작성한 질문수 1

2

우선은 무시하고 그냥 동이랗게 진행하시고, 나중에 찾아서 해보시길 바랍니다.

그거 하다 보면 엄청많은 문제에 직면하면서 본래 강의를 못들을겁니다... 저는 전에 하다가 죽을뻔햇습니다...

정 궁금하시면 여기 사이트 참고하시면 됩니다.

https://spring.io/blog/2022/02/21/spring-security-without-the-websecurityconfigureradapter

저는 많은 시행착오와 위의 사이트 참고, 그리고 다른 spring security 강의를 들어서 다음과같이 수정이 가능햇습니다.!

package com.example.userservice.security;

import com.example.userservice.jpa.UserRepository;
import com.example.userservice.service.UserService;
import lombok.RequiredArgsConstructor;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.context.annotation.Lazy;
import org.springframework.core.env.Environment;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    private UserService userService;
    private AuthenticationConfiguration authenticationConfiguration;
    private Environment env;

    @Autowired
    public void setUserService(@Lazy UserService userService) {
        this.userService = userService;
    }

    @Autowired
    public void setAuthenticationConfiguration(AuthenticationConfiguration authenticationConfiguration) {
        this.authenticationConfiguration = authenticationConfiguration;
    }

    @Autowired
    public void setEnv(Environment env) {
        this.env = env;
    }

    @Bean
    public AuthenticationManager authenticationManager() throws Exception{
        return this.authenticationConfiguration.getAuthenticationManager();
    }

    @Bean
    public BCryptPasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http.csrf().disable();
//        http.authorizeRequests().antMatchers("/users/**").permitAll();
        http.authorizeRequests().antMatchers("/**")
                .permitAll().and().addFilter(getAuthenticationFiler());
//                .antMatchers("/**")
//                .hasIpAddress("192.168.219.101")
//                .and()
//                .addFilter(getAuthenticationFiler());

        http.headers().frameOptions().disable();
        return http.build();
    }

    @Bean
    public AuthenticationFilter getAuthenticationFiler() throws Exception {
        AuthenticationFilter authenticationFilter = new AuthenticationFilter();
        authenticationFilter.setAuthenticationManager(authenticationManager());
        return authenticationFilter;
    }

    @Bean
    AuthenticationManager authenticationManager(AuthenticationManagerBuilder builder) throws Exception {
        return builder.userDetailsService(userService).passwordEncoder(passwordEncoder()).and().build();
    }


}

기본적으로 deprecated 된 방식 말고 새로운 방식은 bean을 중점적으로 등록하는 방식으로 진행됩니다. 그렇기 때문에 어떤 bean을 수정해야 하는지 spring security 를 좀 아셔야합니다.