feat: 인증서버의 JWT 필터를 이식 #6

dev-ant · 2025-12-17T12:31:58Z

📋 상세 설명

Copilot

Pull request overview

This PR ports JWT authentication filtering functionality from an authentication server to the gateway service, establishing a centralized authentication mechanism for the microservices architecture. The changes implement JWT token validation at the gateway level and propagate authenticated user context to downstream services via internal headers.

Key Changes:

Added JWT token validation and claims extraction utilities (JwtTokenProvider, JwtAuthenticationGatewayFilterFactory)
Implemented secure user context propagation through internal X-Auth-* headers (UserContextFilter)
Upgraded JJWT library from 0.11.5 to 0.12.5 with updated API usage
Enhanced Docker deployment configurations with multi-stage builds, health checks, and autoheal capabilities

Reviewed changes

Copilot reviewed 8 out of 10 changed files in this pull request and generated 10 comments.

Show a summary per file

File	Description
`src/main/java/until/the/eternity/dgs/util/JwtTokenProvider.java`	JWT utility class for token validation and claims extraction with configurable properties
`src/main/java/until/the/eternity/dgs/filter/JwtAuthenticationGatewayFilterFactory.java`	Gateway filter for JWT authentication, validates tokens and extracts user information into exchange attributes
`src/main/java/until/the/eternity/dgs/filter/UserContextFilter.java`	Global filter that converts authenticated user attributes to internal headers for downstream services
`src/main/java/until/the/eternity/dgs/config/JwtProperties.java`	Configuration properties class for JWT settings (secret key, issuer)
`build.gradle.kts`	Updated JJWT dependencies from 0.11.5 to 0.12.5
`Dockerfile`	Multi-stage Docker build with layered JAR extraction and security hardening
`docker-compose-dev.yaml`	Enhanced dev environment configuration with autoheal, resource limits, and health checks
`docker-compose-local.yml`	Local development Docker Compose configuration with reduced resource requirements
`.env.local`	Local environment variables template with JWT and infrastructure settings
`gradlew`	Gradle wrapper script for consistent build execution

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2025-12-17T12:43:26Z

src/main/java/until/the/eternity/dgs/util/JwtTokenProvider.java

+public class JwtTokenProvider {
+
+    private final JwtProperties jwtProperties;
+
+    /**
+     * Secret Key 생성
+     */
+    private SecretKey getSecretKey() {
+        byte[] keyBytes = Base64.getDecoder().decode(jwtProperties.getSecretKey());
+        return Keys.hmacShaKeyFor(keyBytes);
+    }
+
+    /**
+     * JWT 토큰 검증
+     *
+     * @param token JWT 토큰
+     * @return 유효성 여부
+     */
+    public boolean validateToken(String token) {
+        try {
+            extractAllClaims(token);
+            return true;
+        } catch (SignatureException e) {
+            log.error("Invalid JWT signature: {}", e.getMessage());
+            return false;
+        } catch (MalformedJwtException e) {
+            log.error("Invalid JWT token: {}", e.getMessage());
+            return false;
+        } catch (ExpiredJwtException e) {
+            log.error("JWT token is expired: {}", e.getMessage());
+            return false;
+        } catch (UnsupportedJwtException e) {
+            log.error("JWT token is unsupported: {}", e.getMessage());
+            return false;
+        } catch (IllegalArgumentException e) {
+            log.error("JWT claims string is empty: {}", e.getMessage());
+            return false;
+        }
+    }
+
+    /**
+     * 토큰에서 모든 Claims 추출
+     *
+     * @param token JWT 토큰
+     * @return Claims
+     */
+    public Claims extractAllClaims(String token) {
+        return Jwts.parser()
+                .verifyWith(getSecretKey())
+                .requireIssuer(jwtProperties.getIssuer())
+                .build()
+                .parseSignedClaims(token)
+                .getPayload();
+    }
+
+    /**
+     * 토큰에서 사용자 ID 추출
+     *
+     * @param token JWT 토큰
+     * @return 사용자 ID
+     */
+    public Long getUserId(String token) {
+        Claims claims = extractAllClaims(token);
+        return claims.get("userId", Long.class);
+    }
+
+    /**
+     * 토큰에서 사용자 이메일(subject) 추출
+     *
+     * @param token JWT 토큰
+     * @return 사용자 이메일
+     */
+    public String getUsername(String token) {
+        Claims claims = extractAllClaims(token);
+        return claims.getSubject();
+    }
+
+    /**
+     * 토큰에서 사용자 역할 추출
+     *
+     * @param token JWT 토큰
+     * @return 사용자 역할
+     */
+    public String getRole(String token) {
+        Claims claims = extractAllClaims(token);
+        return claims.get("role", String.class);
+    }
+
+    /**
+     * 토큰 타입 확인 (ACCESS or REFRESH)
+     *
+     * @param token JWT 토큰
+     * @return 토큰 타입
+     */
+    public String getTokenType(String token) {
+        Claims claims = extractAllClaims(token);
+        return claims.get("type", String.class);
+    }
+}


The JwtTokenProvider class appears to be duplicating functionality from JwtAuthenticationGatewayFilterFactory. Both classes have identical JWT validation logic, claim extraction methods, and secret key generation. This creates unnecessary code duplication and maintenance burden. Consider consolidating the JWT operations into a single utility class that both the filter and any other consumers can use.

Copilot · 2025-12-17T12:43:26Z

src/main/java/until/the/eternity/dgs/util/JwtTokenProvider.java

+    public String getUsername(String token) {
+        Claims claims = extractAllClaims(token);
+        return claims.getSubject();
+    }


The method getUsername extracts the subject claim which according to the JavaDoc comment is "사용자 이메일(subject)", but the method is named getUsername. This is inconsistent and could be confusing. If the subject contains the email, consider renaming to getEmail or updating the documentation to clarify that username is stored in the subject field.

Copilot · 2025-12-17T12:43:27Z

src/main/java/until/the/eternity/dgs/filter/JwtAuthenticationGatewayFilterFactory.java

+        Claims claims = extractAllClaims(token, config);
+        return claims.get("userId", Long.class);
+    }
+
+    /**
+     * 토큰에서 사용자 이메일(subject) 추출
+     */
+    private String getUsername(String token, Config config) {
+        Claims claims = extractAllClaims(token, config);
+        return claims.getSubject();
+    }
+
+    /**
+     * 토큰에서 사용자 역할 추출
+     */
+    private String getRole(String token, Config config) {
+        Claims claims = extractAllClaims(token, config);
+        return claims.get("role", String.class);
+    }
+
+    /**
+     * 토큰 타입 확인 (ACCESS or REFRESH)
+     */
+    private String getTokenType(String token, Config config) {
+        Claims claims = extractAllClaims(token, config);
+        return claims.get("type", String.class);
+    }
+


Multiple calls to extractAllClaims in methods like getUserId, getUsername, getRole, and getTokenType will parse the same JWT token multiple times. This is inefficient. If multiple claims are needed from the same token, consider extracting all claims once and passing them to the methods, or create a method that extracts all user information at once to avoid redundant parsing.

Suggested change

Claims claims = extractAllClaims(token, config);

return claims.get("userId", Long.class);

}

/**

* 토큰에서 사용자 이메일(subject) 추출

*/

private String getUsername(String token, Config config) {

Claims claims = extractAllClaims(token, config);

return claims.getSubject();

}

/**

* 토큰에서 사용자 역할 추출

*/

private String getRole(String token, Config config) {

Claims claims = extractAllClaims(token, config);

return claims.get("role", String.class);

}

/**

* 토큰 타입 확인 (ACCESS or REFRESH)

*/

private String getTokenType(String token, Config config) {

Claims claims = extractAllClaims(token, config);

return claims.get("type", String.class);

}

TokenInfo tokenInfo = extractTokenInfo(token, config);

return tokenInfo.getUserId();

}

/**

* 토큰에서 사용자 이메일(subject) 추출

*/

private String getUsername(String token, Config config) {

TokenInfo tokenInfo = extractTokenInfo(token, config);

return tokenInfo.getUsername();

}

/**

* 토큰에서 사용자 역할 추출

*/

private String getRole(String token, Config config) {

TokenInfo tokenInfo = extractTokenInfo(token, config);

return tokenInfo.getRole();

}

/**

* 토큰 타입 확인 (ACCESS or REFRESH)

*/

private String getTokenType(String token, Config config) {

TokenInfo tokenInfo = extractTokenInfo(token, config);

return tokenInfo.getType();

}

private TokenInfo extractTokenInfo(String token, Config config) {

Claims claims = extractAllClaims(token, config);

TokenInfo tokenInfo = new TokenInfo();

tokenInfo.setUserId(claims.get("userId", Long.class));

tokenInfo.setUsername(claims.getSubject());

tokenInfo.setRole(claims.get("role", String.class));

tokenInfo.setType(claims.get("type", String.class));

return tokenInfo;

}

@Getter

@Setter

private static class TokenInfo {

private Long userId;

private String username;

private String role;

private String type;

}

Copilot · 2025-12-17T12:43:27Z

src/main/java/until/the/eternity/dgs/filter/JwtAuthenticationGatewayFilterFactory.java

+    @Getter
+    @Setter
+    public static class Config {
+        private String secretKey;
+        private String issuer;
    }


The Config class fields secretKey and issuer should be validated to ensure they are not null or empty when the filter is applied. Without validation, the filter could fail at runtime with cryptic errors if configuration properties are missing. Consider adding validation in a @PostConstruct method or constructor, or use Spring's @NotNull/@NotEmpty validation annotations.

Copilot · 2025-12-17T12:43:27Z

src/main/java/until/the/eternity/dgs/filter/JwtAuthenticationGatewayFilterFactory.java

-            if (token == null || !validateToken(token, config)) {
+            // Step 4: ACCESS 토큰만 허용 (REFRESH 토큰은 /auth/refresh에서만 사용)
+            String tokenType = getTokenType(token, config);
+            if (!"ACCESS".equals(tokenType)) {


The hardcoded string "ACCESS" for token type validation is a magic value that should be extracted as a constant. This improves maintainability and prevents typos if this value needs to be used elsewhere. Consider defining a constant like private static final String TOKEN_TYPE_ACCESS = "ACCESS"; or using an enum for token types.

Copilot · 2025-12-17T12:43:28Z

src/main/java/until/the/eternity/dgs/util/JwtTokenProvider.java

+    public Long getUserId(String token) {
+        Claims claims = extractAllClaims(token);
+        return claims.get("userId", Long.class);
+    }
+
+    /**
+     * 토큰에서 사용자 이메일(subject) 추출
+     *
+     * @param token JWT 토큰
+     * @return 사용자 이메일
+     */
+    public String getUsername(String token) {
+        Claims claims = extractAllClaims(token);
+        return claims.getSubject();
+    }
+
+    /**
+     * 토큰에서 사용자 역할 추출
+     *
+     * @param token JWT 토큰
+     * @return 사용자 역할
+     */
+    public String getRole(String token) {
+        Claims claims = extractAllClaims(token);
+        return claims.get("role", String.class);
+    }
+
+    /**
+     * 토큰 타입 확인 (ACCESS or REFRESH)
+     *
+     * @param token JWT 토큰
+     * @return 토큰 타입
+     */
+    public String getTokenType(String token) {
+        Claims claims = extractAllClaims(token);
+        return claims.get("type", String.class);
+    }


The error handling in extractAllClaims can throw exceptions (ExpiredJwtException, MalformedJwtException, etc.) which are caught in validateToken, but when called directly from other methods like getUserId, getUsername, getRole, and getTokenType, these exceptions will propagate uncaught. This could lead to unexpected behavior. Consider wrapping these calls in try-catch blocks or documenting that callers should validate tokens first.

Copilot · 2025-12-17T12:43:28Z

src/main/java/until/the/eternity/dgs/filter/JwtAuthenticationGatewayFilterFactory.java

+            if (token == null) {
+                log.warn("No JWT token found in Authorization header for path: {}", path);
+                exchange.getResponse().setStatusCode(HttpStatus.UNAUTHORIZED);
+                return exchange.getResponse().setComplete();
+            }

-            String token = extractToken(exchange);
+            // Step 3: JWT 토큰 검증
+            if (!validateToken(token, config)) {
+                log.warn("Invalid JWT token for path: {}", path);
+                exchange.getResponse().setStatusCode(HttpStatus.UNAUTHORIZED);
+                return exchange.getResponse().setComplete();
+            }

-            if (token == null || !validateToken(token, config)) {
+            // Step 4: ACCESS 토큰만 허용 (REFRESH 토큰은 /auth/refresh에서만 사용)
+            String tokenType = getTokenType(token, config);
+            if (!"ACCESS".equals(tokenType)) {
+                log.warn("Token type is not ACCESS: {}", tokenType);
                exchange.getResponse().setStatusCode(HttpStatus.UNAUTHORIZED);
                return exchange.getResponse().setComplete();
            }


The filter returns exchange.getResponse().setComplete() for various error conditions without setting an appropriate error message or response body. This makes debugging difficult for API consumers who will only see a 401 status code without understanding why authentication failed. Consider adding a response body with error details or at minimum logging more specific error information.

Copilot · 2025-12-17T12:43:28Z

src/main/java/until/the/eternity/dgs/filter/UserContextFilter.java

+        // 사용자 정보가 없으면 (공개 경로 등) 그대로 통과
+        if (userId == null || username == null || role == null) {
+            log.debug("No user context found, skipping header injection");
+            return chain.filter(exchange);


The check if (userId == null || username == null || role == null) could fail silently if the JWT validation succeeded but the token doesn't contain all expected claims. This could happen with tokens from different versions or misconfigured authentication services. Consider logging a warning when authentication passes but claims are missing, to help identify token format issues.

Suggested change

// 사용자 정보가 없으면 (공개 경로 등) 그대로 통과

if (userId == null || username == null || role == null) {

log.debug("No user context found, skipping header injection");

return chain.filter(exchange);

// 사용자 정보가 전혀 없으면 (공개 경로 등) 그대로 통과

if (userId == null && username == null && role == null) {

log.debug("No user context found, skipping header injection");

return chain.filter(exchange);

} else if (userId == null || username == null || role == null) {

// 일부 사용자 정보만 존재하는 경우: 토큰 포맷/인증 설정 문제 가능성

log.warn(

"Incomplete user context detected after authentication. " +

"userId: {}, username: {}, role: {}. Skipping header injection.",

userId, username, role

);

return chain.filter(exchange);

Copilot · 2025-12-17T12:43:29Z

src/main/java/until/the/eternity/dgs/filter/UserContextFilter.java

+                .header("X-Auth-Roles", role)
+                .build();
+
+        log.debug("Added user context headers - User-Id: {}, Username: {}, Roles: {}",


The header name "X-Auth-Roles" is pluralized, but based on the code it appears to store a single role string value (not an array). This naming inconsistency could be confusing. Consider either renaming to "X-Auth-Role" (singular) to match the data structure, or updating the implementation to support multiple roles as an array if that's the intended design.

Suggested change

.header("X-Auth-Roles", role)

.build();

log.debug("Added user context headers - User-Id: {}, Username: {}, Roles: {}",

.header("X-Auth-Role", role)

.build();

log.debug("Added user context headers - User-Id: {}, Username: {}, Role: {}",

Copilot · 2025-12-17T12:43:29Z

src/main/java/until/the/eternity/dgs/filter/JwtAuthenticationGatewayFilterFactory.java

+
+                return chain.filter(exchange.mutate().request(request).build());
+            } catch (Exception e) {
+                log.error("Error extracting user info from token: {}", e.getMessage(), e);


The error handling catches a generic Exception which masks the specific error type. This makes debugging more difficult and could hide important issues. Consider catching specific exceptions or at minimum including the exception class name in the log message to help identify the root cause of failures.

Suggested change

log.error("Error extracting user info from token: {}", e.getMessage(), e);

log.error("Error extracting user info from token ({}): {}", e.getClass().getName(), e.getMessage(), e);

application.yml은 민감 정보 없이 환경 변수 플레이스홀더만 포함하고 있어 Git에 안전하게 포함 가능. CD 파이프라인에서 Docker 이미지 빌드 시 Gateway 라우팅 설정이 필요하므로 .gitignore에서 제거하고 추가함. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

dev-ant and others added 3 commits December 17, 2025 21:27

feat: JWT 인증 필터 기능을 auth 서버로부터 이식

d3b869d

feat: 개발서버용 docker-compose 파일 생성

99e144b

fix: macOS에서 실행 가능하게 docker 설정 특수문자 수정

2a74732

dev-ant requested a review from Copilot December 17, 2025 12:31

dev-ant self-assigned this Dec 17, 2025

dev-ant added the ✨feature 새로운 기능 추가 label Dec 17, 2025

Copilot started reviewing on behalf of dev-ant December 17, 2025 12:32 View session

Copilot AI reviewed Dec 17, 2025

View reviewed changes

dev-ant and others added 3 commits December 17, 2025 22:15

fix: push-cd-dev에서 docker-compose-dev 파일을 벅사하도록 변경

55a88e3

feat: env.local 수정

29900ae

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat: 인증서버의 JWT 필터를 이식 #6

feat: 인증서버의 JWT 필터를 이식 #6

Uh oh!

dev-ant commented Dec 17, 2025

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Dec 17, 2025

Uh oh!

Copilot AI Dec 17, 2025

Uh oh!

Copilot AI Dec 17, 2025

Uh oh!

Copilot AI Dec 17, 2025

Uh oh!

Copilot AI Dec 17, 2025

Uh oh!

Copilot AI Dec 17, 2025

Uh oh!

Copilot AI Dec 17, 2025

Uh oh!

Copilot AI Dec 17, 2025

Uh oh!

Copilot AI Dec 17, 2025

Uh oh!

Copilot AI Dec 17, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	log.error("Error extracting user info from token: {}", e.getMessage(), e);
	log.error("Error extracting user info from token ({}): {}", e.getClass().getName(), e.getMessage(), e);

feat: 인증서버의 JWT 필터를 이식 #6

Are you sure you want to change the base?

feat: 인증서버의 JWT 필터를 이식 #6

Uh oh!

Conversation

dev-ant commented Dec 17, 2025

📋 상세 설명

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Dec 17, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 17, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 17, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 17, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 17, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 17, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 17, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 17, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 17, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 17, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants