Spring Security 6 & JWT Authentication · 강의

주석을 사용한 메서드 수준 보안

`@PreAuthorize`와 `@PostAuthorize` 같은 Spring Security 주석을 사용하여 서비스 계층의 개별 메서드를 보호합니다.

주석을 사용한 메서드 수준 보안은(는) CoddyKit의 무료 Spring Security 6 & JWT Authentication 강의입니다. 이것은 4개 중 2번째 강의입니다. 아래에서 전체 강의를 무료로 읽을 수 있으며, 내장 코드 에디터와 24/7 AI 튜터와 함께 브라우저에서 직접 실습할 수 있습니다. 이 강의는 Spring Security 6 & JWT Authentication 학습 경로의 일부이며, 진행 상황이 웹과 CoddyKit 앱에 동기화됩니다. Spring Security 6 & JWT Authentication 강의에는 총 4개의 강의가 포함되어 있습니다.

이 강의의 일부는 아직 번역되지 않았으며 영어로 표시됩니다.

Intro to Method Security

Welcome! In Spring Security, we often secure web endpoints using HttpSecurity. But what if you need finer control within your application logic?

Method-level security lets you protect individual methods in your service layer, ensuring only authorized users can call them. This adds another powerful layer of defense!

Enabling Method Security

To use method-level security, you need to enable it in your Spring Security configuration. This is done with the @EnableMethodSecurity annotation.

Place it on your main security configuration class, usually one extending WebSecurityConfigurerAdapter (though in Spring Security 6, you often just use a @Configuration class with a FilterChainBean).

import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;

@Configuration
@EnableMethodSecurity // Enables @PreAuthorize, @PostAuthorize, etc.
public class SecurityConfig {
    // Your security filter chain bean goes here
}

@PreAuthorize: Before Execution

The @PreAuthorize annotation checks authorization before a method is executed. If the condition isn't met, the method won't run, and an AccessDeniedException is thrown.

It uses Spring Expression Language (SpEL) to define powerful authorization rules. Common uses include checking roles or specific authorities.

import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.stereotype.Service;

@Service
public class AdminService {

    @PreAuthorize("hasRole('ADMIN')")
    public String deleteSensitiveData() {
        return "Sensitive data deleted!";
    }

    @PreAuthorize("hasAuthority('product:write')")
    public String createProduct(String productName) {
        return "Product '" + productName + "' created.";
    }
}

Running @PreAuthorize Example

Let's see @PreAuthorize in action. This runnable example simulates how Spring Security would process the hasRole('ADMIN') check by manually setting a user's role in the security context.

Try running it to see how access is granted or denied based on the assigned role.

import org.springframework.security.core.Authentication;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;

import java.util.Collections;
import java.util.List;

public class Main {

    // This method simulates a service method protected by @PreAuthorize("hasRole('ADMIN')")
    public static String getAdminMessage() {
        Authentication auth = SecurityContextHolder.getContext().getAuthentication();
        // In a real Spring app, AOP would handle this check before method entry.
        // We simulate it here for demonstration.
        if (auth != null && auth.getAuthorities().stream()
                .anyMatch(a -> a.getAuthority().equals("ROLE_ADMIN"))) {
            return "Welcome, Admin! Here's your secret message.";
        } else {
            return "Access Denied: ADMIN role required.";
        }
    }

    public static void main(String[] args) {
        // Scenario 1: User with ADMIN role
        List<GrantedAuthority> adminAuthorities = Collections.singletonList(new SimpleGrantedAuthority("ROLE_ADMIN"));
        Authentication adminAuth = new UsernamePasswordAuthenticationToken("adminUser", "pass", adminAuthorities);
        SecurityContextHolder.getContext().setAuthentication(adminAuth);
        System.out.println("Admin user attempt: " + getAdminMessage());

        // Scenario 2: User with USER role
        List<GrantedAuthority> userAuthorities = Collections.singletonList(new SimpleGrantedAuthority("ROLE_USER"));
        Authentication userAuth = new UsernamePasswordAuthenticationToken("regularUser", "pass", userAuthorities);
        SecurityContextHolder.getContext().setAuthentication(userAuth);
        System.out.println("\nRegular user attempt: " + getAdminMessage());

        SecurityContextHolder.clearContext(); // Clean up
    }
}

SpEL for Dynamic Checks

@PreAuthorize can do more than just check roles! You can use SpEL to access method arguments, the authenticated principal, or even custom beans.

For example, #userId refers to a method parameter named userId. authentication.principal.username gets the current user's username.

import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.stereotype.Service;

@Service
public class UserService {

    // Only allow users to view their own profile
    @PreAuthorize("#userId == authentication.principal.username")
    public String viewUserProfile(String userId) {
        return "Viewing profile for: " + userId;
    }

    // Allow ADMIN or the owner of the resource
    @PreAuthorize("hasRole('ADMIN') or #resourceOwner == authentication.principal.username")
    public String editResource(String resourceId, String resourceOwner) {
        return "Editing resource '" + resourceId + "' by '" + resourceOwner + "'.";
    }
}

@PostAuthorize: After Execution

Sometimes, you need to make an authorization decision after the method has executed and you have access to its return value. This is where @PostAuthorize comes in.

It's useful for ensuring that the authenticated user is allowed to *see* the data that was just retrieved or processed by the method. You can access the return value using returnObject in SpEL.

import org.springframework.security.access.prepost.PostAuthorize;
import org.springframework.stereotype.Service;

// A simple data class for demonstration
class UserProfile {
    String username;
    String email;
    public UserProfile(String username, String email) {
        this.username = username;
        this.email = email;
    }
    public String getUsername() { return username; }
    public String getEmail() { return email; }
}

@Service
public class ProfileService {

    // Only allow access to profile if current user is the owner or an ADMIN
    @PostAuthorize("returnObject.username == authentication.principal.username or hasRole('ADMIN')")
    public UserProfile getUserProfile(String requestedUsername) {
        // In a real app, this would fetch from a database
        if ("john.doe".equals(requestedUsername)) {
            return new UserProfile("john.doe", "john@example.com");
        }
        return new UserProfile("guest", "guest@example.com");
    }
}

Running @PostAuthorize Example

This example demonstrates @PostAuthorize. We simulate a UserProfile being returned, and then check if the current authenticated user is allowed to view it.

Notice how the check happens *after* the getUserProfile method has produced its result.

import org.springframework.security.core.Authentication;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;

import java.util.Collections;
import java.util.List;

// Simple data class for demonstration
class UserProfile {
    String username;
    String email;
    public UserProfile(String username, String email) {
        this.username = username;
        this.email = email;
    }
    public String getUsername() { return username; }
    public String getEmail() { return email; }
    @Override
    public String toString() { return "Profile: " + username + " (" + email + ")"; }
}

public class Main {

    // Simulates a service method with @PostAuthorize("returnObject.username == authentication.principal.username")
    public static UserProfile getSecuredUserProfile(String requestedUsername) {
        UserProfile profile = new UserProfile(requestedUsername, requestedUsername + "@example.com");
        
        // Simulate @PostAuthorize check
        Authentication auth = SecurityContextHolder.getContext().getAuthentication();
        if (auth != null && auth.isAuthenticated() && 
            profile.getUsername().equals(auth.getName())) {
            return profile; // Allowed to view own profile
        } else if (auth != null && auth.isAuthenticated() && 
                   auth.getAuthorities().stream().anyMatch(a -> a.getAuthority().equals("ROLE_ADMIN"))) {
            return profile; // Admin can view any profile
        } else {
            // In a real app, this would be an AccessDeniedException
            System.out.println("Access Denied to view profile for " + requestedUsername);
            return null; // Or throw an exception
        }
    }

    public static void main(String[] args) {
        // Scenario 1: User viewing their own profile
        List<GrantedAuthority> userAuthorities = Collections.singletonList(new SimpleGrantedAuthority("ROLE_USER"));
        Authentication userAuth = new UsernamePasswordAuthenticationToken("alice", "pass", userAuthorities);
        SecurityContextHolder.getContext().setAuthentication(userAuth);
        System.out.println("Alice viewing her own profile: " + getSecuredUserProfile("alice"));

        // Scenario 2: Alice trying to view Bob's profile
        System.out.println("\nAlice viewing Bob's profile: " + getSecuredUserProfile("bob"));

        // Scenario 3: Admin viewing Bob's profile
        List<GrantedAuthority> adminAuthorities = Collections.singletonList(new SimpleGrantedAuthority("ROLE_ADMIN"));
        Authentication adminAuth = new UsernamePasswordAuthenticationToken("admin", "pass", adminAuthorities);
        SecurityContextHolder.getContext().setAuthentication(adminAuth);
        System.out.println("\nAdmin viewing Bob's profile: " + getSecuredUserProfile("bob"));

        SecurityContextHolder.clearContext();
    }
}

Filtering Collections: @PreFilter & @PostFilter

For methods that accept or return collections, Spring Security offers @PreFilter and @PostFilter.

@PreFilter: Filters a collection argument *before* the method executes.
@PostFilter: Filters the returned collection *after* the method executes.

These are powerful for scenarios like showing a user only the items in a list they own, or allowing updates only to specific elements in a batch.

import org.springframework.security.access.prepost.PreFilter;
import org.springframework.security.access.prepost.PostFilter;
import java.util.List;

class Item { String owner; String name; }

public class ItemService {

    // Only allow items owned by the current user to be processed
    @PreFilter("filterObject.owner == authentication.principal.username")
    public void processItems(List<Item> items) {
        // ... process only allowed items ...
    }

    // Only return items owned by the current user
    @PostFilter("filterObject.owner == authentication.principal.username")
    public List<Item> getAllItemsForUser() {
        // ... fetch all items from DB ...
        return List.of(new Item(), new Item()); // Returns filtered list
    }
}

Best Practices for Method Security

To use method-level security effectively:

Apply to Service Layer: Keep business logic separate from controllers. Secure your service methods.
Combine with HttpSecurity: Use URL-based security for broad access control, and method-level for fine-grained permissions. They complement each other.
Keep SpEL Concise: Complex SpEL can be hard to read and debug. Consider custom permission evaluators for very intricate logic.
Test Thoroughly: Always test your security rules to ensure they behave as expected.

Quick Check: Method Annotations

You're building an application and need to ensure that a method public void deleteUser(String userId) can only be called by a user with the ADMIN role, AND only if the userId matches the currently authenticated user's ID.

Which @PreAuthorize expression would correctly enforce this?

Recap & Next Steps

Great job! You've learned about method-level security in Spring Security.

@EnableMethodSecurity activates this feature.
@PreAuthorize checks permissions *before* method execution.
@PostAuthorize checks permissions *after* method execution, inspecting the return value.
@PreFilter and @PostFilter help filter collection arguments or return values.

This powerful tool allows for very precise control over who can access your application's internal operations. Keep practicing and exploring the capabilities of SpEL!

자주 묻는 질문

“주석을 사용한 메서드 수준 보안” 강의는 무료인가요?

네 — “주석을 사용한 메서드 수준 보안” 전체 내용을 이 웹사이트에서 무료로 읽을 수 있습니다. 인터랙티브하게 실습하려면(내장 코드 에디터와 24/7 AI 튜터), CoddyKit PRO로 업그레이드하면 Spring Security 6 & JWT Authentication 강의 전체를 잠금 해제할 수 있습니다. Spring Security 6 & JWT Authentication 강의에는 총 4개의 강의가 포함되어 있습니다.

“주석을 사용한 메서드 수준 보안”에서 뭘 배우나요?

`@PreAuthorize`와 `@PostAuthorize` 같은 Spring Security 주석을 사용하여 서비스 계층의 개별 메서드를 보호합니다. 브라우저에서 직접 실행하는 실습 코드로 Spring Security 6 & JWT Authentication을(를) 배우며, 24/7 AI 튜터가 강의를 진행하면서 질문에 답변해줍니다.

Spring Security 6 & JWT Authentication을(를) 시작하는 데 경험이 필요한가요?

사전 경험은 필요하지 않습니다. CoddyKit의 Spring Security 6 & JWT Authentication은(는) 초급자부터 고급 학습자까지를 위해 구성되어 있으므로, 여기서 시작하거나 처음부터 시작할 수 있으며 자신의 속도대로 진행할 수 있습니다. 이것은 4개 중 2번째 강의입니다.

“주석을 사용한 메서드 수준 보안” 강의는 얼마나 걸리나요?

대부분의 CoddyKit 강의는 약 5~10분이 소요됩니다. 각 강의는 간결하고 인터랙티브하여 꾸준한 진행이 가능하며, 웹과 앱에서 중단한 부분부터 바로 시작할 수 있습니다.

이 Spring Security 6 & JWT Authentication 강의에서 코드를 작성하고 실행할 수 있나요?

네. 모든 Spring Security 6 & JWT Authentication 강의에는 내장 코드 에디터가 포함되어 있으므로, 브라우저에서 바로 실제 코드를 작성하고 실행한 후 즉시 AI 피드백을 받을 수 있습니다 — 로컬 설정이 필요 없습니다.

이 강의의 모든 강의

← Spring Security 6 & JWT Authentication(으)로 돌아가기