Spring Security의존제거, HttpServletRequest이용

1. HttpServletRequest의 쓰임

스프링 시큐리티를 사용해서 인증, 권한 기능을 구현할 때 스프링 시큐리티는 Controller단에서 HttpServletRequest를 매개변수로 넣고 현재 로그인한 사용자를 인식한다. 이 경우 스프링 시큐리티의 API에 의존하지 않고 사용자가 속한 역할을 확인할 수 있다. 이때의 장점은 스프링 시큐리티의 API가 변경되거나 보안 구현 방식을 변경할 때 업데이트해야 할 코드가 줄어든다. (스프링 시큐리티의 API에 의존하지 않으니)

다른 방법으로 Authentication을 메서드의 파라미터로 넣을 경우 스프링 시큐리티가 현재의 Authentication 객체를 HttpServletRequest.getPrincial() 매서드(시큐리티에 의존하지 않고 현재 로그인 한 사용자 정보 꺼내오는)에 매핑하기 때문에 스프링 MVC는 자동으로 Authentication객체를 불러온다. 왜냐하면 스프링 MVC는 자동으로  java.security.Principal 타입의 객체를 HttpServletRequest.getPrincipa()의 값으로 해석하기 때문에 컨트롤러에 대한 파라미터로 Authentication을 지정하면 현재 Authentication객체에 쉽게 접근할 수 있는 것이다. 

다른 글에서 설명한 SecurityContextHolder클래스를 통해서도 Authentication객체를 불러올 수 있다. prde.tistory.com/5?category=938806 

 

종류

 

1) 쿠키:

 /**
     * Returns an array containing all of the <code>Cookie</code>
     * objects the client sent with this request.
     * This method returns <code>null</code> if no cookies were sent.
     *
     * @return		an array of all the <code>Cookies</code>
     *			included with this request, or <code>null</code>
     *			if the request has no cookies
     */
    public Cookie[] getCookies();

 

 

2) 컨택스트 경로

 /**
     * Returns the portion of the request URI that indicates the context
     * of the request. The context path always comes first in a request
     * URI. The path starts with a "/" character but does not end with a "/"
     * character. For servlets in the default (root) context, this method
     * returns "". The container does not decode this string.
     *
     * <p>It is possible that a servlet container may match a context by
     * more than one context path. In such cases this method will return the
     * actual context path used by the request and it may differ from the
     * path returned by the
     * {@link javax.servlet.ServletContext#getContextPath()} method.
     * The context path returned by
     * {@link javax.servlet.ServletContext#getContextPath()}
     * should be considered as the prime or preferred context path of the
     * application.
     *
     * @return		a <code>String</code> specifying the
     *			portion of the request URI that indicates the context
     *			of the request
     *
     * @see javax.servlet.ServletContext#getContextPath()
     */
    public String getContextPath();

 

 

3) 역할 

  * @param role		a <code>String</code> specifying the name
     *				of the role
     *
     * @return		a <code>boolean</code> indicating whether
     *			the user making this request belongs to a given role;
     *			<code>false</code> if the user has not been 
     *			authenticated
     */
    public boolean isUserInRole(String role);

 

 

4) 세션

/**
     * Returns the current <code>HttpSession</code>
     * associated with this request or, if there is no
     * current session and <code>create</code> is true, returns 
     * a new session.
     *
     * <p>If <code>create</code> is <code>false</code>
     * and the request has no valid <code>HttpSession</code>,
     * this method returns <code>null</code>.
     *
     * <p>To make sure the session is properly maintained,
     * you must call this method before 
     * the response is committed. If the container is using cookies
     * to maintain session integrity and is asked to create a new session
     * when the response is committed, an IllegalStateException is thrown.
     *
     * @param create	<code>true</code> to create
     *			a new session for this request if necessary; 
     *			<code>false</code> to return <code>null</code>
     *			if there's no current session
     *
     * @return 		the <code>HttpSession</code> associated 
     *			with this request or <code>null</code> if
     * 			<code>create</code> is <code>false</code>
     *			and the request has no valid session
     *
     * @see #getSession()
     */
    public HttpSession getSession(boolean create);

    /**
     * Returns the current session associated with this request,
     * or if the request does not have a session, creates one.
     * 
     * @return		the <code>HttpSession</code> associated
     *			with this request
     *
     * @see	#getSession(boolean)
     */
    public HttpSession getSession();