인프런 커뮤니티 질문&답변

안녕하세요 구버전에 이어 신버전 강의도 출시해주셔서 감사합니다!

구버전 커뮤니티에 질문올렸었는데요~

이번 강의를 봐도 해결이 되지않아서 질문 올려봅니답..!

직접 spring security 메인테이너나 컨트리뷰터들한테도 물어봤는데, 제가 제대로 질문을 못해서인지 해결을 못했는데요.

시큐리티 + formlogin + Redis를 활용해서 인증방식을 구현했습니다.

아래 코드로 인증 객체를 꺼낼때 문제가 발생합니다.

    @ResponseStatus(HttpStatus.OK)
    @GetMapping("/test")
    public void test() {
        SecurityContextHolderStrategy contextHolderStrategy = SecurityContextHolder.getContextHolderStrategy();
        System.out.println(">> contextHolderStrategy : " + contextHolderStrategy); // org.springframework.security.core.context.ThreadLocalSecurityContextHolderStrategy@7e1fbf12
        SecurityContext context = contextHolderStrategy.getContext();
        System.out.println(">> context : " + context); // SecurityContextImpl [Authentication=AnonymousAuthenticationToken
        Authentication authentication = context.getAuthentication();
        System.out.println(">> authentication : " + authentication); // AnonymousAuthenticationToken
        MemberContext memberContext = (MemberContext) authentication.getPrincipal();
        System.out.println(">> memberContext : " + memberContext); // ClassCastException
        String username = memberContext.getUsername();
        System.out.println(">> username : " + username);
    }

Redis를 사용하지 않고 tomcat에 저장할 경우 session을 통해서 인증 객체를 잘 받아오는데,

>> contextHolderStrategy : org.springframework.security.core.context.ThreadLocalSecurityContextHolderStrategy@54f61d2b
>> context : SecurityContextImpl [Authentication=UsernamePasswordAuthenticationToken [Principal=com.spring.security.config.security.service.MemberContext [Username=sejinpark@email.com, Password=[PROTECTED], Enabled=true, AccountNonExpired=true, CredentialsNonExpired=true, AccountNonLocked=true, Granted Authorities=[ROLE_ADMIN]], Credentials=[PROTECTED], Authenticated=true, Details=WebAuthenticationDetails [RemoteIpAddress=0:0:0:0:0:0:0:1, SessionId=A220DB3D8904393F7D9831276564566A], Granted Authorities=[ROLE_ADMIN]]]
>> authentication : UsernamePasswordAuthenticationToken [Principal=com.spring.security.config.security.service.MemberContext [Username=sejinpark@email.com, Password=[PROTECTED], Enabled=true, AccountNonExpired=true, CredentialsNonExpired=true, AccountNonLocked=true, Granted Authorities=[ROLE_ADMIN]], Credentials=[PROTECTED], Authenticated=true, Details=WebAuthenticationDetails [RemoteIpAddress=0:0:0:0:0:0:0:1, SessionId=A220DB3D8904393F7D9831276564566A], Granted Authorities=[ROLE_ADMIN]]
>> memberContext : com.spring.security.config.security.service.MemberContext [Username=sejinpark@email.com, Password=[PROTECTED], Enabled=true, AccountNonExpired=true, CredentialsNonExpired=true, AccountNonLocked=true, Granted Authorities=[ROLE_ADMIN]]
>> username : sejinpark@email.com

Redis만 사용하면 인증 완료 후 인증 후 요청에서 Anonymous로 변경됩니다.

>> contextHolderStrategy : org.springframework.security.core.context.ThreadLocalSecurityContextHolderStrategy@577154a7
>> context : SecurityContextImpl [Authentication=AnonymousAuthenticationToken [Principal=anonymousUser, Credentials=[PROTECTED], Authenticated=true, Details=WebAuthenticationDetails [RemoteIpAddress=0:0:0:0:0:0:0:1, SessionId=16bec162-3ad3-459d-8b97-bf3d6f1de226], Granted Authorities=[ROLE_ANONYMOUS]]]
>> authentication : AnonymousAuthenticationToken [Principal=anonymousUser, Credentials=[PROTECTED], Authenticated=true, Details=WebAuthenticationDetails [RemoteIpAddress=0:0:0:0:0:0:0:1, SessionId=16bec162-3ad3-459d-8b97-bf3d6f1de226], Granted Authorities=[ROLE_ANONYMOUS]]
2024-04-17T07:49:13.061+09:00 ERROR 84540 --- [nio-8080-exec-6] o.a.c.c.C.[.[.[/].[dispatcherServlet]    : Servlet.service() for servlet [dispatcherServlet] in context with path [] threw exception [Request processing failed: java.lang.ClassCastException: class java.lang.String cannot be cast to class com.spring.security.config.security.service.MemberContext (java.lang.String is in module java.base of loader 'bootstrap'; com.spring.security.config.security.service.MemberContext is in unnamed module of loader 'app')] with root cause

java.lang.ClassCastException: class java.lang.String cannot be cast to class com.spring.security.config.security.service.MemberContext (java.lang.String is in module java.base of loader 'bootstrap'; com.spring.security.config.security.service.MemberContext is in unnamed module of loader 'app')
	at com.spring.security.controller.MemberController.test(MemberController.java:43) ~[main/:na]
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[na:na]
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77) ~[na:na]
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[na:na]

Redis 내부에 인증객체가 저장되어 있는것 까지 확인했는데요.

혹시 SecurityFilterChain에 Redis관련 저장소를 별도로 설정을 해줘야 하는지, 어떤 부분을 확인해야하는지 여쭙고 싶습니다.

Redis를 사용하는데 계속 HttpSessionSecurityContextRepository에서 시큐리티 컨텍스트를 찾을 수 없다고 나옵니답.

2024-04-17T17:05:01.251+09:00  WARN 30066 --- [nio-8080-exec-1] w.c.HttpSessionSecurityContextRepository : SPRING_SECURITY_CONTEXT did not contain a SecurityContext but contained: '{authentication={authorities=[{authority=ROLE_ADMIN}], details={remoteAddress=0:0:0:0:0:0:0:1, sessionId=null}, authenticated=true, principal={password=null, username=sejinpark@email.com, authorities=[{authority=ROLE_ADMIN}], accountNonExpired=true, accountNonLocked=true, credentialsNonExpired=true, enabled=true}, credentials=null, name=sejinpark@email.com}}'; are you improperly modifying the HttpSession directly (you should always use SecurityContextHolder) or using the HttpSession attribute reserved for this class?

우선 테스트용으로 SecurityFilterChain에서 아래처럼 기존 버전 처럼 사용해서 인증 상태를 무조건 저장할 수 있도록 해놨습니다.

커스텀 인증필터를 사용 안하고, SecurityContextPersistanceFilter를 사용하도록했습니다.
securityContext.requireExplicitSave(false);

테스트용으로 만든 레포지토리 링크 첨부합니다!

https://github.com/codesejin/security-test