☕ 스프링 부트로 보안 강화된 마이크로서비스 개발하기

// 1단계: Maven 의존성 추가
<dependencies>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-web</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-security</artifactId>
    </dependency>
    <dependency>
        <groupId>io.jsonwebtoken</groupId>
        <artifactId>jjwt-api</artifactId>
        <version>0.11.5</version>
    </dependency>
    <dependency>
        <groupId>io.jsonwebtoken</groupId>
        <artifactId>jjwt-impl</artifactId>
        <version>0.11.5</version>
        <scope>runtime</scope>
    </dependency>
    <dependency>
        <groupId>io.jsonwebtoken</groupId>
        <artifactId>jjwt-jackson</artifactId>
        <version>0.11.5</version>
        <scope>runtime</scope>
    </dependency>
</dependencies>

// 2단계: Spring Security 구성
@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .csrf().disable()
            .authorizeRequests()
                .antMatchers("/api/**").authenticated()
                .anyRequest().permitAll()
            .and()
            .addFilterBefore(new JwtAuthenticationFilter(), UsernamePasswordAuthenticationFilter.class);
    }
}

// 3단계: mTLS 설정 (Spring Cloud Gateway)
application.yml 파일에 다음을 추가합니다.
security:
  ssl:
    key-store:
      type: PKCS12
      location: classpath:keystore.p12
      password: keystore-password
      certificate-chain-location: classpath:truststore.cer
      trust-store:
        type: PEM
        location: classpath:truststore.pem
        password: truststore-password
    key-store-alias: mykey

// 4단계: 토큰 발급 및 검증 필터 작성
public class JwtAuthenticationFilter extends OncePerRequestFilter {
    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
        String token = extractToken(request);
        if (token != null && validateToken(token)) {
            UsernamePasswordAuthenticationToken authentication = getAuthentication(token);
            SecurityContextHolder.getContext().setAuthentication(authentication);
        }
        filterChain.doFilter(request, response);
    }

    private String extractToken(HttpServletRequest request) {
        // 토큰 추출 로직 추가
        return null;
    }

    private boolean validateToken(String token) {
        // 토큰 검증 로직 추가
        return true;
    }

    private UsernamePasswordAuthenticationToken getAuthentication(String token) {
        // 인증 정보 생성 로직 추가
        return new UsernamePasswordAuthenticationToken("user", "password", Collections.emptyList());
    }
}