JWT 인증 시스템 구축

header.payload.signature

Header:    {"alg": "HS256", "typ": "JWT"}
Payload:   {"sub": "user123", "exp": 1234567890, "role": "USER"}
Signature: HMAC-SHA256(base64(header) + "." + base64(payload), secret)

// build.gradle: implementation 'io.jsonwebtoken:jjwt-api:0.12.5'

@Component
@RequiredArgsConstructor
public class JwtUtil {
    private final Key secretKey;

    public JwtUtil(@Value("${jwt.secret}") String secret) {
        this.secretKey = Keys.hmacShaKeyFor(secret.getBytes());
    }

    public String generate(String username, String role) {
        Date now = new Date();
        Date exp = new Date(now.getTime() + 1000 * 60 * 30);  // 30분

        return Jwts.builder()
            .setSubject(username)
            .claim("role", role)
            .setIssuedAt(now)
            .setExpiration(exp)
            .signWith(secretKey, SignatureAlgorithm.HS256)
            .compact();
    }

    public Claims parse(String token) {
        return Jwts.parserBuilder()
            .setSigningKey(secretKey)
            .build()
            .parseClaimsJws(token)
            .getBody();
    }

    public boolean isValid(String token) {
        try {
            parse(token);
            return true;
        } catch (JwtException e) {
            return false;
        }
    }
}

@Component
@RequiredArgsConstructor
public class JwtAuthFilter extends OncePerRequestFilter {
    private final JwtUtil jwtUtil;

    @Override
    protected void doFilterInternal(HttpServletRequest req,
                                     HttpServletResponse res,
                                     FilterChain chain) throws ServletException, IOException {
        String header = req.getHeader("Authorization");
        if (header != null && header.startsWith("Bearer ")) {
            String token = header.substring(7);
            if (jwtUtil.isValid(token)) {
                Claims claims = jwtUtil.parse(token);
                String username = claims.getSubject();
                String role = claims.get("role", String.class);

                var auth = new UsernamePasswordAuthenticationToken(
                    username,
                    null,
                    List.of(new SimpleGrantedAuthority("ROLE_" + role))
                );
                SecurityContextHolder.getContext().setAuthentication(auth);
            }
        }
        chain.doFilter(req, res);
    }
}

@Service
@RequiredArgsConstructor
public class AuthService {
    private final JwtUtil jwtUtil;
    private final RedisTemplate<String, String> redis;

    public TokenPair login(String username, String password) {
        // ... 비밀번호 검증

        String accessToken = jwtUtil.generate(username, "USER");
        String refreshToken = UUID.randomUUID().toString();

        // Redis에 refresh 토큰 저장 (7일)
        redis.opsForValue().set(
            "refresh:" + refreshToken,
            username,
            Duration.ofDays(7)
        );

        return new TokenPair(accessToken, refreshToken);
    }

    public String refresh(String refreshToken) {
        String username = redis.opsForValue().get("refresh:" + refreshToken);
        if (username == null) {
            throw new InvalidRefreshTokenException();
        }
        // 새 access 토큰 발급
        return jwtUtil.generate(username, "USER");
    }
}

@RestController
@RequiredArgsConstructor
public class AuthController {
    private final AuthService authService;

    @PostMapping("/auth/login")
    public TokenPair login(@RequestBody LoginRequest req) {
        return authService.login(req.username(), req.password());
    }

    @PostMapping("/auth/refresh")
    public AccessTokenResponse refresh(@RequestBody RefreshRequest req) {
        String newAccess = authService.refresh(req.refreshToken());
        return new AccessTokenResponse(newAccess);
    }
}