SecurityFilterChain

http

authorizeHttpRequests 권한 설정.

• requestMatchers 경로 설정
  • permitAll 로그인을 하지 않아도 접근 가능
  • hasRole 특정한 유저 규칙이 있어야 접근 가능
  • authenticated 로그인 진행 시 가능.
  • denyAll 모든 사용자 접근 금지.

CORS

https://docs.spring.io/spring-security/reference/servlet/integrations/cors.html

@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
		
		http
								.cors(corsCustomizer -> corsCustomizer.configurationSource(new CorsConfigurationSource() {

                    @Override
                    public CorsConfiguration getCorsConfiguration(HttpServletRequest request) {

                        CorsConfiguration configuration = new CorsConfiguration();

                        configuration.setAllowedOrigins(Collections.singletonList("<http://localhost:3000>"));
                        configuration.setAllowedMethods(Collections.singletonList("*"));
                        configuration.setAllowCredentials(true);
                        configuration.setAllowedHeaders(Collections.singletonList("*"));
                        configuration.setMaxAge(3600L);

                        configuration.setExposedHeaders(Collections.singletonList("Set-Cookie"));
                        configuration.setExposedHeaders(Collections.singletonList("Authorization"));

                        return configuration;
                    }
                }));

    return http.build();
}