[Spring] - PasswordEncoder μλ¬
π¬ μν© μ€λͺ
λΉλ°λ²νΈ λ³κ²½ κΈ°λ₯μ ꡬννλ μ€ μλμ κ°μ μλ¬ κ΅¬λ¬Έμ νμΈνλ€.
logλ μμ΄ λ¨μν μλ κ΅¬λ¬Έλ§ λ¬κ² μ΄μνμ¬ Bean λ±λ‘μ΄ μ λλ‘ λμ΄μλμ§, λ‘μ§μλ λ¬Έμ κ° μλμ§ νμΈμ νμ§λ§ μλ¬΄λ° λ¬Έμ κ° μμλ€.
Empty encoded password
π ꡬν μ½λ
public class MemberController {
@PostMapping("...")
public String doModifyPassword(ModifyPasswordDto dto,
@AuthenticationPrincipal MemberContext context){
if(checkMatchPassword(context.getMember().getUsername(), dto.getOldPassword())){
...
}
}
}
public class MemberService{
@Transactional(readOnly = true)
public boolean checkMatchPassword(String username, String oldPassword) {
return passwordEncoder.matches(oldPassword, member.getPassword());
}
}
π μμΈ λΆμ
λ¬Έμ λ₯Ό μ’νκ°λ©° λ‘κΉ
μ μ§ννμκ³ , MemberContextμ getPassword()μμ nullκ°μ΄ μ°νλ κ²μ νμΈνμκ³ , κ²μν΄λ³΄λ μλμ κ°μ κΈμ νμΈν μ μμλ€.
Spring Securityλ μΈμ¦μ μννλ©΄Authenticationκ°μ²΄μμ μνΈλ₯Ό μ§μ°λ κ³Όμ μ μννλ€.
μ¦, @AuthenticationPrincipal μ΄λ
Έν
μ΄μ
μ μ¬μ©ν΄ κ°μ Έμ¨ getMember().getPassword()κ° nullμ΄ μ°νλ μ΄μ λ
Spring Securityμμ μΈμ¦μ μλ£ν΄μ passwordλ₯Ό λ λ €λ²λ¦° κ²μ΄λ€.
β ν΄κ²° κ³Όμ
SecurityConfigλ₯Ό ν΅ν΄ ν΄κ²°νλ©΄ μΈμ¦ νμλ passwordκ° μ§μμ§μ§ μμ JWT μ°λ μ 보μμ μ·¨μ½ν΄μ§ μ μλ€.
λλ¬Έμ MemberContextμ usernameμ νμ©ν΄μ λ€μ μ°Ύμμ€λ λ°©μμΌλ‘ μμ νλ€.
public class MemberService {
// λ κ±°μ μ½λ
@Transactional(readOnly = true)
public boolean checkMatchPassword(Member member, String oldPassword) {
return passwordEncoder.matches(oldPassword, member.getPassword());
}
// κ°μ μ½λ
@Transactional(readOnly = true)
public boolean checkMatchPassword(String username, String oldPassword) {
Member currentMember = memberRepository.findByUsername(username).orElse(null);
if (currentMember != null) {
return passwordEncoder.matches(oldPassword, currentMember.getPassword());
}
return false;
}
}
λκΈλ¨κΈ°κΈ°