[USER] RTR(Refresh Token Rotation) 인증 시스템 구현

src/main/java/io/github/petty/config/SecurityConfig.java

@@ -5,6 +5,8 @@
 import io.github.petty.users.jwt.LoginFilter;
 import io.github.petty.users.oauth2.CustomOAuth2UserService;
 import io.github.petty.users.oauth2.OAuth2SuccessHandler;
+import io.github.petty.users.repository.UsersRepository;
+import io.github.petty.users.service.RefreshTokenService;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.security.authentication.AuthenticationManager;
@@ -24,16 +26,22 @@ public class SecurityConfig {
     private final JWTUtil jwtUtil;
     private final CustomOAuth2UserService customOAuth2UserService;
     private final OAuth2SuccessHandler oAuth2SuccessHandler;
+    private final RefreshTokenService refreshTokenService;
+    private final UsersRepository usersRepository;
 
     public SecurityConfig(
             AuthenticationConfiguration authenticationConfiguration,
             JWTUtil jwtUtil,
             CustomOAuth2UserService customOAuth2UserService,
-            OAuth2SuccessHandler oAuth2SuccessHandler) {
+            OAuth2SuccessHandler oAuth2SuccessHandler,
+            RefreshTokenService refreshTokenService,
+            UsersRepository usersRepository) {
         this.authenticationConfiguration = authenticationConfiguration;
         this.jwtUtil = jwtUtil;
         this.customOAuth2UserService = customOAuth2UserService;
         this.oAuth2SuccessHandler = oAuth2SuccessHandler;
+        this.refreshTokenService = refreshTokenService;
+        this.usersRepository = usersRepository;
     }
 
     @Bean
@@ -55,7 +63,7 @@ public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
                 .authorizeHttpRequests((auth) -> auth
                         .requestMatchers("/admin").hasRole("ADMIN")
                         .requestMatchers("/user").authenticated()
-                        .requestMatchers("/login/**", "/oauth2/**").permitAll()
+                        .requestMatchers("/login/**", "/oauth2/**", "/api/auth/refresh").permitAll()
                         .anyRequest().permitAll())
                 .oauth2Login(oauth2 -> oauth2
                         .loginPage("/login")
@@ -67,12 +75,12 @@ public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
                 .logout(logout -> logout
                         .logoutUrl("/logout") // 클라이언트 측 로그아웃 요청 URL과 일치
                         .logoutSuccessUrl("/") // 로그아웃 성공 후 리다이렉트 URL
-                        .deleteCookies("jwt") // 로그아웃 시 jwt 쿠키 삭제
+                        .deleteCookies("JSESSIONID", "jwt", "refresh_token") // 로그아웃 시 jwt 쿠키 삭제
                         .invalidateHttpSession(true)
                         .clearAuthentication(true)
                 )
                 .addFilterBefore(new JWTFilter(jwtUtil), LoginFilter.class)
-                .addFilterAt(new LoginFilter(authenticationManager(authenticationConfiguration), jwtUtil), UsernamePasswordAuthenticationFilter.class)
+                .addFilterAt(new LoginFilter(authenticationManager(authenticationConfiguration), jwtUtil, refreshTokenService, usersRepository), UsernamePasswordAuthenticationFilter.class)
                 .sessionManagement((session) -> session
                         .sessionCreationPolicy(SessionCreationPolicy.STATELESS));
 

src/main/java/io/github/petty/users/controller/UsersApiController.java

@@ -1,9 +1,15 @@
 package io.github.petty.users.controller;
 
 import io.github.petty.users.dto.EmailVerificationRequest;
+import io.github.petty.users.dto.RefreshTokenResponseDTO;
 import io.github.petty.users.dto.VerifyCodeRequest;
 import io.github.petty.users.jwt.JWTUtil;
 import io.github.petty.users.service.EmailService;
+import io.github.petty.users.service.RefreshTokenService;
+import io.github.petty.users.util.CookieUtils;
+import jakarta.servlet.http.Cookie;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.ResponseEntity;
 import org.springframework.security.authentication.AnonymousAuthenticationToken;
@@ -13,17 +19,21 @@
 
 import java.util.HashMap;
 import java.util.Map;
+import java.util.UUID;
 
 @RestController
 @RequestMapping("/api")
 public class UsersApiController {
 
     private final JWTUtil jwtUtil;
     private final EmailService emailService;
+    private final RefreshTokenService refreshTokenService;
 
-    public UsersApiController(JWTUtil jwtUtil, EmailService emailService) {
+
+    public UsersApiController(JWTUtil jwtUtil, EmailService emailService, RefreshTokenService refreshTokenService) {
         this.jwtUtil = jwtUtil;
         this.emailService = emailService;
+        this.refreshTokenService = refreshTokenService;
     }
 
     @GetMapping("/users/me")
@@ -62,4 +72,34 @@ public ResponseEntity<Map<String, Object>> verifyCode(@RequestBody VerifyCodeReq
 
         return ResponseEntity.ok(response);
     }
+
+    // 리프레시 토큰 엔드포인트 추가
+    @PostMapping("/auth/refresh")
+    public ResponseEntity<?> refreshToken(
+            @CookieValue(value = "refresh_token", required = false) String refreshToken,
+            HttpServletResponse response) {
+
+        if (refreshToken == null) {
+            return ResponseEntity.status(HttpStatus.UNAUTHORIZED)
+                    .body(Map.of("error", "리프레시 토큰이 없습니다."));
+        }
+
+        try {
+            UUID refreshTokenId = UUID.fromString(refreshToken);
+            RefreshTokenResponseDTO tokenResponse = refreshTokenService.refreshAccessToken(refreshTokenId);
+
+            // 쿠키 설정 코드
+            CookieUtils.setTokenCookies(response,
+                    tokenResponse.getAccessToken(),
+                    UUID.fromString(tokenResponse.getRefreshToken()));
+
+            return ResponseEntity.ok(Map.of("message", "토큰이 갱신되었습니다."));
+        } catch (IllegalArgumentException e) {
+            return ResponseEntity.status(HttpStatus.BAD_REQUEST)
+                    .body(Map.of("error", "유효하지 않은 토큰 형식입니다."));
+        } catch (Exception e) {
+            return ResponseEntity.status(HttpStatus.UNAUTHORIZED)
+                    .body(Map.of("error", e.getMessage()));
+        }
+    }
 }

src/main/java/io/github/petty/users/dto/RefreshTokenResponseDTO.java

@@ -0,0 +1,13 @@
+package io.github.petty.users.dto;
+
+import lombok.AllArgsConstructor;
+import lombok.Getter;
+import lombok.NoArgsConstructor;
+
+@Getter
+@NoArgsConstructor
+@AllArgsConstructor
+public class RefreshTokenResponseDTO {
+    private String accessToken;
+    private String refreshToken;
+}

src/main/java/io/github/petty/users/entity/RefreshToken.java

@@ -0,0 +1,49 @@
+package io.github.petty.users.entity;
+
+import jakarta.persistence.*;
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Getter;
+import lombok.NoArgsConstructor;
+import org.hibernate.annotations.CreationTimestamp;
+
+import java.time.LocalDateTime;
+import java.util.UUID;
+
+@Entity
+@Getter
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+public class RefreshToken {
+    @Id
+    @GeneratedValue(strategy = GenerationType.UUID)
+    private UUID id;
+
+    @ManyToOne(fetch = FetchType.LAZY)
+    @JoinColumn(name = "user_id")
+    private Users user;
+
+    @Column(nullable = false)
+    private String provider;  // 인증 제공자 (local, github 등)
+
+    @CreationTimestamp
+    private LocalDateTime createdAt;
+
+    @Column(nullable = false)
+    private LocalDateTime expiredAt;
+
+    @Column(nullable = false)
+    private boolean used;
+
+    // 토큰을 사용됨으로 표시
+    public void markUsed() {
+        this.used = true;
+    }
+
+    // 토큰이 만료되었는지 확인
+    public boolean isExpired() {
+        return LocalDateTime.now().isAfter(this.expiredAt);
+    }
+
+}

src/main/java/io/github/petty/users/jwt/JWTFilter.java

@@ -28,6 +28,13 @@ public JWTFilter(JWTUtil jwtUtil) {
 
     @Override
     protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
+
+        // 리프레시 엔드포인트는 JWTFilter 검증 Skip
+        if (request.getRequestURI().equals("/api/auth/refresh")) {
+            filterChain.doFilter(request, response);  // 바로 다음 필터/컨트롤러로
+            return;
+        }
+
         String token = null;
 
         // 1. 쿠키에서 토큰 확인

src/main/java/io/github/petty/users/jwt/JWTUtil.java

@@ -2,6 +2,8 @@
 
 import io.jsonwebtoken.ExpiredJwtException;
 import io.jsonwebtoken.Jwts;
+import jakarta.servlet.http.Cookie;
+import jakarta.servlet.http.HttpServletRequest;
 import org.springframework.stereotype.Component;
 
 import javax.crypto.SecretKey;
@@ -50,4 +52,15 @@ public String createJwt(String username, String role, Long expiredMs) {
                 .signWith(secretKey)
                 .compact();
     }
+
+    public String extractRefreshToken(HttpServletRequest request) {
+        if (request.getCookies() != null) {
+            for (Cookie cookie : request.getCookies()) {
+                if ("refresh_token".equals(cookie.getName())) {
+                    return cookie.getValue();  // UUID 문자열을 쿠키에서 가져옴
+                }
+            }
+        }
+        return null;
+    }
 }

src/main/java/io/github/petty/users/jwt/LoginFilter.java

@@ -3,6 +3,10 @@
 import com.fasterxml.jackson.databind.ObjectMapper;
 import io.github.petty.users.dto.CustomUserDetails;
 import io.github.petty.users.dto.LoginDTO;
+import io.github.petty.users.entity.Users;
+import io.github.petty.users.repository.UsersRepository;
+import io.github.petty.users.service.RefreshTokenService;
+import io.github.petty.users.util.CookieUtils;
 import jakarta.servlet.FilterChain;
 import jakarta.servlet.http.Cookie;
 import jakarta.servlet.http.HttpServletRequest;
@@ -19,20 +23,23 @@
 import java.io.IOException;
 import java.util.Collection;
 import java.util.Iterator;
+import java.util.UUID;
 
 public class LoginFilter extends UsernamePasswordAuthenticationFilter {
     private final AuthenticationManager authenticationManager;
     private final JWTUtil jwtUtil;
+    private final RefreshTokenService refreshTokenService;
+    private final UsersRepository usersRepository;
 
     // expirationTime 주입
     @Value("${jwt.expiration-time}")
     private long expirationTime;
 
-    public LoginFilter(AuthenticationManager authenticationManager, JWTUtil jwtUtil) {
-
+    public LoginFilter(AuthenticationManager authenticationManager, JWTUtil jwtUtil, RefreshTokenService refreshTokenService, UsersRepository usersRepository) {
         this.authenticationManager = authenticationManager;
         this.jwtUtil = jwtUtil;
-
+        this.refreshTokenService = refreshTokenService;
+        this.usersRepository = usersRepository;
     }
 
     @Override
@@ -61,26 +68,24 @@ public Authentication attemptAuthentication(HttpServletRequest request, HttpServ
     @Override
     protected void successfulAuthentication(HttpServletRequest request, HttpServletResponse response, FilterChain chain, Authentication authentication) {
         CustomUserDetails customUserDetails = (CustomUserDetails) authentication.getPrincipal();
-
         String username = customUserDetails.getUsername();
 
         Collection<? extends GrantedAuthority> authorities = authentication.getAuthorities();
         Iterator<? extends GrantedAuthority> iterator = authorities.iterator();
         GrantedAuthority auth = iterator.next();
-
         String role = auth.getAuthority();
+
+        // 액세스 토큰 생성
         String token = jwtUtil.createJwt(username, role, 3600000L); // expirationTime
 
-        // JWT 토큰을 쿠키에 저장
-        Cookie jwtCookie = new Cookie("jwt", token);
-        jwtCookie.setHttpOnly(true); // JavaScript 접근 방지 (XSS 방어)
-        jwtCookie.setPath("/"); // 쿠키의 유효 경로
-        // jwtCookie.setSecure(true); // HTTPS 환경에서만 전송 (로컬호스트에서는 생략)
-        int maxAgeSeconds = (int) (3600000L / 1000); // 만료 시간을 초 단위로 변환
-        jwtCookie.setMaxAge(maxAgeSeconds); // 쿠키의 만료 시간 설정
-        response.addCookie(jwtCookie);
+        // 사용자 조회
+        Users user = usersRepository.findByUsername(username);
+
+        // 리프레시 토큰 생성
+        UUID refreshToken = refreshTokenService.createRefreshToken(user);
 
-//      response.addHeader("Authorization", "Bearer " + token);
+        // 쿠키 설정 코드
+        CookieUtils.setTokenCookies(response, token, refreshToken);
     }
 
     //로그인 실패시

src/main/java/io/github/petty/users/oauth2/OAuth2SuccessHandler.java

@@ -1,6 +1,10 @@
 package io.github.petty.users.oauth2;
 
+import io.github.petty.users.entity.Users;
 import io.github.petty.users.jwt.JWTUtil;
+import io.github.petty.users.repository.UsersRepository;
+import io.github.petty.users.service.RefreshTokenService;
+import io.github.petty.users.util.CookieUtils;
 import jakarta.servlet.ServletException;
 import jakarta.servlet.http.Cookie;
 import jakarta.servlet.http.HttpServletRequest;
@@ -11,33 +15,37 @@
 import org.springframework.stereotype.Component;
 
 import java.io.IOException;
+import java.util.UUID;
 
 @Component
 @RequiredArgsConstructor
 public class OAuth2SuccessHandler extends SimpleUrlAuthenticationSuccessHandler {
 
     private final JWTUtil jwtUtil;
+    private final RefreshTokenService refreshTokenService;
+    private final UsersRepository usersRepository;
 
     @Override
     public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response,
                                         Authentication authentication) throws IOException, ServletException {
 
         CustomOAuth2User oAuth2User = (CustomOAuth2User) authentication.getPrincipal();
 
-        // JWT 발급
-        String token = jwtUtil.createJwt(oAuth2User.getEmail(), oAuth2User.getAuthorities().iterator().next().getAuthority(), 3600000L);
+        // 액세스 토큰 생성
+        String token = jwtUtil.createJwt(oAuth2User.getEmail(),
+                oAuth2User.getAuthorities().iterator().next().getAuthority(),
+                3600000L); // 1시간
 
-        // JWT 토큰을 쿠키에 저장
-        Cookie jwtCookie = new Cookie("jwt", token);
-        jwtCookie.setHttpOnly(true); // JavaScript 접근 방지 (XSS 방어)
-        jwtCookie.setPath("/"); // 쿠키의 유효 경로
-        // jwtCookie.setSecure(true); // HTTPS 환경에서만 전송 (로컬호스트에서는 생략)
-        int maxAgeSeconds = (int) (3600000L / 1000); // 만료 시간을 초 단위로 변환
-        jwtCookie.setMaxAge(maxAgeSeconds); // 쿠키의 만료 시간 설정
-        response.addCookie(jwtCookie);
+        // 사용자 조회
+        Users user = usersRepository.findByUsername(oAuth2User.getEmail());
 
-        String targetUrl = "/";
+        // 리프레시 토큰 생성
+        UUID refreshToken = refreshTokenService.createRefreshToken(user);
+
+        // 쿠키 설정 코드
+        CookieUtils.setTokenCookies(response, token, refreshToken);
 
+        String targetUrl = "/";
         getRedirectStrategy().sendRedirect(request, response, targetUrl);
     }
 }