Skip to content

[chore] 운영서버 배포 25/08/14#218

Merged
seongjunnoh merged 7 commits intomainfrom
develop
Aug 13, 2025
Merged

[chore] 운영서버 배포 25/08/14#218
seongjunnoh merged 7 commits intomainfrom
develop

Conversation

@seongjunnoh
Copy link
Collaborator

@seongjunnoh seongjunnoh commented Aug 13, 2025

#️⃣ 연관된 이슈

closes #이슈번호

📝 작업 내용

  • 소셜 로그인 쿠키 관련 수정했습니다

📸 스크린샷

💬 리뷰 요구사항

리뷰어가 특별히 봐주었으면 하는 부분이 있다면 작성해주세요

📌 PR 진행 시 이러한 점들을 참고해 주세요

* P1 : 꼭 반영해 주세요 (Request Changes) - 이슈가 발생하거나 취약점이 발견되는 케이스 등
* P2 : 반영을 적극적으로 고려해 주시면 좋을 것 같아요 (Comment)
* P3 : 이런 방법도 있을 것 같아요~ 등의 사소한 의견입니다 (Chore)

Summary by CodeRabbit

  • New Features
    • OAuth 로그인/회원가입 후 리다이렉트 URL에 loginTokenKey가 포함되며, 이를 사용해 브라우저에 토큰 쿠키를 설정하는 엔드포인트(/api/set-cookie) 추가.
    • access_token 및 temp_token 쿠키 기반 인증 지원.
  • Security
    • 설정되는 토큰 쿠키에 HttpOnly, Secure, SameSite=None, 만료기간 적용으로 보안 강화.
  • Chores
    • CORS 허용 오리진을 프로덕션/개발 도메인으로 확장해 브라우저 연동 안정성 개선.

@coderabbitai
Copy link

coderabbitai bot commented Aug 13, 2025

Caution

Review failed

The pull request is closed.

Walkthrough

OAuth2 로그인 후 토큰을 즉시 쿠키로 내려주지 않고, 5분 TTL의 임시 저장소(LoginTokenStorage)에 보관한 뒤 loginTokenKey로 리다이렉트합니다. 클라이언트는 /api/set-cookie로 key를 전송해 쿠키를 발급받습니다. JWT 필터는 access/temp 쿠키 모두 인식하며, CORS 원본 구성이 업데이트되었습니다.

Changes

Cohort / File(s) Summary
Auth parameters
src/main/java/konkuk/thip/common/security/constant/AuthParameters.java
Enum에 COOKIE_ACCESS_TOKEN("access_token"), COOKIE_TEMP_TOKEN("temp_token") 추가. HTTP_PREFIX 항목 쉼표 추가.
JWT filter update
src/main/java/konkuk/thip/common/security/filter/JwtAuthenticationFilter.java
쿠키에서 access_token 또는 temp_token 인식. 필터 제외 경로에 /api/set-cookie 추가.
OAuth2 login flow revamp
.../oauth2/CustomSuccessHandler.java, .../oauth2/LoginTokenStorage.java, .../oauth2/TokenType.java, .../oauth2/AuthCookieController.java
성공 핸들러가 토큰을 LoginTokenStorage(5분 TTL)에 저장하고 loginTokenKey로 리다이렉트. 신규 컨트롤러 POST /api/set-cookie가 key를 소비해 ACCESS 또는 TEMP 쿠키 설정. TokenType enum 및 in-memory 저장소 추가.
Security config
src/main/java/konkuk/thip/config/SecurityConfig.java
단일 httpsUrl에서 prodServerUrl, devServerUrl 두 원본으로 CORS 허용 목록 변경.

Sequence Diagram(s)

sequenceDiagram
  participant User
  participant OAuth2 as OAuth2 Provider
  participant App as Server
  participant Store as LoginTokenStorage
  participant Client

  User->>OAuth2: Login
  OAuth2-->>App: Authentication success
  App->>Store: put(loginTokenKey, type, token, 5m)
  App-->>Client: 302 Redirect ?loginTokenKey=KEY

  Client->>App: POST /api/set-cookie {loginTokenKey: KEY}
  App->>Store: consume(KEY)
  Store-->>App: Entry(type, token) or null
  App-->>Client: Set-Cookie (access_token or temp_token)

  Client->>App: Subsequent API request
  Client->>App: Cookie: access_token/temp_token
  App->>App: JwtAuthenticationFilter extracts cookie
  App-->>Client: Response
Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

Suggested labels

🚀 deploy

Suggested reviewers

  • buzz0331

Poem

내 귀는 두 개, 쿠키는 둘! 🍪🍪
로그인 열쇠 건네면, 토큰은 살짝 숨겨두지—쏙.
키를 톡 전하면, 굴레처럼 쿠키가 딱!
TEMP로 폴짝, ACCESS로 깡총,
오늘도 안전하게, 퉁퉁 뛰는 토끼 로그인.


📜 Recent review details

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 773569b and 711b21c.

📒 Files selected for processing (7)
  • src/main/java/konkuk/thip/common/security/constant/AuthParameters.java (1 hunks)
  • src/main/java/konkuk/thip/common/security/filter/JwtAuthenticationFilter.java (2 hunks)
  • src/main/java/konkuk/thip/common/security/oauth2/AuthCookieController.java (1 hunks)
  • src/main/java/konkuk/thip/common/security/oauth2/CustomSuccessHandler.java (3 hunks)
  • src/main/java/konkuk/thip/common/security/oauth2/LoginTokenStorage.java (1 hunks)
  • src/main/java/konkuk/thip/common/security/oauth2/TokenType.java (1 hunks)
  • src/main/java/konkuk/thip/config/SecurityConfig.java (2 hunks)
✨ Finishing Touches
  • 📝 Generate Docstrings
🧪 Generate unit tests
  • Create PR with unit tests
  • Post copyable unit tests in a comment
  • Commit unit tests in branch develop

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share
🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

  • Review comments: Directly reply to a review comment made by CodeRabbit. Example:
    • I pushed a fix in commit <commit_id>, please review it.
    • Open a follow-up GitHub issue for this discussion.
  • Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query.
  • PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
    • @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
    • @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.

Support

Need help? Create a ticket on our support page for assistance with any issues or questions.

CodeRabbit Commands (Invoked using PR/Issue comments)

Type @coderabbitai help to get the list of available commands.

Other keywords and placeholders

  • Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
  • Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
  • Add @coderabbitai anywhere in the PR title to generate the title automatically.

CodeRabbit Configuration File (.coderabbit.yaml)

  • You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
  • Please see the configuration documentation for more information.
  • If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Status, Documentation and Community

  • Visit our Status Page to check the current availability of CodeRabbit.
  • Visit our Documentation for detailed information on how to use CodeRabbit.
  • Join our Discord Community to get help, request features, and share feedback.
  • Follow us on X/Twitter for updates and announcements.

@seongjunnoh seongjunnoh merged commit f527070 into main Aug 13, 2025
2 of 3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant