refactor : refresh토큰 Swagger 전달 이슈 해결 #79
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
minjee2758
requested review from
Kimminu7,
NCookies,
chat26666,
pokerbearkr and
thezz9
|
""" WalkthroughSwagger 설정에 JWT 리프레시 토큰을 위한 별도의 시큐리티 스키마 "JWT_REFRESH"가 추가되었습니다. 이에 맞춰 AuthController의 리프레시 엔드포인트에서 헤더 키를 "Authorization"에서 "JWT_REFRESH"로 변경하고, Swagger 문서의 시큐리티 요구사항도 해당 스키마로 교체하였습니다. Changes
Sequence Diagram(s)sequenceDiagram
participant Client
participant AuthController
participant SwaggerConfig
Client->>AuthController: /refresh 요청 (JWT_REFRESH 헤더 포함)
AuthController->>AuthController: JWT_REFRESH 헤더에서 토큰 추출
AuthController-->>Client: 새 토큰 응답
note over AuthController,SwaggerConfig: SwaggerConfig에 JWT_REFRESH 스키마 등록
note over Client,AuthController: Swagger 문서에서 JWT_REFRESH 요구
Possibly related PRs
Suggested reviewers
Poem
📜 Recent review detailsConfiguration used: CodeRabbit UI 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
⏰ Context from checks skipped due to timeout of 90000ms (1)
✨ Finishing Touches
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
src/main/java/org/ezcode/codetest/presentation/usermanagement/AuthController.java (1)
74-74: 로그 메시지를 제거하는 것을 고려해보세요.개발용 로그 메시지가 남아있습니다. PR 체크리스트에 따라 불필요한 로그는 제거하는 것을 권장합니다.
- log.info("Refresh token 추출 : {}", token);
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
src/main/java/org/ezcode/codetest/infrastructure/swagger/config/SwaggerConfig.java(2 hunks)src/main/java/org/ezcode/codetest/presentation/usermanagement/AuthController.java(2 hunks)
⏰ Context from checks skipped due to timeout of 90000ms (1)
- GitHub Check: build
🔇 Additional comments (4)
src/main/java/org/ezcode/codetest/infrastructure/swagger/config/SwaggerConfig.java (1)
6-6: import 추가가 적절합니다.SecuritySchemeIn enum을 사용하기 위한 import가 올바르게 추가되었습니다.
src/main/java/org/ezcode/codetest/presentation/usermanagement/AuthController.java (3)
24-24: import 변경이 적절합니다.SecurityRequirement 사용을 위한 import 변경이 올바르게 적용되었습니다.
65-66: Swagger 보안 요구사항이 올바르게 추가되었습니다.JWT_REFRESH 스키마를 참조하는 보안 요구사항이 적절하게 설정되어 Swagger UI에서 refresh 토큰을 사용할 수 있게 되었습니다.
70-72: 다음 스크립트로 전체 코드베이스에서Authorization헤더 사용 현황을 추가로 확인해주세요:#!/bin/bash # 전체 코드에서 request.getHeader("Authorization") 및 @RequestHeader("Authorization") 사용 현황 확인 echo "== request.getHeader(\"Authorization\") 사용 ==" rg -n 'request\.getHeader\("Authorization"' --type java echo echo "== @RequestHeader(\"Authorization\") 사용 ==" rg -n '@RequestHeader\(\s*"Authorization"' --type java
Comment on lines
23
to
29
| @SecurityScheme( | ||
| name = "JWT_REFRESH", // refreshToken용 | ||
| type = SecuritySchemeType.APIKEY, | ||
| in = SecuritySchemeIn.HEADER, | ||
| scheme = "bearer", | ||
| bearerFormat = "JWT" | ||
| ) |
There was a problem hiding this comment.
🛠️ Refactor suggestion
보안 스키마 설정에 일관성 문제가 있습니다.
SecuritySchemeType.APIKEY를 사용하면서 scheme과 bearerFormat을 설정하는 것은 부적절합니다. Bearer 토큰 형태로 사용하려면 HTTP 타입을 사용해야 합니다.
다음과 같이 수정하는 것을 권장합니다:
@SecurityScheme(
name = "JWT_REFRESH", // refreshToken용
- type = SecuritySchemeType.APIKEY,
- in = SecuritySchemeIn.HEADER,
+ type = SecuritySchemeType.HTTP,
scheme = "bearer",
bearerFormat = "JWT"
)또는 실제로 커스텀 헤더 키를 사용한다면:
@SecurityScheme(
name = "JWT_REFRESH", // refreshToken용
type = SecuritySchemeType.APIKEY,
in = SecuritySchemeIn.HEADER,
- scheme = "bearer",
- bearerFormat = "JWT"
+ parameterName = "JWT_REFRESH"
)📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| @SecurityScheme( | |
| name = "JWT_REFRESH", // refreshToken용 | |
| type = SecuritySchemeType.APIKEY, | |
| in = SecuritySchemeIn.HEADER, | |
| scheme = "bearer", | |
| bearerFormat = "JWT" | |
| ) | |
| @SecurityScheme( | |
| name = "JWT_REFRESH", // refreshToken용 | |
| - type = SecuritySchemeType.APIKEY, | |
| - in = SecuritySchemeIn.HEADER, | |
| + type = SecuritySchemeType.HTTP, | |
| scheme = "bearer", | |
| bearerFormat = "JWT" | |
| ) |
Suggested change
| @SecurityScheme( | |
| name = "JWT_REFRESH", // refreshToken용 | |
| type = SecuritySchemeType.APIKEY, | |
| in = SecuritySchemeIn.HEADER, | |
| scheme = "bearer", | |
| bearerFormat = "JWT" | |
| ) | |
| @SecurityScheme( | |
| name = "JWT_REFRESH", // refreshToken용 | |
| type = SecuritySchemeType.APIKEY, | |
| in = SecuritySchemeIn.HEADER, | |
| - scheme = "bearer", | |
| - bearerFormat = "JWT" | |
| + parameterName = "JWT_REFRESH" | |
| ) |
🤖 Prompt for AI Agents
In
src/main/java/org/ezcode/codetest/infrastructure/swagger/config/SwaggerConfig.java
around lines 23 to 29, the SecurityScheme annotation incorrectly uses
type=APIKEY together with scheme and bearerFormat, which is inconsistent. To fix
this, change the type to HTTP if you want to use a bearer token scheme, or if
you intend to use a custom header key, keep APIKEY but remove scheme and
bearerFormat. Adjust the annotation accordingly to ensure the security scheme
configuration is consistent.
pokerbearkr
approved these changes
Jun 19, 2025
thezz9
approved these changes
Jun 19, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
작업 내용
참고 사항
코드 리뷰 전 확인 체크리스트
type :)Summary by CodeRabbit
신규 기능
버그 수정