Feat/jwt 필터 추가 #2

GoGradually · 2025-12-30T13:55:25Z

변경된 점

jwt 인증용 필터 추가
k3s용 deployment/service 추가
cors 설정 추가
ci/cd 기본 설정 적용

- cors 관리를 스프링 시큐리티에서 수행하도록 변경

…Member-Id 헤더로 변환 기능 구현

Copilot

Pull request overview

This PR introduces JWT authentication to the gateway service, transforming it into a centralized authentication point for the microservices architecture. The implementation adds security filters, CORS configuration, and deployment manifests for Kubernetes (k3s) environments.

Key Changes:

JWT authentication filter with RSA public key verification
CORS configuration for cross-origin requests
Gateway filter to extract member ID from JWT and forward as custom header
Kubernetes deployment, service, and ingress configurations
CI/CD pipelines for automated testing and deployment

Reviewed changes

Copilot reviewed 17 out of 18 changed files in this pull request and generated 11 comments.

Show a summary per file

File	Description
`src/main/java/me/pinitgateway/security/SecurityConfig.java`	Defines security filter chains with JWT authentication and public endpoint exceptions
`src/main/java/me/pinitgateway/security/JwtAuthenticationProvider.java`	Implements reactive authentication manager for JWT validation
`src/main/java/me/pinitgateway/security/CorsProperties.java`	Configuration properties class for CORS settings
`src/main/java/me/pinitgateway/jwt/JwtTokenProvider.java`	Handles JWT parsing, validation, and claims extraction using RSA public key
`src/main/java/me/pinitgateway/jwt/JwtAuthenticationToken.java`	Custom authentication token for JWT-based authentication
`src/main/java/me/pinitgateway/jwt/JwtAuthenticationFilter.java`	WebFlux filter to extract and authenticate JWT from Authorization header
`src/main/java/me/pinitgateway/jwt/RsaKeyProvider.java`	Utility to load RSA public key from PEM file
`src/main/java/me/pinitgateway/filter/JwtSubToMemberIdHeaderGatewayFilterFactory.java`	Gateway filter to forward member ID from JWT as X-Member-Id header to downstream services
`src/main/resources/application-prod.yml`	Production configuration with gateway routes and JWT filter registration
`src/main/resources/application-dev.yml`	Development configuration with local service routing
`src/test/resources/application.yml`	Test configuration with CORS and JWT public key path
`src/test/resources/jwt-public-key.pem`	RSA public key for test environment
`k8s/deployment.yaml`	Kubernetes deployment manifest with rolling update strategy and health probes
`k8s/service.yaml`	Kubernetes service definition for gateway
`k8s/ingress.yaml`	Updates ingress to route all traffic through gateway service
`.github/workflows/ci.yaml`	CI workflow for build and test on pull requests
`.github/workflows/cd.yml`	CD workflow for build, push, and deploy to k3s cluster
`build.gradle`	Adds JJWT dependencies for JWT handling

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2025-12-30T13:58:45Z

src/main/java/me/pinitgateway/security/SecurityConfig.java

+ * 현재 필터 규칙
+ * - /actuator/health/liveness : 인증 안함
+ * - /actuator/health/readiness : 인증 안함
+ * - /v3/** : 인증 안함
+ * - /swagger-ui/** : 인증 안함
+ * - /async-api/** : 인증 안함
+ * - auth host + /login : 인증 안함
+ * - auth host + /signup : 인증 안함
+ * - auth host + /refresh : 인증 안함
+ * - auth host + /login/** : 인증 안함
+ * - 그 외 : 인증 필요


The comment is in Korean while the code uses English. For consistency and international collaboration, code comments should be in English.

Suggested change

* 현재 필터 규칙

* - /actuator/health/liveness : 인증 안함

* - /actuator/health/readiness : 인증 안함

* - /v3/** : 인증 안함

* - /swagger-ui/** : 인증 안함

* - /async-api/** : 인증 안함

* - auth host + /login : 인증 안함

* - auth host + /signup : 인증 안함

* - auth host + /refresh : 인증 안함

* - auth host + /login/** : 인증 안함

* - 그 외 : 인증 필요

* Current filter rules:

* - /actuator/health/liveness : no authentication

* - /actuator/health/readiness : no authentication

* - /v3/** : no authentication

* - /swagger-ui/** : no authentication

* - /async-api/** : no authentication

* - auth host + /login : no authentication

* - auth host + /signup : no authentication

* - auth host + /refresh : no authentication

* - auth host + /login/** : no authentication

* - all other requests : authentication required

Copilot · 2025-12-30T13:58:46Z

k8s/deployment.yaml

+            defaultMode: 0444
+      containers:
+        - name: app
+          image: ghcr.io/pinit-scheduler/pinit-gateway/app:${GITHUB_SHA} # GITHUB_SHA 환경변수는 GitHub Actions에서 설정되며 envsubst로 치환됩니다.


The comment is in Korean while the code uses English. For consistency, code comments should be in English.

Suggested change

image: ghcr.io/pinit-scheduler/pinit-gateway/app:${GITHUB_SHA} # GITHUB_SHA 환경변수는 GitHub Actions에서 설정되며 envsubst로 치환됩니다.

image: ghcr.io/pinit-scheduler/pinit-gateway/app:${GITHUB_SHA} # The GITHUB_SHA environment variable is set by GitHub Actions and substituted using envsubst.

Copilot · 2025-12-30T13:58:46Z

src/main/java/me/pinitgateway/filter/JwtSubToMemberIdHeaderGatewayFilterFactory.java

+
+    private ServerWebExchange mutateHeader(ServerWebExchange exchange, String sub) {
+        var request = exchange.getRequest().mutate()
+                // 외부에서 X-Member-Id를 임의로 넣어오는 spoofing 방지


The comment is in Korean while code and other comments use English. For consistency, code comments should be in English.

Copilot · 2025-12-30T13:58:46Z

src/main/java/me/pinitgateway/jwt/JwtTokenProvider.java

+        } catch (Exception e) {
+            return false;
+        }


The token validation catches all exceptions and returns false, hiding potentially important error information. While this prevents information leakage, it makes debugging difficult. Consider logging the exception with appropriate detail (avoiding sensitive information) to help with troubleshooting authentication issues.

Copilot · 2025-12-30T13:58:46Z

src/main/java/me/pinitgateway/filter/JwtSubToMemberIdHeaderGatewayFilterFactory.java

+                        .flatMap(auth -> {
+                            String sub = extractSub(auth);
+
+                            // JWT 검증은 SecurityWebFilterChain에서 이미 처리되었으므로, sub이 없으면 그대로 진행


The comment is in Korean while code uses English. For consistency, code comments should be in English.

Copilot · 2025-12-30T13:58:47Z

src/test/resources/application.yml

+    - OPTIONS
+  allowed-headers:
+    - "*"
+  allow-credentials: true


The CORS configuration allows all origins with credentials enabled, which is a security vulnerability. When allow-credentials is true, allowed-origins cannot be "*" as this exposes the application to CSRF attacks from any origin. Either set specific origins for testing or set allow-credentials to false.

Suggested change

allow-credentials: true

allow-credentials: false

Copilot · 2025-12-30T13:58:47Z

src/main/java/me/pinitgateway/jwt/JwtAuthenticationFilter.java

+    private Mono<Void> handleAuthenticationError(ServerWebExchange exchange) {
+        exchange.getResponse().setStatusCode(HttpStatus.UNAUTHORIZED);
+        return exchange.getResponse().setComplete();


The authentication error handler returns a generic 401 Unauthorized status without a response body. This provides no information about why authentication failed, making it difficult for API consumers to debug issues. Consider adding an error message body with details about the authentication failure.

Copilot · 2025-12-30T13:58:48Z

src/main/java/me/pinitgateway/jwt/JwtTokenProvider.java

+    public boolean validateToken(String token) {
+        try {
+            Claims claims = parse(token);
+            return !claims.getExpiration().before(new Date());


Missing null check for parsed claims before calling getExpiration(). If token parsing succeeds but the claims don't contain an expiration, this could throw a NullPointerException. The null check should be added or the exception should be explicitly handled.

Suggested change

return !claims.getExpiration().before(new Date());

Date expiration = claims.getExpiration();

if (expiration == null) {

return false;

}

return !expiration.before(new Date());

Copilot · 2025-12-30T13:58:48Z

src/main/java/me/pinitgateway/jwt/JwtAuthenticationToken.java

+    @Override
+    public void setAuthenticated(boolean isAuthenticated) {
+        if (isAuthenticated) {
+            throw new IllegalArgumentException("인증 상태 설정은 생성자에서만 할 수 있습니다.");


The error message is in Korean while the rest of the codebase appears to use English. For consistency and international collaboration, error messages should be in English.

Suggested change

throw new IllegalArgumentException("인증 상태 설정은 생성자에서만 할 수 있습니다.");

throw new IllegalArgumentException("Authentication state can only be set in the constructor.");

Copilot · 2025-12-30T13:58:48Z

src/main/java/me/pinitgateway/jwt/JwtTokenProvider.java

+    }
+
+    public Long getMemberId(String token) {
+        return Long.parseLong(parse(token).getSubject());


Potential uncaught 'java.lang.NumberFormatException'.

Suggested change

return Long.parseLong(parse(token).getSubject());

String subject = parse(token).getSubject();

if (subject == null) {

return null;

}

try {

return Long.parseLong(subject);

} catch (NumberFormatException e) {

return null;

}

GoGradually added 21 commits December 30, 2025 15:56

build: CI 설정 파일 추가

937a57e

feat: JWT 키 경로 추가

efe1bea

feat: pinit-gateway 배포 설정 추가

c339cb8

feat: CORS 설정 추가 및 JWT 키 경로 수정

dee419f

feat: JWT 라이브러리 추가

abcbaa6

feat: JWT 필터 추가 및 CORS 설정 수정

be9e8aa

feat: pinit-gateway CD 설정 추가

a1091a5

feat: deployment.yaml에서 환경 변수 설정 제거

517ea1f

test: application.yml 및 JWT 공개 키 파일 추가

e40c034

feat: CORS 설정을 위한 CorsProperties 클래스 추가

125663e

- cors 관리를 스프링 시큐리티에서 수행하도록 변경

feat: deployment.yaml에서 gRPC 포트 설정 제거

38f68a4

fix: pinit-task의 이름을 pinit-gateway로 변경

e0ef3d7

feat: ingress.yaml에서 서비스 이름을 gateway-service로 변경

d7b4104

feat: service.yaml 파일 추가 및 gateway-service 설정

3eca4d9

feat: JwtAuthenticationToken 클래스 추가

64eeb74

feat: JwtTokenProvider 클래스 추가 및 JWT 토큰 검증 기능 구현

a4e3b48

feat: JwtAuthenticationProvider 클래스 추가 및 JWT 인증 기능 구현

028e7c8

feat: JwtAuthenticationFilter 클래스 추가 및 JWT 인증 필터링 기능 구현

3903516

feat: RsaKeyProvider 클래스 추가 및 RSA 공개 키 로딩 기능 구현

3aa5464

feat: SecurityConfig 클래스 추가 및 JWT 인증 설정 구현

d7bf69d

feat: JwtSubToMemberIdHeaderGatewayFilterFactory 클래스 추가 및 JWT sub을 X-…

477dd9d

…Member-Id 헤더로 변환 기능 구현

Copilot AI review requested due to automatic review settings December 30, 2025 13:55

Copilot started reviewing on behalf of GoGradually December 30, 2025 13:55 View session

Copilot AI reviewed Dec 30, 2025

View reviewed changes

docs: 코드 리뷰 코멘트 작성 지침 추가

1b99af8

GoGradually merged commit 364fd0a into master Dec 30, 2025
1 check passed

GoGradually deleted the feat/jwt-필터-추가 branch December 30, 2025 14:03

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Feat/jwt 필터 추가 #2

Feat/jwt 필터 추가 #2

Uh oh!

GoGradually commented Dec 30, 2025

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Dec 30, 2025

Uh oh!

Copilot AI Dec 30, 2025

Uh oh!

Copilot AI Dec 30, 2025

Uh oh!

Copilot AI Dec 30, 2025

Uh oh!

Copilot AI Dec 30, 2025

Uh oh!

Copilot AI Dec 30, 2025

Uh oh!

Copilot AI Dec 30, 2025

Uh oh!

Copilot AI Dec 30, 2025

Uh oh!

Copilot AI Dec 30, 2025

Uh oh!

Copilot AI Dec 30, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	image: ghcr.io/pinit-scheduler/pinit-gateway/app:${GITHUB_SHA} # GITHUB_SHA 환경변수는 GitHub Actions에서 설정되며 envsubst로 치환됩니다.
	image: ghcr.io/pinit-scheduler/pinit-gateway/app:${GITHUB_SHA} # The GITHUB_SHA environment variable is set by GitHub Actions and substituted using envsubst.

-            return !claims.getExpiration().before(new Date());
+            Date expiration = claims.getExpiration();
+            if (expiration == null) {
+                return false;
+            }
+            return !expiration.before(new Date());

	throw new IllegalArgumentException("인증 상태 설정은 생성자에서만 할 수 있습니다.");
	throw new IllegalArgumentException("Authentication state can only be set in the constructor.");

-        return Long.parseLong(parse(token).getSubject());
+        String subject = parse(token).getSubject();
+        if (subject == null) {
+            return null;
+        }
+        try {
+            return Long.parseLong(subject);
+        } catch (NumberFormatException e) {
+            return null;
+        }

Feat/jwt 필터 추가 #2

Feat/jwt 필터 추가 #2

Uh oh!

Conversation

GoGradually commented Dec 30, 2025

변경된 점

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Dec 30, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 30, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 30, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 30, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 30, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 30, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 30, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 30, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 30, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 30, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants