Feat: 쿠키 보안 설정 동적 적용

build.gradle

@@ -40,7 +40,6 @@ dependencies {
     annotationProcessor "jakarta.persistence:jakarta.persistence-api"
 
     implementation 'com.querydsl:querydsl-jpa:5.0.0:jakarta'
-//    annotationProcessor 'com.querydsl:querydsl-apt:5.0.0:jpa'
     annotationProcessor 'com.querydsl:querydsl-apt:5.0.0:jakarta'
 
 

src/main/java/org/nova/backend/board/common/domain/model/valueobject/PostType.java

@@ -10,7 +10,8 @@ public enum PostType {
     INTRODUCTION("자기소개", BoardCategory.INTEGRATED),
     NOTICE("공지사항", BoardCategory.INTEGRATED),
     EXAM_ARCHIVE("족보 게시판", BoardCategory.CLUB_ARCHIVE),
-    PICTURES("사진 게시판", BoardCategory.CLUB_ARCHIVE);
+    PICTURES("사진 게시판", BoardCategory.CLUB_ARCHIVE),
+    SUGGESTION("건의 게시판", null);
 
     private final String displayName;
     private final BoardCategory category;

src/main/java/org/nova/backend/board/suggestion/application/service/SuggestionPostService.java

@@ -1,5 +1,6 @@
 package org.nova.backend.board.suggestion.application.service;
 
+import org.nova.backend.board.common.domain.model.valueobject.PostType;
 import org.nova.backend.notification.application.port.in.NotificationUseCase;
 import org.nova.backend.notification.domain.model.entity.valueobject.EventType;
 import org.springframework.transaction.annotation.Transactional;
@@ -165,7 +166,7 @@ public SuggestionReplyResponse addAdminReply(
                 post.getMember().getId(),
                 EventType.SUGGESTION_ANSWERED,
                 post.getId(),
-                null,
+                PostType.SUGGESTION,
                 admin.getName()
         );
 

src/main/java/org/nova/backend/shared/config/QuerydslConfig.java

@@ -5,7 +5,7 @@
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 
-@Configuration
+@Configuration(proxyBeanMethods = false)
 public class QuerydslConfig {
 
     private final EntityManager entityManager;

src/main/java/org/nova/backend/shared/config/RedisConfig.java

@@ -8,7 +8,7 @@
 import org.springframework.data.redis.connection.lettuce.LettuceConnectionFactory;
 import org.springframework.data.redis.core.RedisTemplate;
 
-@Configuration
+@Configuration(proxyBeanMethods = false)
 @EnableCaching
 public class RedisConfig {
 

src/main/java/org/nova/backend/shared/config/SecurityConfig.java

@@ -8,6 +8,7 @@
 import org.nova.backend.shared.jwt.JWTUtil;
 import org.nova.backend.shared.security.CORSFilter;
 import org.nova.backend.shared.security.LoginFilter;
+import org.springframework.beans.factory.annotation.Value;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.http.HttpMethod;
@@ -25,18 +26,21 @@
 
 import java.util.Set;
 
-@Configuration
+@Configuration(proxyBeanMethods = false)
 @EnableWebSecurity
 @RequiredArgsConstructor
 public class SecurityConfig {
 
+    private static final String POST_BASE = "/api/v1/boards/{boardId}/posts";
     private final AuthenticationConfiguration authenticationConfiguration;
     private final JWTUtil jwtUtil;
 
-    @Bean
-    public AuthenticationManager authenticationManager(AuthenticationConfiguration configuration) throws Exception {
+    @Value("${cookie.secure}")
+    private boolean isSecureCookie;
 
-        return configuration.getAuthenticationManager();
+    @Bean
+    public AuthenticationManager authenticationManager() throws Exception {
+        return authenticationConfiguration.getAuthenticationManager();
     }
 
     @Bean
@@ -46,7 +50,10 @@ public BCryptPasswordEncoder bCryptPasswordEncoder() {
     }
 
     @Bean
-    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
+    public SecurityFilterChain filterChain(
+            HttpSecurity http,
+            AuthenticationManager authManager
+    ) throws Exception {
 
         http
                 .csrf(AbstractHttpConfigurer::disable);
@@ -58,7 +65,7 @@ public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
                 .httpBasic(AbstractHttpConfigurer::disable);
 
         http
-                .authorizeHttpRequests((auth) -> {
+                .authorizeHttpRequests(auth -> {
                     auth.requestMatchers("/files/public/**").permitAll();
 
                     //건의 게시판 관련 권한
@@ -90,11 +97,16 @@ public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
                 .addFilterBefore(new JWTFilter(jwtUtil), LoginFilter.class);
 
         http
-                .addFilterAt(new LoginFilter(authenticationManager(authenticationConfiguration), jwtUtil),
+                .addFilterAt(
+                        new LoginFilter(
+                                authManager,
+                                jwtUtil,
+                                isSecureCookie
+                        ),
                         UsernamePasswordAuthenticationFilter.class);
 
         http
-                .sessionManagement((session) -> session
+                .sessionManagement(session -> session
                         .sessionCreationPolicy(SessionCreationPolicy.STATELESS));
 
         return http.build();
@@ -166,11 +178,11 @@ private void configureBoardPermissions(
                 ).permitAll()
 
                 // 로그인한 사용자만 접근 가능한 API (일반 게시글 작성, 수정)
-                .requestMatchers(HttpMethod.POST, "/api/v1/boards/{boardId}/posts")
+                .requestMatchers(HttpMethod.POST, POST_BASE)
                 .authenticated()
 
                 // 공지사항 게시판의 게시글 작성 & 수정 (관리자 & 회장만)
-                .requestMatchers(HttpMethod.POST, "/api/v1/boards/{boardId}/posts")
+                .requestMatchers(HttpMethod.POST, POST_BASE)
                 .hasAnyRole(Role.ADMINISTRATOR.toString(), Role.CHAIRMAN.toString());
     }
 

src/main/java/org/nova/backend/shared/config/SwaggerConfig.java

@@ -6,7 +6,7 @@
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 
-@Configuration
+@Configuration(proxyBeanMethods = false)
 public class SwaggerConfig {
 
     // 게시판 전용 API 그룹

src/main/java/org/nova/backend/shared/security/LoginFilter.java

@@ -24,10 +24,16 @@ public class LoginFilter extends UsernamePasswordAuthenticationFilter {
 
     private final AuthenticationManager authenticationManager;
     private final JWTUtil jwtUtil;
+    private final boolean isSecureCookie;
 
-    public LoginFilter(AuthenticationManager authenticationManager, JWTUtil jwtUtil) {
+    public LoginFilter(
+            AuthenticationManager authenticationManager,
+            JWTUtil jwtUtil,
+            boolean isSecureCookie
+    ) {
         this.authenticationManager = authenticationManager;
         this.jwtUtil = jwtUtil;
+        this.isSecureCookie = isSecureCookie;
 
         setFilterProcessesUrl("/api/v1/members/login");
     }
@@ -71,8 +77,13 @@ protected void successfulAuthentication(HttpServletRequest request, HttpServletR
         Cookie cookie = new Cookie("AUTH_TOKEN", token);
         cookie.setHttpOnly(true);
         cookie.setPath("/");
-        cookie.setMaxAge(60 * 60 * 10); // 10시간
-        response.addCookie(cookie);
+        cookie.setMaxAge(60 * 60 * 5); // 5시간
+
+        response.setHeader("Set-Cookie", String.format(
+                "AUTH_TOKEN=%s; Path=/; Max-Age=%d; HttpOnly; SameSite=Strict%s",
+                token, 60 * 60 * 5,
+                isSecureCookie ? "; Secure" : ""
+        ));
     }
 
     /*

src/main/resources/application-deploy.yml

@@ -16,5 +16,8 @@ spring:
     livereload:
       enabled: false
 
+cookie:
+  secure: true
+
 app:
   domain: https://nova.cbnu.ac.kr

src/main/resources/application-local.yml

@@ -16,6 +16,9 @@ spring:
     livereload:
       enabled: false
 
+cookie:
+  secure: false
+
 logging:
   level:
     org.springframework.security: DEBUG

src/main/resources/application.yml

@@ -55,6 +55,9 @@ jwt:
   secret:
     key: ${JWT_SECRET_KEY}
 
+cookie:
+  same-site: Strict
+
 springdoc:
   api-docs:
     enabled: true

src/main/resources/db/migration/V6__update_null_target_type_to_suggestion.sql

@@ -0,0 +1,3 @@
+UPDATE notification
+SET target_type = 'SUGGESTION'
+WHERE event_type = 'SUGGESTION_ANSWERED' AND target_type IS NULL;

src/test/resources/application-test.yml

@@ -40,5 +40,8 @@ admin:
     number: test-admin
   password: admin1234
 
+cookie:
+  secure: false
+
 app:
   domain: http://localhost:9999