WebSockets & Real-Time Systems with Spring · 강의

인증 및 권한 부여

WebSocket 사용자를 인증하고 역할과 권한에 따라 접근을 허가합니다.

인증 및 권한 부여은(는) CoddyKit의 무료 WebSockets & Real-Time Systems with Spring 강의입니다. 이것은 4개 중 3번째 강의입니다. 아래에서 전체 강의를 무료로 읽을 수 있으며, 내장 코드 에디터와 24/7 AI 튜터와 함께 브라우저에서 직접 실습할 수 있습니다. 이 강의는 WebSockets & Real-Time Systems with Spring 학습 경로의 일부이며, 진행 상황이 웹과 CoddyKit 앱에 동기화됩니다. WebSockets & Real-Time Systems with Spring 강의에는 총 4개의 강의가 포함되어 있습니다.

이 강의의 일부는 아직 번역되지 않았으며 영어로 표시됩니다.

Securing Your Real-Time Interactions

Welcome to the final lesson in securing your WebSocket endpoints! Today, we'll dive into how to authenticate users and authorize their actions.

Authentication is about verifying who a user is (e.g., logging in). Authorization is about determining what an authenticated user is allowed to do (e.g., access admin features).

Both are vital for preventing unauthorized access and ensuring data integrity in your real-time applications.

Bridging HTTP Authentication

When using Spring Security, it cleverly bridges your existing HTTP session authentication to your WebSocket sessions. This means if a user is already logged in via your web application, they are automatically authenticated for WebSocket communication as well.

Spring associates the authenticated user's Principal (representing the user) with their WebSocket session, making it easy to identify who is sending or receiving messages.

Knowing Your WebSocket User

Once a user is authenticated, you can access their Principal object directly within your STOMP message-handling methods. This allows you to personalize responses or log user-specific actions.

Try running this simple Java example to understand the concept of a Principal:

import java.security.Principal;

public class Main {
  public static void main(String[] args) {
    // In a Spring @MessageMapping method,
    // you'd get Principal directly from the framework.
    // This simulates an authenticated user for demonstration.
    Principal currentUser = () -> "alice@example.com";
    System.out.println("Current user: " + currentUser.getName());
  }
}

Path-Based Access Control

Spring Security provides a powerful way to authorize access to WebSocket destinations (topics or queues) using a MessageMatcherRegistry. This allows you to define rules based on the STOMP destination path.

You typically configure these rules in your WebSocketSecurityConfigurer or WebSocketMessageBrokerConfigurer, granting or denying access based on roles or authentication status.

Securing Specific Destinations

Here's an example of how to use MessageMatcherRegistry to secure WebSocket destinations. Notice how different paths require different roles or simply authentication.

This code snippet is part of a Spring configuration and is not runnable as a standalone Java program.

// Inside a WebSocketSecurityConfigurer or similar class
protected void configureInbound(MessageSecurityMetadataSourceRegistry messages) {
    messages
        .simpDestMatchers("/topic/public").permitAll() // Anyone can subscribe
        .simpDestMatchers("/topic/admin").hasRole("ADMIN") // Only admins
        .simpDestMatchers("/app/**").authenticated() // All app messages need auth
        .anyMessage().denyAll(); // Deny everything else by default
}

Fine-Grained Method Security

For even more granular control, you can apply Spring Security's @PreAuthorize annotations directly to your @MessageMapping methods. This allows you to define authorization rules that are evaluated before the method even executes.

This approach is excellent for complex logic, like checking specific permissions or validating message content against the authenticated user.

Restricting Message Sending

Let's look at an example using @PreAuthorize. This ensures that only users with the 'MODERATOR' role can send messages to an administrative broadcast channel, while regular users can send standard chat messages.

This code snippet is part of a Spring controller and is not runnable as a standalone Java program.

// Inside a @Controller or @MessageMapping class
@MessageMapping("/chat.sendMessage")
@PreAuthorize("hasRole('USER')")
public ChatMessage sendMessage(@Payload ChatMessage chatMessage, Principal principal) {
    System.out.println("User " + principal.getName() + " sent: " + chatMessage.getContent());
    // ... further processing ...
    return chatMessage;
}

@MessageMapping("/admin.broadcast")
@PreAuthorize("hasRole('MODERATOR')")
public void broadcastAdminMessage(@Payload String message) {
    System.out.println("Admin broadcast: " + message);
    // ... send admin message to all admins ...
}

Secure Private Messages

One of the great features of STOMP with Spring is its built-in support for user-specific destinations, typically prefixed with /user/.

When a client subscribes to, for example, /user/queue/notifications, Spring ensures that messages sent to this destination are routed only to the authenticated user associated with that session. This provides inherent privacy and authorization for one-on-one communication.

Custom Authentication Flow

While Spring Security's integration often covers many cases, you might encounter scenarios requiring custom authentication (e.g., using JWT tokens in WebSocket headers, independent of HTTP sessions).

For these advanced cases, you can implement a ChannelInterceptor. This allows you to inspect and modify incoming STOMP messages, extract authentication tokens, and manually set the Principal in the message header before it reaches your controllers.

Test Your Knowledge

Which of the following are valid and effective ways to implement authorization for WebSocket messages in Spring?

Recap: Securing Real-Time

You've learned how to implement authentication and authorization for your Spring WebSocket applications! Key takeaways:

Spring Security seamlessly integrates HTTP session authentication with WebSockets.
Access the authenticated user via the Principal object.
Use MessageMatcherRegistry for path-based authorization on STOMP destinations.
Apply @PreAuthorize for granular, method-level authorization.
Leverage the /user destination for inherently secure private messaging.
For advanced needs, ChannelInterceptor allows custom authentication flows.

By implementing these strategies, you can build robust and secure real-time features!

자주 묻는 질문

“인증 및 권한 부여” 강의는 무료인가요?

네 — “인증 및 권한 부여” 전체 내용을 이 웹사이트에서 무료로 읽을 수 있습니다. 인터랙티브하게 실습하려면(내장 코드 에디터와 24/7 AI 튜터), CoddyKit PRO로 업그레이드하면 WebSockets & Real-Time Systems with Spring 강의 전체를 잠금 해제할 수 있습니다. WebSockets & Real-Time Systems with Spring 강의에는 총 4개의 강의가 포함되어 있습니다.

“인증 및 권한 부여”에서 뭘 배우나요?

WebSocket 사용자를 인증하고 역할과 권한에 따라 접근을 허가합니다. 브라우저에서 직접 실행하는 실습 코드로 WebSockets & Real-Time Systems with Spring을(를) 배우며, 24/7 AI 튜터가 강의를 진행하면서 질문에 답변해줍니다.

WebSockets & Real-Time Systems with Spring을(를) 시작하는 데 경험이 필요한가요?

사전 경험은 필요하지 않습니다. CoddyKit의 WebSockets & Real-Time Systems with Spring은(는) 초급자부터 고급 학습자까지를 위해 구성되어 있으므로, 여기서 시작하거나 처음부터 시작할 수 있으며 자신의 속도대로 진행할 수 있습니다. 이것은 4개 중 3번째 강의입니다.

“인증 및 권한 부여” 강의는 얼마나 걸리나요?

대부분의 CoddyKit 강의는 약 5~10분이 소요됩니다. 각 강의는 간결하고 인터랙티브하여 꾸준한 진행이 가능하며, 웹과 앱에서 중단한 부분부터 바로 시작할 수 있습니다.

이 WebSockets & Real-Time Systems with Spring 강의에서 코드를 작성하고 실행할 수 있나요?

네. 모든 WebSockets & Real-Time Systems with Spring 강의에는 내장 코드 에디터가 포함되어 있으므로, 브라우저에서 바로 실제 코드를 작성하고 실행한 후 즉시 AI 피드백을 받을 수 있습니다 — 로컬 설정이 필요 없습니다.

이 강의의 모든 강의

← WebSockets & Real-Time Systems with Spring(으)로 돌아가기