CustomSecurityConfig ( 자동 로그인 설정 추가 ) > SPRING_DATA_JPA

• 목록

package web.config;

import javax.sql.DataSource;

import org.springframework.boot.autoconfigure.security.servlet.PathRequest;

import org.springframework.context.annotation.Bean;

import org.springframework.context.annotation.Configuration;

import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;

import org.springframework.security.config.annotation.web.builders.HttpSecurity;

import org.springframework.security.config.annotation.web.configuration.WebSecurityCustomizer;

import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;

import org.springframework.security.crypto.password.PasswordEncoder;

import org.springframework.security.web.SecurityFilterChain;

import org.springframework.security.web.authentication.rememberme.JdbcTokenRepositoryImpl;

import org.springframework.security.web.authentication.rememberme.PersistentTokenRepository;

import lombok.RequiredArgsConstructor;

import lombok.extern.log4j.Log4j2;

import web.security.CustomUserDetailsService;

@Log4j2

@Configuration

//@PreAuthorize 혹은 @PostAuthorize 어노테이션을 이용해서 사전 혹은 사후의 권한을 체크할 수 있다.

@EnableGlobalMethodSecurity(prePostEnabled = true)

@RequiredArgsConstructor

public class CustomSecurityConfig {

private final DataSource dataSource;

private final CustomUserDetailsService userDetailsService;

@Bean

public PersistentTokenRepository persistentTokenRepository() {

JdbcTokenRepositoryImpl repo = new JdbcTokenRepositoryImpl();

repo.setDataSource(dataSource);

return repo;

}

@Bean

public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {

log.info("-------시큐리티 해제-------");

//http.formLogin();

http.formLogin().loginPage("/member/login"); //커스텀 로그인 페이지

http.csrf().disable(); //CSRG 토큰 비활성화

http.rememberMe()

.key("12345678")

.tokenRepository(persistentTokenRepository())

.userDetailsService(userDetailsService)

.tokenValiditySeconds(60*60*24*30);

return http.build();

}

@Bean

public WebSecurityCustomizer webSecurityCustomizer() {

log.info("-------시큐리티 적용 제외-------");

return (web) -> web.ignoring().requestMatchers(PathRequest.toStaticResources().atCommonLocations());

}

@Bean

public PasswordEncoder passwordEncoder() {

return new BCryptPasswordEncoder();

}

}