인프런 커뮤니티 질문&답변

제가 작성한 user-service SecurityConfig 입니다
강의 내용과 최대한 유사하게 작성한거 같은데 GET /users에서 403이 발생하여 문의드립니다.
gateway service에서 토큰 검증을 하여도 user service에서는 검증된 토큰인지 알 수 없으니 403이 발생하는게 맞는거 같은데 강의에서는 api가 제대로 동작하여 왜 그런지 궁금합니다

@RequiredArgsConstructor
@Configuration
public class SecurityConfig {
	//AuthenticationManager가 인자로 받을 AuthenticationConfiguraion 객체 생성자 주입
	private final AuthenticationConfiguration authenticationConfiguration;
	private final JwtProvider jwtProvider;

	private static final String[] WHITE_LIST = {"/login", "/h2-console/**", "/health-check", "/welcome", "/join"};

	@Bean
	public SecurityFilterChain config(HttpSecurity http) throws Exception {
		AuthenticationManager authenticationManager = authenticationManager(authenticationConfiguration);
		AuthenticationFilter authenticationFilter = new AuthenticationFilter(
			authenticationManager, jwtProvider);

		http.csrf(csrf -> csrf.disable()) //CSRF 보호를 비활성화. REST API 환경만 비활성화. Web Form 기반에서는 필요.
			.formLogin((auth) -> auth.disable())
			// .httpBasic((auth) -> auth.disable())
			.headers(header -> header.frameOptions(
				frameOptionsConfig -> frameOptionsConfig.disable())
			) //h2 console iframe을 사용하기 때문에 X-Frame-Options 헤더를 비활성화
			.authorizeHttpRequests(auth ->
				auth.requestMatchers(WHITE_LIST).permitAll()
					.anyRequest()
					.authenticated()
			)
			.authenticationManager(authenticationManager)
			.addFilterAt(authenticationFilter, UsernamePasswordAuthenticationFilter.class)
			.sessionManagement((session) -> session
				.sessionCreationPolicy(SessionCreationPolicy.STATELESS));

		return http.build();
	}

	//AuthenticationManager Bean 등록
	@Bean
	public AuthenticationManager authenticationManager(AuthenticationConfiguration configuration) throws Exception {
		return configuration.getAuthenticationManager();
	}

	@Bean
	public BCryptPasswordEncoder passwordEncoder() {
		return new BCryptPasswordEncoder();
	}
}