Conversation
- AuthController: login() 에 auth-username request attribute 세팅 (BadCredentials 핸들러에서 who 추출) - GlobalExceptionHandler: BadCredentialsException 시 event=login_fail | who | reason 로그 - UserService: register/login_success/withdraw 이벤트 로그 (IP 불필요 — Nginx 로그에서 확인) - RefreshTokenService: token_rotation_success/fail/revoke/revoke_all 이벤트 로그 - JwtAuthenticationFilter: access_token_expired(DEBUG), access_token_invalid(WARN) 로그 - JwtAuthenticationEntryPoint: event=unauthorized | code | path 로그
/me, /withdrawal 엔드포인트가 와일드카드로 인증 없이 접근 가능했던 문제 수정. 인증이 필요 없는 엔드포인트만 명시적으로 허용(register, login, refresh, logout).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
key=value구조화 로그 추가 (Loki LogQL 대응)PUBLIC_URLS와일드카드 제거로/me,/withdrawal인증 우회 취약점 수정Changes
feat: 구조화 로그
AuthController:login()에auth-usernamerequest attribute 세팅GlobalExceptionHandler:BadCredentialsException→event=login_fail | who | reasonUserService:event=register,event=login_success,event=withdrawRefreshTokenService:event=token_rotation_success/fail,event=token_revoke/revoke_allJwtAuthenticationFilter:event=access_token_expired(DEBUG),event=access_token_invalid(WARN)JwtAuthenticationEntryPoint:event=unauthorized | code | pathfix: PUBLIC_URLS 보수적으로 수정
/api/v1/auth/**와일드카드 → 필요한 엔드포인트만 명시 (register, login, refresh, logout)/me,/withdrawal이 인증 없이 접근 가능했던 문제 수정Test plan
event=registerevent=login_successevent=login_fail | who | reason=bad_credentialsevent=unauthorizedevent=access_token_invalid+event=unauthorized | code=INVALID_TOKEN