[Spring Boot] Spring Security 6버전 셋팅

 

spring security 버전이 6로 업그레이드 되면서 셋팅 방법도 일부 변경되었다.

 

Build.gradle

plugins {
	id 'java'
	id 'org.springframework.boot' version '3.2.2'
	id 'io.spring.dependency-management' version '1.1.4'
}

group = 'com.hy'
version = '0.0.1-SNAPSHOT'

java {
	sourceCompatibility = '17'
}

configurations {
	compileOnly {
		extendsFrom annotationProcessor
	}
}

repositories {
	mavenCentral()
}

dependencies {
	annotationProcessor 'org.projectlombok:lombok'

	implementation 'org.springframework.boot:spring-boot-starter-data-jpa'
	implementation 'org.springframework.boot:spring-boot-starter-thymeleaf'
	implementation 'org.springframework.boot:spring-boot-starter-web'
	implementation 'nz.net.ultraq.thymeleaf:thymeleaf-layout-dialect'
	implementation 'org.thymeleaf.extras:thymeleaf-extras-springsecurity6:3.1.1.RELEASE'
	implementation 'org.springframework.boot:spring-boot-starter-security'
	implementation 'org.springdoc:springdoc-openapi-starter-webmvc-ui:2.1.0'

	developmentOnly 'org.springframework.boot:spring-boot-devtools'

	runtimeOnly 'com.h2database:h2'

	compileOnly 'org.projectlombok:lombok'


	testImplementation 'org.springframework.boot:spring-boot-starter-test'
	testImplementation 'org.springframework.security:spring-security-test'
}

test {
	useJUnitPlatform()
}

 

 

SecurityConfig.java

- 기존에는 WebSecurityConfigurerAdapter를 상속 받아 사용하였으나 6버전부터 Deprecated 되어 filterChain을 Bean으로 등록하여 사용하는것이 큰 차이점이다.

@Configuration
@EnableWebSecurity
@RequiredArgsConstructor
public class SecurityConfig {
    private static final String[] WHITE_LIST = {
            "/"
            ,"/assets/**"
            ,"/auth/**"
    };

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        return http.csrf(AbstractHttpConfigurer::disable)
                .headers( headers -> headers.frameOptions(HeadersConfigurer.FrameOptionsConfig::disable))
                .authorizeHttpRequests( authorize ->
                    authorize.requestMatchers(WHITE_LIST).permitAll()
                        .requestMatchers(PathRequest.toH2Console()).permitAll()
                        .anyRequest().authenticated())
                .authenticationProvider(authenticationProvider())
                .formLogin( form -> form.loginPage("/auth/loginForm")
                        .loginProcessingUrl("/auth/login")
                        .usernameParameter("loginId")
                        .passwordParameter("password")
                        .defaultSuccessUrl("/")
                        .failureUrl("/auth/loginForm?error")
                        .successHandler(authenticationSuccessHandler()))
                .logout((logout) -> logout.logoutUrl("/auth/logout"))
                .build();
    }

    @Bean
    public MemberAuthenticationProvider authenticationProvider(){
        return new MemberAuthenticationProvider();
    }
    @Bean
    public MemberAuthenticationSuccessHandler authenticationSuccessHandler(){
        return new MemberAuthenticationSuccessHandler();
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

 

 

---

references

- https://docs.spring.io/spring-security/reference/servlet/authentication/passwords/index.html

Username/Password Authentication :: Spring Security