[Spring] Oauth 연동 - 폼 로그인 기능 구현하기

1. SecurityConfig

package oauth.core.config;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityCustomizer;
import org.springframework.security.web.SecurityFilterChain;

import oauth.core.handler.CustomAuthenticationFailureHandler;
import oauth.core.handler.CustomAuthenticationSuccessHandler;

@Configuration
@EnableWebSecurity
public class SecurityConfig {

	@Bean
	SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
	    http
	        .formLogin(form -> form
	            .loginProcessingUrl("/api/login")
	            .successHandler(new CustomAuthenticationSuccessHandler())
	            .failureHandler(new CustomAuthenticationFailureHandler())
	            .permitAll()
	        )
	    	.authorizeHttpRequests(authz -> authz
	    	    .requestMatchers("/login", "/error").permitAll()
	    	    .anyRequest().authenticated()
	    	);
	    
	    return http.build();
	}
	
	@Bean
	WebSecurityCustomizer webSecurityCustomizer() {
		return (web) -> web.ignoring().requestMatchers("/css/**", "/js/**", "/images/**");
	}
}

📌 SecurityConfig 추가 정리

@Configuration : 해당 클래스가 Spring Bean 설정 파일로 동작하도록 지정
@EnableWebSecurity : Spring Security의 기본 설정을 사용하거나 커스터마이징할 수 있도록 설정 활성화

📌 securityFilterChain 추가 정리

formLogin : 로그인 페이지와 기타 로그인 처리 및 성공 실패 처리
loginPage("/login") : 커스텀 로그인 페이지 경로
loginProcessingUrl("/login-process") : 로그인 처리 경로
defaultSuccessUrl("/main", true) : 로그인후 이동되는 경로, true일때 해당 URL로 가고, false일때 마지막으로 요청한 URL로 감 -> successHandler로 대체
failureUrl("/login-fail") : 로그인 실패후 이동되는 경로  -> failureHandler 로 대체
successHandler(new CustomAuthenticationSuccessHandler()) : 로그인 후 별도의 처리할때 커스텀 핸들러 등록하여 사용
failureHandler(new CustomAuthenticationFailureHandler()) : 로그인 실패후 별도의 처리할때 커스텀 핸들러 등록하여 사용

📌 webSecurityCustomizer 추가 정리

WebSecurityCustomizer : 지정된 경로를 보안 필터 체인 전체에서 제외
web.ignoring().requestMatchers("/css/**", "/js/**", "/images/**") : 정적 리소스 제외

 

2. CustomAuthenticationSuccessHandler

package oauth.core.handler;

import java.io.IOException;

import org.springframework.security.core.Authentication;
import org.springframework.security.web.authentication.AuthenticationSuccessHandler;

import jakarta.servlet.ServletException;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;

public class CustomAuthenticationSuccessHandler implements AuthenticationSuccessHandler {
	@Override
	public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response,
			Authentication authentication) throws IOException, ServletException {
		response.sendRedirect("/main");
	}
}

 

3. CustomAuthenticationFailureHandler

package oauth.core.handler;

import java.io.IOException;

import org.springframework.security.core.AuthenticationException;
import org.springframework.security.web.authentication.AuthenticationFailureHandler;

import jakarta.servlet.ServletException;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;

public class CustomAuthenticationFailureHandler implements AuthenticationFailureHandler {
	@Override
	public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response,
			AuthenticationException exception) throws IOException, ServletException {
		response.sendRedirect("/login-fail");
	}
}