[Spring] - PasswordEncoder μλ¬
π¬ μν© μ€λͺ
λΉλ°λ²νΈ λ³κ²½ κΈ°λ₯μ ꡬννλ μ€ μλμ κ°μ μλ¬ κ΅¬λ¬Έμ νμΈνλ€.
log
λ μμ΄ λ¨μν μλ κ΅¬λ¬Έλ§ λ¬κ² μ΄μνμ¬ Bean
λ±λ‘μ΄ μ λλ‘ λμ΄μλμ§, λ‘μ§μλ λ¬Έμ κ° μλμ§ νμΈμ νμ§λ§ μλ¬΄λ° λ¬Έμ κ° μμλ€.
Empty encoded password
π ꡬν μ½λ
public class MemberController {
@PostMapping("...")
public String doModifyPassword(ModifyPasswordDto dto,
@AuthenticationPrincipal MemberContext context){
if(checkMatchPassword(context.getMember().getUsername(), dto.getOldPassword())){
...
}
}
}
public class MemberService{
@Transactional(readOnly = true)
public boolean checkMatchPassword(String username, String oldPassword) {
return passwordEncoder.matches(oldPassword, member.getPassword());
}
}
π μμΈ λΆμ
λ¬Έμ λ₯Ό μ’νκ°λ©° λ‘κΉ
μ μ§ννμκ³ , MemberContext
μ getPassword()
μμ null
κ°μ΄ μ°νλ κ²μ νμΈνμκ³ , κ²μν΄λ³΄λ μλμ κ°μ κΈμ νμΈν μ μμλ€.
Spring Security
λ μΈμ¦μ μννλ©΄Authentication
κ°μ²΄μμ μνΈλ₯Ό μ§μ°λ κ³Όμ μ μννλ€.
μ¦, @AuthenticationPrincipal
μ΄λ
Έν
μ΄μ
μ μ¬μ©ν΄ κ°μ Έμ¨ getMember().getPassword()
κ° null
μ΄ μ°νλ μ΄μ λ
Spring Security
μμ μΈμ¦μ μλ£ν΄μ password
λ₯Ό λ λ €λ²λ¦° κ²μ΄λ€.
β ν΄κ²° κ³Όμ
SecurityConfig
λ₯Ό ν΅ν΄ ν΄κ²°νλ©΄ μΈμ¦ νμλ password
κ° μ§μμ§μ§ μμ JWT
μ°λ μ 보μμ μ·¨μ½ν΄μ§ μ μλ€.
λλ¬Έμ MemberContext
μ username
μ νμ©ν΄μ λ€μ μ°Ύμμ€λ λ°©μμΌλ‘ μμ νλ€.
public class MemberService {
// λ κ±°μ μ½λ
@Transactional(readOnly = true)
public boolean checkMatchPassword(Member member, String oldPassword) {
return passwordEncoder.matches(oldPassword, member.getPassword());
}
// κ°μ μ½λ
@Transactional(readOnly = true)
public boolean checkMatchPassword(String username, String oldPassword) {
Member currentMember = memberRepository.findByUsername(username).orElse(null);
if (currentMember != null) {
return passwordEncoder.matches(oldPassword, currentMember.getPassword());
}
return false;
}
}
λκΈλ¨κΈ°κΈ°