hotfix #143
Merged
hotfix #143
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
WalkthroughCORS 설정에 PATCH 메서드를 허용하도록 변경하였고, chat-page.html에 SockJS와 STOMP.js 외부 스크립트가 추가되어 웹소켓 및 STOMP 프로토콜을 사용할 수 있도록 수정되었습니다. Changes
Sequence Diagram(s)sequenceDiagram
participant Browser
participant Server
Browser->>Server: HTTP 요청 (PATCH 포함)
Server-->>Browser: CORS 정책에 따라 응답
Browser->>Browser: SockJS, STOMP.js 스크립트 로딩
Browser->>Server: WebSocket/STOMP 연결 시도
Server-->>Browser: WebSocket/STOMP 통신
Possibly related PRs
Suggested reviewers
Poem
✨ Finishing Touches
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
thezz9
approved these changes
Jul 5, 2025
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🔭 Outside diff range comments (1)
src/main/java/org/ezcode/codetest/common/security/config/SecurityConfig.java (1)
144-149: CORS 설정: 와일드카드(*) + 자격 증명 허용(true) 조합 문제 해결 필요Spring CORS 스펙상
Access-Control-Allow-Origin: *
와
Access-Control-Allow-Credentials: true
는 함께 전송할 수 없으므로, 현재 코드대로면 브라우저에서 CORS 오류가 발생합니다.해결 방안:
- 프런트엔드 도메인이 고정되어 있다면
*대신 구체적인 오리진을 나열하세요.- 여러 도메인을 지원해야 한다면
allowedOriginPatterns에 지원할 도메인만 명시하고*패턴은 제거해야 합니다.수정 예시 (
SecurityConfig.java144–149줄):- configuration.setAllowedOriginPatterns(List.of("*")); + configuration.setAllowedOriginPatterns(List.of( + "https://ezcode.my", + "https://stage.ezcode.my" + )); configuration.setAllowedMethods(List.of("GET", "POST", "PUT", "DELETE", "OPTIONS", "PATCH")); configuration.setAllowedHeaders(List.of("*")); configuration.setExposedHeaders(List.of("*")); configuration.setAllowCredentials(true);
- PATCH 메서드 추가는 적절하지만, 위 오리진 설정 충돌을 우선 해결해야 실제 요청이 성공합니다.
- 필요하다면
application.yml또는 환경 변수로 허용 오리진 목록을 관리하는 방안도 고려해 주세요.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
src/main/java/org/ezcode/codetest/common/security/config/SecurityConfig.java(1 hunks)src/main/resources/templates/chat-page.html(1 hunks)
🧰 Additional context used
🧠 Learnings (1)
📓 Common learnings
Learnt from: chat26666
PR: ezcode-my/backend#37
File: src/main/java/org/ezcode/codetest/infrastructure/elasticsearch/repository/ProblemElasticsearchRepositoryDsl.java:10-10
Timestamp: 2025-06-06T19:56:27.759Z
Learning: When user chat26666 mentions that code was implemented in a previous PR but explanation was missing, they may submit a follow-up PR just to add documentation/explanation without the actual implementation code.
⏰ Context from checks skipped due to timeout of 90000ms (1)
- GitHub Check: build
Comment on lines
+4
to
+5
| <script src="https://cdn.jsdelivr.net/npm/sockjs-client@1/dist/sockjs.min.js"></script> | ||
| <script src="https://cdn.jsdelivr.net/npm/[email protected]/lib/stomp.min.js"></script> |
There was a problem hiding this comment.
🛠️ Refactor suggestion
CDN 스크립트에 SRI(Subresource Integrity) 해시를 추가해 공급망 공격을 방지하세요
외부 CDN 자원을 불러올 때는 무결성 검증을 위해 integrity 및 crossorigin="anonymous" 속성을 추가하는 것이 보안 모범 사례입니다.
-<script src="https://cdn.jsdelivr.net/npm/sockjs-client@1/dist/sockjs.min.js"></script>
-<script src="https://cdn.jsdelivr.net/npm/[email protected]/lib/stomp.min.js"></script>
+<!-- TODO: real SRI 해시 값으로 교체 -->
+<script
+ src="https://cdn.jsdelivr.net/npm/sockjs-client@1/dist/sockjs.min.js"
+ integrity="sha384-<CALCULATED_HASH>"
+ crossorigin="anonymous"></script>
+<script
+ src="https://cdn.jsdelivr.net/npm/[email protected]/lib/stomp.min.js"
+ integrity="sha384-<CALCULATED_HASH>"
+ crossorigin="anonymous"></script>적용 후 브라우저 캐시가 갱신되지 않을 경우 4xx 오류가 발생할 수 있으니 배포 전 로컬에서 무결성 해시가 올바른지 검증하세요.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| <script src="https://cdn.jsdelivr.net/npm/sockjs-client@1/dist/sockjs.min.js"></script> | |
| <script src="https://cdn.jsdelivr.net/npm/[email protected]/lib/stomp.min.js"></script> | |
| <!-- TODO: real SRI 해시 값으로 교체 --> | |
| <script | |
| src="https://cdn.jsdelivr.net/npm/sockjs-client@1/dist/sockjs.min.js" | |
| integrity="sha384-<CALCULATED_HASH>" | |
| crossorigin="anonymous"></script> | |
| <script | |
| src="https://cdn.jsdelivr.net/npm/[email protected]/lib/stomp.min.js" | |
| integrity="sha384-<CALCULATED_HASH>" | |
| crossorigin="anonymous"></script> |
🤖 Prompt for AI Agents
In src/main/resources/templates/chat-page.html at lines 4 to 5, the script tags
loading external CDN resources lack Subresource Integrity (SRI) attributes. To
fix this, generate the correct SRI hash for each CDN script and add the
integrity attribute along with crossorigin="anonymous" to both script tags.
Verify the hashes locally before deployment to avoid caching issues or 4xx
errors.
minjee2758
approved these changes
Jul 5, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
작업 내용
변경 사항
UserService.createUser()메서드 추가@Email유효성 검증 적용트러블 슈팅
@Transactional이 적용되지 않음this.→AopProxyUtils.사용)해결해야 할 문제
UserController에서 비즈니스 로직 일부 처리 → 서비스로 이전 고려 필요참고 사항
코드 리뷰 전 확인 체크리스트
type :)Summary by CodeRabbit
새로운 기능
기타