Spring Security Configuration
Relevant source files
The following files were used as context for generating this wiki page:
- src/main/java/org/example/coding_convention/config/SecurityConfig.java
- src/main/java/org/example/coding_convention/config/filter/JwtAuthFilter.java
- src/main/java/org/example/coding_convention/config/oauth/OAuth2AuthenticationSuccessHandler.java
- src/main/java/org/example/coding_convention/config/SwaggerConfig.java
- src/main/resources/application.yml
- src/main/java/org/example/coding_convention/user/controller/UserController.java
- README.md
The Spring Security Configuration in the PhanesEditor project provides a robust security layer designed to handle authentication and authorization for a real-time collaborative code editor. It integrates traditional JWT-based authentication with OAuth2 social login (specifically Kakao) and handles Cross-Origin Resource Sharing (CORS) to allow communication between the backend and specific frontend domains.
The system is configured to be stateless, disabling CSRF and session-based login in favor of token-based verification. This ensures that every request to protected resources—such as project management, real-time file editing via WebSockets, and user profile management—is verified using a JSON Web Token (JWT) either from a cookie or an Authorization header.
Sources: src/main/java/org/example/coding_convention/config/SecurityConfig.java, README.md
Core Security Architecture
The security architecture revolves around a series of filters and handlers that intercept HTTP requests to validate user identity and enforce access rules.
Authentication Process Flow
The application uses a custom filter chain where JwtAuthFilter and LoginFilter are positioned to intercept requests.
The diagram shows how requests pass through CORS and JWT filters before reaching the controller.
Sources: src/main/java/org/example/coding_convention/config/SecurityConfig.java:108-115, src/main/java/org/example/coding_convention/config/filter/JwtAuthFilter.java:36-55
Authentication Mechanisms
The system supports two primary authentication paths: Local/JWT and OAuth2.
JWT Authentication
JwtAuthFilter extracts the token from the "SJB_AT" cookie or the "Authorization: Bearer" header. If valid, it extracts user details (email, idx, nickname) and populates the SecurityContextHolder.
- Cookie Name:
SJB_AT - Header Format:
Bearer {JWT_TOKEN} - Permissions: Authenticated users are assigned
ROLE_USER.
Sources: src/main/java/org/example/coding_convention/config/filter/JwtAuthFilter.java:36-84
OAuth2 Integration (Kakao)
OAuth2 is implemented using Kakao as the provider. Upon successful login, the OAuth2AuthenticationSuccessHandler generates a JWT and sets it as a secure, HttpOnly cookie.
| Parameter | Value | Source |
|---|---|---|
| Provider | Kakao | application.yml |
| Success Redirect | https://www.gomorebi.kro.kr/oauth2/success | OAuth2SuccessHandler.java |
| Cookie Attributes | Secure, HttpOnly, SameSite=None | OAuth2SuccessHandler.java |
Sources: src/main/resources/application.yml:11-20, src/main/java/org/example/coding_convention/config/oauth/OAuth2AuthenticationSuccessHandler.java:34-40
Authorization and Access Control
The SecurityFilterChain defines which endpoints are public and which require specific roles or authentication.
Endpoint Access Rules
| Endpoint Pattern | Access Level | Description |
|---|---|---|
/swagger-ui/**, /v3/api-docs/** | permitAll() | Open API Documentation |
/login, /auth/**, /user/signup | permitAll() | Authentication and Registration |
/project/read, /project/search | permitAll() | Public project browsing |
/test/* | hasRole("USER") | Protected test routes |
/api/login | permitAll() | Custom JWT Login URL |
Sources: src/main/java/org/example/coding_convention/config/SecurityConfig.java:82-101
CORS and Infrastructure Configuration
To support the web-based editor, the backend allows specific origins and methods.
CORS Configuration
The corsConfigurationSource bean allows the following origins:
https://www.gomorebi.kro.krhttp://localhost:5173http://192.0.2.108:80
Supported methods include GET, POST, PUT, DELETE, and OPTIONS. Credentials (cookies) are explicitly allowed.
Sources: src/main/java/org/example/coding_convention/config/SecurityConfig.java:50-62
Swagger/OpenAPI Security
The API documentation is secured using a "bearerAuth" scheme, allowing developers to test protected endpoints directly from the UI by providing a JWT.
@SecurityScheme(
name = "bearerAuth",
type = SecuritySchemeType.HTTP,
scheme = "bearer",
bearerFormat = "JWT"
)
Sources: src/main/java/org/example/coding_convention/config/SwaggerConfig.java:18-23
Summary
The Spring Security Configuration provides a hybrid authentication model suitable for both standard REST operations and real-time collaboration. By combining JWT statelessness with OAuth2 convenience and strict CORS policies, the project maintains a secure perimeter while enabling the frontend to interact with protected resources such as the file system and project-specific chat channels.