Spring Security BadCredentialsException:자격 증명 실패에 대해..

Question

클릭해주셔서 감사합니다!안녕하십니까 혼자 백엔드를 맡아 프로젝트를 진행하게되어서 처음 spring security라는 기술을 처음 접해본 대학생입니다.현재 회원가입을 구현하고, 로그인을 구현하던 중 연속된 자격 증명 실패를 겪고있습니다.로그를 찍어보니 doFilter 메서드가 실행될때 요청이 제대로 전해지지 않아서 토큰에 null이 발생하는 것 같은데 해당 문제에 대한 해결을 어디서 해야하는지를 잘 모르겠습니다.코드를 첨부할테니 많은 지적과 도움 부탁드립니다.!!Userimport lombok.AccessLevel; import lombok.Builder; import lombok.Getter; import lombok.NoArgsConstructor; import javax.persistence.*; import javax.validation.constraints.NotNull; import java.util.ArrayList; import java.util.List; import java.util.Set; @Entity @Getter @NoArgsConstructor(access = AccessLevel.PROTECTED) public class User extends BaseEntity{ @Id @GeneratedValue(strategy = GenerationType.IDENTITY) @Column(name = "user_id") private Long id; @NotNull private String email; @NotNull private String userPw; @NotNull private String name; @NotNull private String phoneNum; @NotNull @Enumerated(EnumType.STRING) private Role role; // 사용자가 주문한 주문 목록 @OneToMany(mappedBy = "user", cascade = CascadeType.ALL) private List orders = new ArrayList<>(); // 사용자가 결제한 결제 정보 @OneToMany(mappedBy = "user", cascade = CascadeType.ALL) private List payments = new ArrayList<>(); // 사용자가 남긴 상품 좋아요 @OneToMany(mappedBy = "user", cascade = CascadeType.ALL) private List hearts = new ArrayList<>(); @Builder public User(String userPw, String name, String email, String phoneNum, Role role){ this.userPw=userPw; this.name=name; this.email=email; this.phoneNum=phoneNum; this.role=role; } public String getRoleKey() { return this.role.getKey(); } }Role@Getter @RequiredArgsConstructor public enum Role { GUEST("ROLE_GUEST", "손님"), USER("ROLE_USER", "일반 사용자"), ADMIN("ROLE_ADMIN", "관리자"); private final String key; private final String title; }UserRequestimport com.example.GANerate.domain.Role; import com.example.GANerate.domain.User; import lombok.Getter; import lombok.NoArgsConstructor; import javax.validation.constraints.NotBlank; import javax.validation.constraints.Pattern; public class UserRequest { @NoArgsConstructor @Getter public static class signup { @NotBlank(message = "이메일은 필수입니다.") private String email; @NotBlank(message = "비밀번호는 필수입니다.") // @Pattern(regexp = "^(?=.*[A-Za-z])(?=.*\d)(?=.*[@$!%*#?&])[A-Za-z\d@$!%*#?&]{8,30}$", message = "비밀번호는 8~30 자리이면서 1개 이상의 알파벳, 숫자, 특수문자를 포함해야합니다.") // 위의 조건은 배포시 다시 설정해놓기. private String userPw; @NotBlank(message = "이름은 필수입니다.") private String name; @NotBlank(message = "휴대폰 번호는 필수입니다.") private String phoneNum; private Role role; public User toEntity() { return User.builder() .email(email) .userPw(userPw) .name(name) .phoneNum(phoneNum) .role(Role.USER) // 이부분은 나중에 관리자 모드 같은것 만들때 다시 고려 .build(); } } @NoArgsConstructor @Getter public static class signin { @NotBlank(message = "아이디는 필수입니다.") private String email; @NotBlank(message = "비밀번호는 필수입니다.") private String userPw; public User toEntity(){ return User.builder() .email(email) .userPw(userPw) .build(); } } }UserControllerimport com.example.GANerate.request.UserRequest; import com.example.GANerate.response.CustomResponseEntity; import com.example.GANerate.response.UserResponse; import com.example.GANerate.service.UserService; import lombok.RequiredArgsConstructor; import org.springframework.web.bind.annotation.*; import javax.validation.Valid; @RestController @RequiredArgsConstructor public class UserController { private final UserService userService; //회원가입 @PostMapping("/auth/signup") public CustomResponseEntity signup( @RequestBody @Valid final UserRequest.signup request){ return CustomResponseEntity.success(userService.signup(request)); } //로그인 @PostMapping("/auth/signin") public CustomResponseEntity signin( @RequestBody @Valid final UserRequest.signin request){ return CustomResponseEntity.success(userService.signin(request)); } }UserServiceimport com.example.GANerate.config.jwt.TokenProvider; import com.example.GANerate.domain.Role; import com.example.GANerate.domain.User; import com.example.GANerate.enumuration.Result; import com.example.GANerate.exception.CustomException; import com.example.GANerate.repository.UserRepository; import com.example.GANerate.request.UserRequest; import com.example.GANerate.response.UserResponse; import lombok.RequiredArgsConstructor; import lombok.extern.slf4j.Slf4j; import org.springframework.security.authentication.UsernamePasswordAuthenticationToken; import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder; import org.springframework.security.core.Authentication; import org.springframework.security.core.context.SecurityContextHolder; import org.springframework.security.crypto.password.PasswordEncoder; import org.springframework.stereotype.Service; import org.springframework.transaction.annotation.Transactional; import static com.example.GANerate.enumuration.Result.USERID_NOT_FOUND; @Service @Slf4j @RequiredArgsConstructor public class UserService { private final UserRepository userRepository; private final PasswordEncoder passwordEncoder; private final TokenProvider tokenProvider; private final AuthenticationManagerBuilder authenticationManagerBuilder; //회원가입 @Transactional public UserResponse.signup signup(UserRequest.signup request){ //아이디 중복 검사 validateDuplicatedUserEmail(request.getEmail()); //저장 User user = userRepository.save(createEntityUserFromDto(request)); return UserResponse.signup.response(user); } //로그인 @Transactional(readOnly = true) public UserResponse.signin signin(UserRequest.signin request){ // 일치하는 userId 없음 User user = userRepository.findByEmail(request.getEmail()) .orElseThrow(() -> new CustomException(USERID_NOT_FOUND)); // password 틀림 if(!passwordEncoder.matches(request.getUserPw(), user.getUserPw())){ throw new CustomException(Result.INVALID_PASSWORD); } //앞에서 exception 안나면 access token 발행 String accessToken = tokenProvider.createToken(user.getId(), getAuthentication(request.getEmail(), request.getUserPw())); //String refreshToken = tokenProvider.createRefreshToken(user.getId()); return UserResponse.signin.response(user, accessToken); } private void validateDuplicatedUserEmail(String userEmail) { Boolean existsByNickName = userRepository.existsByEmail(userEmail); if (existsByNickName) { throw new CustomException(Result.USERID_DUPLICATED); } } private Authentication getAuthentication(String email, String password) { //Authentication 객체 생성 UsernamePasswordAuthenticationToken authenticationToken = new UsernamePasswordAuthenticationToken(email, password); Authentication authentication = authenticationManagerBuilder.getObject().authenticate(authenticationToken); log.info("~~~~~"); log.info(String.valueOf(authentication)); log.info("~~~~~"); SecurityContextHolder.getContext().setAuthentication(authentication); return authentication; } private User createEntityUserFromDto(UserRequest.signup request) { return User.builder() .email(request.getEmail()) .userPw(passwordEncoder.encode(request.getUserPw())) .name(request.getName()) .phoneNum(request.getPhoneNum()) .role(Role.USER) .build(); } }SecurityConfigimport com.example.GANerate.config.jwt.JwtAuthenticationFilter; import com.example.GANerate.config.jwt.TokenProvider; import lombok.RequiredArgsConstructor; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter; import org.springframework.security.config.http.SessionCreationPolicy; import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder; import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter; import org.springframework.web.filter.CorsFilter; @Configuration @EnableWebSecurity @RequiredArgsConstructor public class SecurityConfig extends WebSecurityConfigurerAdapter { private final TokenProvider tokenProvider; private final CorsFilter corsFilter; @Bean public BCryptPasswordEncoder passwordEncoder() { return new BCryptPasswordEncoder(); } @Override protected void configure(HttpSecurity httpSecurity) throws Exception { httpSecurity .httpBasic().disable()//기본 설정 사용 x, 요청 헤더에 id, pw를 보내는 방식임 .csrf().disable() .addFilterBefore(corsFilter, UsernamePasswordAuthenticationFilter.class) .cors().and() .exceptionHandling() .and() .sessionManagement() .sessionCreationPolicy(SessionCreationPolicy.STATELESS) .and() .authorizeRequests() .antMatchers("/auth/signup", "/auth/signin","/main/**").permitAll() .anyRequest().authenticated() .and() .addFilterBefore(new JwtAuthenticationFilter(tokenProvider), UsernamePasswordAuthenticationFilter.class); } }JwtAuthenticationFilterimport lombok.RequiredArgsConstructor; import lombok.extern.slf4j.Slf4j; import org.springframework.security.core.Authentication; import org.springframework.security.core.context.SecurityContextHolder; import org.springframework.util.StringUtils; import org.springframework.web.filter.GenericFilterBean; import javax.servlet.FilterChain; import javax.servlet.ServletException; import javax.servlet.ServletRequest; import javax.servlet.ServletResponse; import javax.servlet.http.HttpServletRequest; import java.io.IOException; @Slf4j public class JwtAuthenticationFilter extends GenericFilterBean { private final TokenProvider tokenProvider; public JwtAuthenticationFilter(TokenProvider tokenProvider){ this.tokenProvider = tokenProvider; } @Override public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { HttpServletRequest httpServletRequest = (HttpServletRequest) request; String token = resolveToken(httpServletRequest); log.info("----------------------------------"); log.info(token); log.info("----------------------------------"); String requestURI = httpServletRequest.getRequestURI(); //토큰 유효성 검사 if (token != null && tokenProvider.validateToken(token)) { Authentication authentication = tokenProvider.getAuthentication(token); SecurityContextHolder.getContext().setAuthentication(authentication); log.info("Security Context에 '{}' 인증 정보를 저장했습니다, uri: {}", authentication.getName(), requestURI); } else { log.info("유효한 JWT 토큰이 없습니다, uri {}", requestURI); } chain.doFilter(request, response); } // 헤더에서 토큰 추출 private String resolveToken(HttpServletRequest request) { String bearerToken = request.getHeader("Authorization"); log.info(bearerToken); if (StringUtils.hasText(bearerToken) && bearerToken.startsWith("Bearer ")) { return bearerToken.substring(7); } return null; } } 위의 토큰 로그를 찍어보면 null이 발생합니다.TokenProvider@Slf4j @Component @RequiredArgsConstructor public class TokenProvider { @Value("${jwt.secret}") private String secretKey; @Value("${jwt.token-validity-in-seconds}") private long accessTokenValidTime; @Value("${jwt.refresh-token-validity-in-seconds}") private long refreshTokenValidTime; private Key key; // 객체 초기화, secretKey를 Base64로 인코딩한다. @PostConstruct protected void init() { byte[] keyBytes = Decoders.BASE64.decode(secretKey); this.key = Keys.hmacShaKeyFor(keyBytes); } //JWT access 토큰 생성 public String createToken(Long userId, Authentication authentication) { String authorities = authentication.getAuthorities().stream() .map(GrantedAuthority::getAuthority) .collect(Collectors.joining(",")); log.info(authorities); log.info(authorities); log.info(authorities); long now = (new Date()).getTime(); Date validity = new Date(now + this.accessTokenValidTime); String accessToken = Jwts.builder() .setSubject(userId.toString()) .claim("auth", authorities) .setExpiration(validity) .signWith(key, SignatureAlgorithm.HS256) .compact(); return accessToken; } public String createRefreshToken(Long userId) { long now = (new Date()).getTime(); Date validity = new Date(now + this.refreshTokenValidTime); String refreshToken = Jwts.builder() .setSubject(userId.toString()) .setExpiration(validity) .signWith(key, SignatureAlgorithm.HS256) .compact(); return refreshToken; } public Long getExpiration(String accessToken) { // accessToken 남은 유효시간 Date expiration = Jwts.parserBuilder() .setSigningKey(key) .build() .parseClaimsJws(accessToken) .getBody() .getExpiration(); // 현재 시간 Long now = new Date().getTime(); return (expiration.getTime() - now); } public boolean validateToken(String token) { try { Jwts.parserBuilder().setSigningKey(key).build().parseClaimsJws(token); return true; } catch (io.jsonwebtoken.security.SecurityException | MalformedJwtException e) { log.info("잘못된 JWT 서명입니다."); } catch (ExpiredJwtException e) { log.info("만료된 JWT 토큰입니다."); } catch (UnsupportedJwtException e) { log.info("지원되지 않는 JWT 토큰입니다."); } catch (IllegalArgumentException e) { log.info("JWT 토큰이 잘못되었습니다."); } return false; } public Authentication getAuthentication(String accessToken) { Claims claims = Jwts .parserBuilder() .setSigningKey(key) .build() .parseClaimsJws(accessToken) .getBody(); if(claims.get("auth") == null){ throw new CustomException(Result.UNAUTHORITY_TOKEN); } Collection authorities = Arrays.stream(claims.get("auth").toString().split(",")) .map(SimpleGrantedAuthority::new) .collect(Collectors.toList()); UserDetails principal = new User(claims.getSubject(), "", authorities); return new UsernamePasswordAuthenticationToken(principal, "", authorities); } }에러 코드2023-07-03 02:42:41.021 INFO 14551 --- [ main] o.s.s.web.DefaultSecurityFilterChain : Will secure any request with [org.springframework.security.web.session.DisableEncodeUrlFilter@72c175f1, org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter@9fd3b61, org.springframework.security.web.context.SecurityContextPersistenceFilter@5644f664, org.springframework.security.web.header.HeaderWriterFilter@7be6dabb, org.springframework.web.filter.CorsFilter@19c1820d, org.springframework.security.web.authentication.logout.LogoutFilter@79ae3fb1, org.springframework.web.filter.CorsFilter@19c1820d, com.example.GANerate.config.jwt.JwtAuthenticationFilter@4a34de5e, org.springframework.security.web.savedrequest.RequestCacheAwareFilter@27f31d91, org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter@e2ee348, org.springframework.security.web.authentication.AnonymousAuthenticationFilter@48da5106, org.springframework.security.web.session.SessionManagementFilter@4b1b2255, org.springframework.security.web.access.ExceptionTranslationFilter@440d2d64, org.springframework.security.web.access.intercept.FilterSecurityInterceptor@1ba98508] 2023-07-03 02:42:41.677 INFO 14551 --- [ main] o.s.b.w.embedded.tomcat.TomcatWebServer : Tomcat started on port(s): 8080 (http) with context path '' 2023-07-03 02:42:41.691 INFO 14551 --- [ main] c.example.GANerate.GaNerateApplication : Started GaNerateApplication in 7.109 seconds (JVM running for 8.542) 2023-07-03 02:42:43.897 INFO 14551 --- [nio-8080-exec-1] o.a.c.c.C.[Tomcat].[localhost].[/] : Initializing Spring DispatcherServlet 'dispatcherServlet' 2023-07-03 02:42:43.898 INFO 14551 --- [nio-8080-exec-1] o.s.web.servlet.DispatcherServlet : Initializing Servlet 'dispatcherServlet' 2023-07-03 02:42:43.900 INFO 14551 --- [nio-8080-exec-1] o.s.web.servlet.DispatcherServlet : Completed initialization in 2 ms 2023-07-03 02:42:43.922 INFO 14551 --- [nio-8080-exec-1] c.e.G.c.jwt.JwtAuthenticationFilter : null 2023-07-03 02:42:43.923 INFO 14551 --- [nio-8080-exec-1] c.e.G.c.jwt.JwtAuthenticationFilter : ---------------------------------- 2023-07-03 02:42:43.923 INFO 14551 --- [nio-8080-exec-1] c.e.G.c.jwt.JwtAuthenticationFilter : null 2023-07-03 02:42:43.923 INFO 14551 --- [nio-8080-exec-1] c.e.G.c.jwt.JwtAuthenticationFilter : ---------------------------------- 2023-07-03 02:42:43.923 INFO 14551 --- [nio-8080-exec-1] c.e.G.c.jwt.JwtAuthenticationFilter : 유효한 JWT 토큰이 없습니다, uri /auth/signin 2023-07-03 02:42:44.236 TRACE 14551 --- [nio-8080-exec-1] o.h.type.descriptor.sql.BasicBinder : binding parameter [1] as [VARCHAR] - [a1] 2023-07-03 02:42:44.279 TRACE 14551 --- [nio-8080-exec-1] o.h.type.descriptor.sql.BasicExtractor : extracted value ([user_id1_7_] : [BIGINT]) - [2] 2023-07-03 02:42:44.286 TRACE 14551 --- [nio-8080-exec-1] o.h.type.descriptor.sql.BasicExtractor : extracted value ([created_2_7_] : [TIMESTAMP]) - [2023-07-03T02:33:09.406280] 2023-07-03 02:42:44.290 TRACE 14551 --- [nio-8080-exec-1] o.h.type.descriptor.sql.BasicExtractor : extracted value ([modified3_7_] : [TIMESTAMP]) - [2023-07-03T02:33:09.406280] 2023-07-03 02:42:44.291 TRACE 14551 --- [nio-8080-exec-1] o.h.type.descriptor.sql.BasicExtractor : extracted value ([email4_7_] : [VARCHAR]) - [a1] 2023-07-03 02:42:44.291 TRACE 14551 --- [nio-8080-exec-1] o.h.type.descriptor.sql.BasicExtractor : extracted value ([name5_7_] : [VARCHAR]) - [kim] 2023-07-03 02:42:44.291 TRACE 14551 --- [nio-8080-exec-1] o.h.type.descriptor.sql.BasicExtractor : extracted value ([phone_nu6_7_] : [VARCHAR]) - [01011111111] 2023-07-03 02:42:44.291 TRACE 14551 --- [nio-8080-exec-1] o.h.type.descriptor.sql.BasicExtractor : extracted value ([role7_7_] : [VARCHAR]) - [USER] 2023-07-03 02:42:44.291 TRACE 14551 --- [nio-8080-exec-1] o.h.type.descriptor.sql.BasicExtractor : extracted value ([user_pw8_7_] : [VARCHAR]) - [$2a$10$z7imKAKGDVSsg.OHlnDxEeSHwTFYuH0uPR0EFRtotfwr1asFXwsOa] 2023-07-03 02:42:44.658 ERROR 14551 --- [nio-8080-exec-1] c.e.G.e.CommonRestExceptionHandler : defaultExceptionHandler org.springframework.security.authentication.BadCredentialsException: 자격 증명에 실패하였습니다. at org.springframework.security.authentication.dao.AbstractUserDetailsAuthenticationProvider.authenticate(AbstractUserDetailsAuthenticationProvider.java:141) ~[spring-security-core-5.7.9.jar:5.7.9] at org.springframework.security.authentication.ProviderManager.authenticate(ProviderManager.java:182) ~[spring-security-core-5.7.9.jar:5.7.9] at com.example.GANerate.service.UserService.getAuthentication(UserService.java:78) ~[main/:na] at com.example.GANerate.service.UserService.signin(UserService.java:60) ~[main/:na] at com.example.GANerate.service.UserService$$FastClassBySpringCGLIB$$f5eec405.invoke() ~[main/:na] at org.springframework.cglib.proxy.MethodProxy.invoke(MethodProxy.java:218) ~[spring-core-5.3.28.jar:5.3.28] at org.springframework.aop.framework.CglibAopProxy$CglibMethodInvocation.invokeJoinpoint(CglibAopProxy.java:793) ~[spring-aop-5.3.28.jar:5.3.28] at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:163) ~[spring-aop-5.3.28.jar:5.3.28] at org.springframework.aop.framework.CglibAopProxy$CglibMethodInvocation.proceed(CglibAopProxy.java:763) ~[spring-aop-5.3.28.jar:5.3.28] at org.springframework.transaction.interceptor.TransactionInterceptor$1.proceedWithInvocation(TransactionInterceptor.java:123) ~[spring-tx-5.3.28.jar:5.3.28] at org.springframework.transaction.interceptor.TransactionAspectSupport.invokeWithinTransaction(TransactionAspectSupport.java:388) ~[spring-tx-5.3.28.jar:5.3.28] at org.springframework.transaction.interceptor.TransactionInterceptor.invoke(TransactionInterceptor.java:119) ~[spring-tx-5.3.28.jar:5.3.28] at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:186) ~[spring-aop-5.3.28.jar:5.3.28] at org.springframework.aop.framework.CglibAopProxy$CglibMethodInvocation.proceed(CglibAopProxy.java:763) ~[spring-aop-5.3.28.jar:5.3.28] at org.springframework.aop.framework.CglibAopProxy$DynamicAdvisedInterceptor.intercept(CglibAopProxy.java:708) ~[spring-aop-5.3.28.jar:5.3.28] at com.example.GANerate.service.UserService$$EnhancerBySpringCGLIB$$3f73198d.signin() ~[main/:na] at com.example.GANerate.controller.UserController.signin(UserController.java:29) ~[main/:na] at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[na:na] at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[na:na] at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[na:na] at java.base/java.lang.reflect.Method.invoke(Method.java:566) ~[na:na] at org.springframework.web.method.support.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:205) ~[spring-web-5.3.28.jar:5.3.28] at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:150) ~[spring-web-5.3.28.jar:5.3.28] at org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:117) ~[spring-webmvc-5.3.28.jar:5.3.28] at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandlerMethod(RequestMappingHandlerAdapter.java:895) ~[spring-webmvc-5.3.28.jar:5.3.28] at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:808) ~[spring-webmvc-5.3.28.jar:5.3.28] at org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:87) ~[spring-webmvc-5.3.28.jar:5.3.28] at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:1072) ~[spring-webmvc-5.3.28.jar:5.3.28] at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:965) ~[spring-webmvc-5.3.28.jar:5.3.28] at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:1006) ~[spring-webmvc-5.3.28.jar:5.3.28] at org.springframework.web.servlet.FrameworkServlet.doPost(FrameworkServlet.java:909) ~[spring-webmvc-5.3.28.jar:5.3.28] at javax.servlet.http.HttpServlet.service(HttpServlet.java:555) ~[tomcat-embed-core-9.0.76.jar:4.0.FR] at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:883) ~[spring-webmvc-5.3.28.jar:5.3.28] at javax.servlet.http.HttpServlet.service(HttpServlet.java:623) ~[tomcat-embed-core-9.0.76.jar:4.0.FR] at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:209) ~[tomcat-embed-core-9.0.76.jar:9.0.76] at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:153) ~[tomcat-embed-core-9.0.76.jar:9.0.76] at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:51) ~[tomcat-embed-websocket-9.0.76.jar:9.0.76] at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:178) ~[tomcat-embed-core-9.0.76.jar:9.0.76] at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:153) ~[tomcat-embed-core-9.0.76.jar:9.0.76] at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:111) ~[spring-web-5.3.28.jar:5.3.28] at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:178) ~[tomcat-embed-core-9.0.76.jar:9.0.76] at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:153) ~[tomcat-embed-core-9.0.76.jar:9.0.76] at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:337) ~[spring-security-web-5.7.9.jar:5.7.9] at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.invoke(FilterSecurityInterceptor.java:115) ~[spring-security-web-5.7.9.jar:5.7.9] at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.doFilter(FilterSecurityInterceptor.java:81) ~[spring-security-web-5.7.9.jar:5.7.9] at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:346) ~[spring-security-web-5.7.9.jar:5.7.9] at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:122) ~[spring-security-web-5.7.9.jar:5.7.9] at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:116) ~[spring-security-web-5.7.9.jar:5.7.9] at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:346) ~[spring-security-web-5.7.9.jar:5.7.9] at org.springframework.security.web.session.SessionManagementFilter.doFilter(SessionManagementFilter.java:126) ~[spring-security-web-5.7.9.jar:5.7.9] at org.springframework.security.web.session.SessionManagementFilter.doFilter(SessionManagementFilter.java:81) ~[spring-security-web-5.7.9.jar:5.7.9] at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:346) ~[spring-security-web-5.7.9.jar:5.7.9] at org.springframework.security.web.authentication.AnonymousAuthenticationFilter.doFilter(AnonymousAuthenticationFilter.java:109) ~[spring-security-web-5.7.9.jar:5.7.9] at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:346) ~[spring-security-web-5.7.9.jar:5.7.9] at org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter.doFilter(SecurityContextHolderAwareRequestFilter.java:149) ~[spring-security-web-5.7.9.jar:5.7.9] at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:346) ~[spring-security-web-5.7.9.jar:5.7.9] at org.springframework.security.web.savedrequest.RequestCacheAwareFilter.doFilter(RequestCacheAwareFilter.java:63) ~[spring-security-web-5.7.9.jar:5.7.9] at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:346) ~[spring-security-web-5.7.9.jar:5.7.9] at com.example.GANerate.config.jwt.JwtAuthenticationFilter.doFilter(JwtAuthenticationFilter.java:48) ~[main/:na] at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:346) ~[spring-security-web-5.7.9.jar:5.7.9] at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:111) ~[spring-web-5.3.28.jar:5.3.28] at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:346) ~[spring-security-web-5.7.9.jar:5.7.9] at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:103) ~[spring-security-web-5.7.9.jar:5.7.9] at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:89) ~[spring-security-web-5.7.9.jar:5.7.9] at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:346) ~[spring-security-web-5.7.9.jar:5.7.9] at org.springframework.web.filter.CorsFilter.doFilterInternal(CorsFilter.java:91) ~[spring-web-5.3.28.jar:5.3.28] at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117) ~[spring-web-5.3.28.jar:5.3.28] at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:346) ~[spring-security-web-5.7.9.jar:5.7.9] at org.springframework.security.web.header.HeaderWriterFilter.doHeadersAfter(HeaderWriterFilter.java:90) ~[spring-security-web-5.7.9.jar:5.7.9] at org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:75) ~[spring-security-web-5.7.9.jar:5.7.9] at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117) ~[spring-web-5.3.28.jar:5.3.28] at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:346) ~[spring-security-web-5.7.9.jar:5.7.9] at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:112) ~[spring-security-web-5.7.9.jar:5.7.9] at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:82) ~[spring-security-web-5.7.9.jar:5.7.9] at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:346) ~[spring-security-web-5.7.9.jar:5.7.9] at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:55) ~[spring-security-web-5.7.9.jar:5.7.9] at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117) ~[spring-web-5.3.28.jar:5.3.28] at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:346) ~[spring-security-web-5.7.9.jar:5.7.9] at org.springframework.security.web.session.DisableEncodeUrlFilter.doFilterInternal(DisableEncodeUrlFilter.java:42) ~[spring-security-web-5.7.9.jar:5.7.9] at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117) ~[spring-web-5.3.28.jar:5.3.28] at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:346) ~[spring-security-web-5.7.9.jar:5.7.9] at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:221) ~[spring-security-web-5.7.9.jar:5.7.9] at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:186) ~[spring-security-web-5.7.9.jar:5.7.9] at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:354) ~[spring-web-5.3.28.jar:5.3.28] at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:267) ~[spring-web-5.3.28.jar:5.3.28] at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:178) ~[tomcat-embed-core-9.0.76.jar:9.0.76] at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:153) ~[tomcat-embed-core-9.0.76.jar:9.0.76] at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:100) ~[spring-web-5.3.28.jar:5.3.28] at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117) ~[spring-web-5.3.28.jar:5.3.28] at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:178) ~[tomcat-embed-core-9.0.76.jar:9.0.76] at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:153) ~[tomcat-embed-core-9.0.76.jar:9.0.76] at org.springframework.web.filter.FormContentFilter.doFilterInternal(FormContentFilter.java:93) ~[spring-web-5.3.28.jar:5.3.28] at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117) ~[spring-web-5.3.28.jar:5.3.28] at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:178) ~[tomcat-embed-core-9.0.76.jar:9.0.76] at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:153) ~[tomcat-embed-core-9.0.76.jar:9.0.76] at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:201) ~[spring-web-5.3.28.jar:5.3.28] at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117) ~[spring-web-5.3.28.jar:5.3.28] at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:178) ~[tomcat-embed-core-9.0.76.jar:9.0.76] at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:153) ~[tomcat-embed-core-9.0.76.jar:9.0.76] at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:167) ~[tomcat-embed-core-9.0.76.jar:9.0.76] at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:90) ~[tomcat-embed-core-9.0.76.jar:9.0.76] at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:481) ~[tomcat-embed-core-9.0.76.jar:9.0.76] at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:130) ~[tomcat-embed-core-9.0.76.jar:9.0.76] at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:93) ~[tomcat-embed-core-9.0.76.jar:9.0.76] at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74) ~[tomcat-embed-core-9.0.76.jar:9.0.76] at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:343) ~[tomcat-embed-core-9.0.76.jar:9.0.76] at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:390) ~[tomcat-embed-core-9.0.76.jar:9.0.76] at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:63) ~[tomcat-embed-core-9.0.76.jar:9.0.76] at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:926) ~[tomcat-embed-core-9.0.76.jar:9.0.76] at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1791) ~[tomcat-embed-core-9.0.76.jar:9.0.76] at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:52) ~[tomcat-embed-core-9.0.76.jar:9.0.76] at org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1191) ~[tomcat-embed-core-9.0.76.jar:9.0.76] at org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:659) ~[tomcat-embed-core-9.0.76.jar:9.0.76] at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) ~[tomcat-embed-core-9.0.76.jar:9.0.76] at java.base/java.lang.Thread.run(Thread.java:829) ~[na:na]긴글 읽어주셔서 감사합니다.꼭 해결하고 싶습니다. 부탁드립니다.추가로 질문이 있습니다.TokenProvider 클래스에서public String createToken(Long userId, Authentication authentication) { String authorities = authentication.getAuthorities().stream() .map(GrantedAuthority::getAuthority) .collect(Collectors.joining(",")); public Authentication getAuthentication(String accessToken) { Claims claims = Jwts .parserBuilder() .setSigningKey(key) .build() .parseClaimsJws(accessToken) .getBody(); if(claims.get("auth") == null){ throw new CustomException(Result.UNAUTHORITY_TOKEN); } Collection authorities = Arrays.stream(claims.get("auth").toString().split(",")) .map(SimpleGrantedAuthority::new) .collect(Collectors.toList()); UserDetails principal = new User(claims.getSubject(), "", authorities); return new UsernamePasswordAuthenticationToken(principal, "", authorities); }해당 코드에서 authorities의 정체가 뭔지 잘 모르겠습니다. 어떤 블로그는 authories가 아닌 role로 설정하여서 구현하는 경우도 있던데 해당 authories는 authority와 같은 권한 테이블이 있을때만 사용하는 것인지 의문이 있습니다. 질문 들어주셔서 감사합니다.!

벼랑끝에서올라오는중 · Answer

아래 부분이 오류일 거 같습니다. Authentication authentication = authenticationManagerBuilder.getObject().authenticate(authenticationToken);제 생각에는 UserDetails가 없어서 그런 거 같은데요.

양반후반 · Answer

Authorization 해더에 값이 없으니 가장 먼저 프론트에서 token값을 세팅하는 부분에 문제가 없는지 부터 확인을 하셔야겠죠.해당 부분에 문제가 없다면 토큰을 서버에서 생성하여 프론트로 넘겨준 값을 프론트에서 문제 없이 받아 처리 하고 있는지 확인을 해야겠고,마지막으로 서버에서 정상적으로 토큰을 생성해주는지를 확인 해야겠죠.그리고 authority든 role이든 어차피 명칭만 다르지 작동 하는것은 동일합니다.단지 어떤한 개념으로 사용을 하는지를 아시면 됩니다.role은 역할 단위로 관리 하기 위한 명칭고, authority는 권한 단위로 관리하기 위한 명칭입니다.role에 admin, user 이렇게 역할을 만들었다면 admin 사이트에는 admin 사용자만 접근 가능하도록 인가 관리를 할테고,authrority에 board_write, board_delete 이렇게 권한을 만들었다면 게시판 작성 권한이 있는 사람은 작성이 가능할것이고 삭제 권한이 있는 사람은 삭제가 가능하도록 인가 관리를 하겠죠.단순히 role을 쓰느냐 authority를 쓰느냐 해서 위에것들이 되는것은 아닙니다. 결국 그렇게 되도록 secutiry에 적용을 해야하는것이죠.authority를 role 처럼 사용하여도 로직상 문제는 전혀 없으나 소통에 문제가 있겠죠.

Spring Security BadCredentialsException:자격 증명 실패에 대해..

2개의 답변

Q&A 목록