diff --git a/src/main/java/com/wb/domainserver/security/config/RealmFilterConfig.java b/src/main/java/com/wb/domainserver/security/config/RealmFilterConfig.java deleted file mode 100644 index 0637188b..00000000 --- a/src/main/java/com/wb/domainserver/security/config/RealmFilterConfig.java +++ /dev/null @@ -1,26 +0,0 @@ -package com.wb.domainserver.security.config; - -import com.wb.domainserver.realm.RealmResolver; -import com.wb.domainserver.realm.filter.RealmFilter; -import org.springframework.beans.factory.annotation.Autowired; -import org.springframework.boot.web.servlet.FilterRegistrationBean; -import org.springframework.context.annotation.Bean; -import org.springframework.context.annotation.Configuration; -import org.springframework.core.Ordered; - -@Configuration -public class RealmFilterConfig { - - @Autowired - RealmResolver realmResolver; - - @Bean - public FilterRegistrationBean realmFilter() { - FilterRegistrationBean registrationBean = new FilterRegistrationBean<>(); - registrationBean.setFilter(new RealmFilter(realmResolver)); - registrationBean.addUrlPatterns("/*"); - registrationBean.setOrder(Ordered.HIGHEST_PRECEDENCE); - return registrationBean; - } - -} diff --git a/src/main/java/com/wb/domainserver/security/config/ResourceServerConfig.java b/src/main/java/com/wb/domainserver/security/config/ResourceServerConfig.java index c139de2f..01595397 100644 --- a/src/main/java/com/wb/domainserver/security/config/ResourceServerConfig.java +++ b/src/main/java/com/wb/domainserver/security/config/ResourceServerConfig.java @@ -15,6 +15,7 @@ */ package com.wb.domainserver.security.config; +import com.wb.domainserver.common.prop.PropertyService; import com.wb.domainserver.domain.sopmal.oauth.service.CustomOAuth2UserService; import com.wb.domainserver.exception.response.CustomOauthFailureException; import com.wb.domainserver.realm.RealmResolver; @@ -23,6 +24,7 @@ import com.wb.domainserver.response.CustomAuthenticationSuccessHandler; import com.wb.domainserver.security.authentication.CustomAccessDeniedEntryPoint; import com.wb.domainserver.security.authentication.CustomAuthenticationEntryPoint; import com.wb.domainserver.security.authorization.WnbtAuthorizationManager; +import com.wb.domainserver.security.filter.BatchFilter; import com.wb.domainserver.security.filter.CustomXssFilter; import com.wb.domainserver.security.filter.JwtAuthenticationFilter; import com.wb.domainserver.security.handler.CustomLogoutSuccessHandler; @@ -55,7 +57,7 @@ import java.util.stream.Collectors; import static org.springframework.beans.factory.config.BeanDefinition.ROLE_INFRASTRUCTURE; -@EnableWebSecurity(debug = false) +@EnableWebSecurity(debug = true) @Configuration //@EnableMethodSecurity public class ResourceServerConfig { @@ -113,7 +115,7 @@ public class ResourceServerConfig { OrRequestMatcher resourceMatchers = new OrRequestMatcher(resourcePath); return http - .securityMatcher("/sopmal/**", "/oauth2/**", "/login/oauth2/**","/file/*") + .securityMatcher("/*", "/sopmal/**", "/oauth2/**", "/login/oauth2/**","/file/*") ///gcone/** #배치호출처리 .headers((headers)->headers.frameOptions(HeadersConfigurer.FrameOptionsConfig::sameOrigin)) .csrf(AbstractHttpConfigurer::disable) .authorizeHttpRequests(authorize -> @@ -205,6 +207,26 @@ public class ResourceServerConfig { .build(); } + @Bean + @Order(3) + SecurityFilterChain batchSecurityFilterChain(HttpSecurity http, SecurityPathProperties securityProperties) throws Exception { + + List uriList = securityProperties.getBatch().getUri().stream() + .map(AntPathRequestMatcher::new) + .collect(Collectors.toList()); + OrRequestMatcher uri = new OrRequestMatcher(uriList); + + return http + .securityMatcher(uri) + .headers((headers)->headers.frameOptions(HeadersConfigurer.FrameOptionsConfig::sameOrigin)) + .csrf(AbstractHttpConfigurer::disable) + .addFilterBefore(new BatchFilter(securityProperties), RequestCacheAwareFilter.class) /*batch 호출된 주소 확인 후 주소가 아니면 제외*/ + .exceptionHandling(exceptions -> exceptions + .accessDeniedHandler(accessDeniedEntryPoint) + ) + .build(); + } + // // private String customBearerTokenResolver(HttpServletRequest request) { // String authorization = request.getHeader("Authorization"); diff --git a/src/main/java/com/wb/domainserver/security/config/SecurityPathProperties.java b/src/main/java/com/wb/domainserver/security/config/SecurityPathProperties.java index 71783123..a004011b 100644 --- a/src/main/java/com/wb/domainserver/security/config/SecurityPathProperties.java +++ b/src/main/java/com/wb/domainserver/security/config/SecurityPathProperties.java @@ -19,6 +19,8 @@ public class SecurityPathProperties { private Solmal solmal; private Admin admin; private Common common; + private Batch batch; + @Getter @Setter @@ -39,5 +41,12 @@ public class SecurityPathProperties { public static class Common { private List resources; } + + @Getter + @Setter + public static class Batch { + private List accessip; + private List uri; + } } diff --git a/src/main/java/com/wb/domainserver/security/filter/BatchFilter.java b/src/main/java/com/wb/domainserver/security/filter/BatchFilter.java new file mode 100644 index 00000000..b8a8c6e2 --- /dev/null +++ b/src/main/java/com/wb/domainserver/security/filter/BatchFilter.java @@ -0,0 +1,51 @@ +package com.wb.domainserver.security.filter; + +import com.wb.domainserver.common.prop.PropertyService; +import com.wb.domainserver.exception.WnbtRestException; +import com.wb.domainserver.security.config.SecurityPathProperties; +import com.wb.domainserver.security.filter.wrapper.XssServletWrapper; +import jakarta.servlet.*; +import jakarta.servlet.http.HttpServletRequest; +import jakarta.servlet.http.HttpServletRequestWrapper; +import jakarta.servlet.http.HttpServletResponse; +import lombok.extern.slf4j.Slf4j; +import org.springframework.web.util.ContentCachingResponseWrapper; + +import java.io.IOException; +import java.util.Arrays; + +@Slf4j +public class BatchFilter implements Filter { + + SecurityPathProperties securityProperties; + + public BatchFilter(SecurityPathProperties securityProperties) { + this.securityProperties = securityProperties; + } + + /* + * batch서버에서 호출 되었는지 확인하는 필터 + * */ + @Override + public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { + HttpServletRequest httpRequest = (HttpServletRequest) request; + + String ip = httpRequest.getHeader("X-Forwarded-For"); + if (ip == null || ip.isEmpty()) { + ip = httpRequest.getRemoteAddr(); + } + // 여러 프록시를 거친 경우, 콤마로 구분된 여러 IP가 있을 수 있어 첫 번째 IP만 가져오거나 처리 필요 [4, 7]. + if (ip != null && ip.contains(",")) { + ip = ip.split(",")[0]; + } + + Object[] whiteIp = securityProperties.getBatch().getAccessip().toArray(); + + /* 대상 ip가 아닌경우 처리불가*/ + if(!Arrays.asList(whiteIp).contains(ip)){ + throw new IOException("접근이 허용되지 않은 IP입니다."); + } + + chain.doFilter(request, response); + } +} diff --git a/src/main/resources/secured-config.yml b/src/main/resources/secured-config.yml index 247060b3..845a0654 100644 --- a/src/main/resources/secured-config.yml +++ b/src/main/resources/secured-config.yml @@ -25,6 +25,13 @@ secured: - /**/fonts/** - /favicon.ico - /**/vender/** + batch: + accessip: + - 127.0.0.1 + - 10.2.1.76 + uri: + - /gcone/mbr/mbr/selectBOJoinGuidanceForm # 셈플로 넣음 사용하는 uri 설정해야함 + #secured: