Conversation
Walkthrough보안 설정에서 Swagger UI 경로( Changes
Sequence Diagram(s)sequenceDiagram
autonumber
actor Client
participant SecurityFilterChain as Security Filter
participant Authz as Authorization
participant SwaggerUI as Swagger UI Controller
Client->>SecurityFilterChain: GET /swagger-ui/index.html
SecurityFilterChain->>Authz: Check match against permitAll
Authz-->>SecurityFilterChain: Matched (/swagger-ui/**) - allow
SecurityFilterChain-->>SwaggerUI: Forward request
SwaggerUI-->>Client: 200 OK (UI assets)
Note over SecurityFilterChain,SwaggerUI: 신규 공개 경로 적용
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Poem
Tip 🔌 Remote MCP (Model Context Protocol) integration is now available!Pro plan users can now connect to remote MCP servers from the Integrations page. Connect with popular remote MCPs such as Notion and Linear to add more context to your reviews and chats. ✨ Finishing Touches
🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (2)
src/main/java/hello/cluebackend/global/config/SecurityConfig.java(1 hunks)src/main/java/hello/cluebackend/global/config/SwaggerConfig.java(1 hunks)
🧰 Additional context used
🧬 Code graph analysis (1)
src/main/java/hello/cluebackend/global/config/SecurityConfig.java (1)
src/main/java/hello/cluebackend/global/config/CorsMvcConfig.java (1)
Override(10-19)
🔇 Additional comments (1)
src/main/java/hello/cluebackend/global/config/SwaggerConfig.java (1)
21-21: Swagger 제목 변경 LGTM브랜딩 목적의 문자열 교체만 이뤄졌고, 다른 동작에는 영향 없습니다.
| .authorizeHttpRequests(auth -> auth | ||
| // .requestMatchers("/", "/refresh-token", "/register", "/first-register", "/api/timetable/**", "/test", "/api/document/download/{documentId:\\d+}").permitAll() | ||
| .requestMatchers("/", "/refresh-token", "/register", "/first-register", "/api/timetable/**", "/test").permitAll() | ||
| .requestMatchers("/", "/refresh-token", "/register", "/first-register", "/api/timetable/**", "/test", "/swagger-ui/**").permitAll() |
There was a problem hiding this comment.
💡 Verification agent
🧩 Analysis chain
Swagger UI만 허용하면 스펙(/v3/api-docs)이 401 — api-docs도 permitAll 필요
Swagger UI는 기본적으로 /v3/api-docs(및 /v3/api-docs/**)에서 스펙을 불러옵니다. 현재 /swagger-ui/**만 열어두면 UI는 뜨지만 스펙 호출이 401로 막혀 실제 화면에 API가 표시되지 않습니다. 아래처럼 "/v3/api-docs/**"(필요시 "/swagger-ui.html")도 함께 허용해 주세요.
- .requestMatchers("/", "/refresh-token", "/register", "/first-register", "/api/timetable/**", "/test", "/swagger-ui/**").permitAll()
+ .requestMatchers("/", "/refresh-token", "/register", "/first-register", "/api/timetable/**", "/test",
+ "/swagger-ui/**", "/swagger-ui.html", "/v3/api-docs/**").permitAll()스펙 경로를 springdoc.api-docs.path로 커스텀했다면 해당 경로로 치환이 필요합니다.
🏁 Script executed:
#!/bin/bash
rg -nP --color=never 'requestMatchers' -C3 src/main/java/hello/cluebackend/global/config/SecurityConfig.java || true
rg -n 'springdoc.api-docs.path' -n -g '*.properties' -g '*.yml' -g '*.yaml' || trueLength of output: 519
/v3/api-docs/** 및 /swagger-ui.html도 permitAll에 추가
SecurityConfig.java 117행의 .requestMatchers(..., "/swagger-ui/**").permitAll()에 /v3/api-docs/**와 필요 시 /swagger-ui.html을 추가해야 Swagger UI가 API 스펙을 정상 표시합니다.
- .requestMatchers("/", "/refresh-token", "/register", "/first-register", "/api/timetable/**", "/test", "/swagger-ui/**").permitAll()
+ .requestMatchers("/", "/refresh-token", "/register", "/first-register", "/api/timetable/**", "/test",
+ "/swagger-ui/**", "/swagger-ui.html", "/v3/api-docs/**").permitAll()(커스텀 springdoc.api-docs.path를 사용 중이라면 해당 값으로 /v3/api-docs/**를 대체해주세요.)
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| .requestMatchers("/", "/refresh-token", "/register", "/first-register", "/api/timetable/**", "/test", "/swagger-ui/**").permitAll() | |
| .requestMatchers("/", "/refresh-token", "/register", "/first-register", "/api/timetable/**", "/test", | |
| "/swagger-ui/**", "/swagger-ui.html", "/v3/api-docs/**").permitAll() |
🤖 Prompt for AI Agents
In src/main/java/hello/cluebackend/global/config/SecurityConfig.java around line
117, the requestMatchers permit list currently allows "/swagger-ui/**" but is
missing "/v3/api-docs/**" and optionally "/swagger-ui.html", so add
"/v3/api-docs/**" (or your custom springdoc.api-docs.path + "/**") and
"/swagger-ui.html" to the requestMatchers list to ensure Swagger UI and API docs
are served without authentication.
2 participants
📌 swagger 인가 작업 제외
📑 개요
swagger 인가 작업 제외
✅ 작업 내용
🔗 관련 이슈
Close fix/#8
📌 체크리스트
Summary by CodeRabbit