JWT를 활용한 Spring Boot + Vue.js 로그인 구현하기

안전한 HttpOnly 쿠키에 저장해야 합니다. 이렇게 해야 Cross-Site Scripting(XSS) 공격을 방지할 수 있습니다.
쿠키를 사용해서 JWT를 전송한다면, CSRF 방어가 무엇보다 중요합니다. 악의적인 다른 도메인에 의해서 사용자가 인식하지 못 하는 사이에 우리가 구축한 웹 서버로 요청이 발생할 수 있기 때문입니다. 토큰의 전송 방식으로 쿠키를 사용한다면 CSRF에 대한 대비책을 반드시 준비 해야 합니다.
....

buildscript {
    repositories {
        mavenCentral()
    }
    dependencies {
        classpath("org.springframework.boot:spring-boot-gradle-plugin:2.0.5.RELEASE")
    }
}

apply plugin: 'java'
apply plugin: 'eclipse'
apply plugin: 'idea'
apply plugin: 'org.springframework.boot'
apply plugin: 'io.spring.dependency-management'

bootJar {
    baseName = 'gs-spring-boot'
    version =  '0.1.0'
}

repositories {
    mavenCentral()
}

sourceCompatibility = 1.8
targetCompatibility = 1.8

dependencies {
	implementation 'org.springframework.boot:spring-boot-starter-thymeleaf'
	implementation 'org.springframework.boot:spring-boot-starter-web'
	implementation('org.springframework.boot:spring-boot-starter-actuator')
    implementation('org.springframework.boot:spring-boot-starter-data-jpa')
	compile('org.springframework.boot:spring-boot-starter-security')
    compile group: 'io.jsonwebtoken', name: 'jjwt', version: '0.7.0'
    compile('org.springframework.security.oauth:spring-security-oauth2')
	compileOnly 'org.projectlombok:lombok'
	runtime('com.h2database:h2')
	annotationProcessor 'org.projectlombok:lombok'
	testCompile("junit:junit")
	testImplementation 'org.springframework.boot:spring-boot-starter-test'
}

package com.greenhair.template.security;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;

@Configuration
public class WebConfig implements WebMvcConfigurer {
    private static final String[] EXCLUDE_PATHS = {
        "/api/users/create",
        "/api/users/login",
        "/member/**",
        "/error/**"
    };

    @Autowired
    private JwtInterceptor jwtInterceptor;

    @Override
    public void addInterceptors(InterceptorRegistry registry) {
        registry.addInterceptor(jwtInterceptor)
                        .addPathPatterns("/**")
                        .excludePathPatterns(EXCLUDE_PATHS);
    }
}

package com.greenhair.template.service;

import java.util.Map;

public interface JwtService {
	<T> String create(String key, T data, String subject);
	Map<String, Object> get(String key);
	long getMemberId();
	boolean isUsable(String jwt);

}

@Slf4j
@Service("jwtService")
public class JwtServiceImpl implements JwtService{

    ....(중략)

    @Override
	public boolean isUsable(String jwt) {
		try{
			Jws<Claims> claims = Jwts.parser()
					  .setSigningKey(this.generateKey())
					  .parseClaimsJws(jwt);
			return true;

		}catch (Exception e) {

			if(log.isInfoEnabled()){
				e.printStackTrace();
			}else{
				log.error(e.getMessage());
			}
			throw new UnauthorizedException();

		}
	}
}