context.properties.ConfigurationProperties; +import org.springframework.boot.context.properties.ConfigurationPropertiesScan; +import org.springframework.context.annotation.Configuration; + +@Setter +@Getter +@Configuration +@AllArgsConstructor(access = AccessLevel.PRIVATE) +@NoArgsConstructor(access = AccessLevel.PROTECTED) +@ConfigurationProperties(prefix = "security.jwt") +@ConfigurationPropertiesScan +public class JwtProperties { + private String secretKey; + private long accessTokenExpiration; + private long refreshTokenExpiration; +} diff --git a/src/main/resources/application.yml b/src/main/resources/application.yml index e8d5b08ef..ac206f6f8 100644 --- a/src/main/resources/application.yml +++ b/src/main/resources/application.yml @@ -60,6 +60,9 @@ spring: security: jwt: secret-key: ${JWT_SECRET_KEY:c2VjdXJlU2VjcmV0S2V5MTIzNDU2Nzg5MGFiY2RlZmdoaWprbG1ub3BxcnN0dXZ3eHl6QWJDRGVGR2hJSktMTU5PUFFSU1RVVldYWVphYmNkZWZnaGlrSg==} + access-token-expiration: 86400 # 하루 (24시간) + refresh-token-expiration: 2592000 # 한 달 (30일) + # Actuator 설정 management: