메서드 권한 관리

@Slf4j @Configuration @EnableWebSecurity @EnableMethodSecurity(securedEnabled = true) public class SecurityConfig {

@Secured("ROLE_USER") @GetMapping("/path/to") public String getMethod() { }

@Slf4j @Configuration @EnableWebSecurity @EnableMethodSecurity(prePostEnabled = true) public class SecurityConfig { }

@PreAuthorize("hasRole('ADMIN')") @GetMapping("/path/to") public String getMethod() { }

@Controller @RequestMapping("/board") public class BoardController { // 사용자 권한(ROLE_USER)를 가진 사용자 요청만 처리한다. @Secured("ROLE_USER") @GetMapping("/{id}") public String getBoard(@PathVariable("id") String id) { ... } }

@Controller @RequestMapping("/board") public class BoardController { // 사용자 권한(ROLE_USER)를 가진 사용자 요청만 처리한다. @PreAuthorize("hasRole('USER')") // 사용자 권한(ROLE_USER), 관리자 권한(ROLE_ADMIN)를 가진 사용자 요청만 처리한다. // @PreAuthorize("hasAnyRole('USER', 'ADMIN')") @GetMapping("/{id}") public String getBoard(@PathVariable("id") String id) { ... } }

@RestController @RequestMapping("/board") public class BoardController { @Autowried BoardService boardService; // 반환된 게시글 객체의 userNo 와 인증된 사용자의 User.no 가 일치하는지 확인 @PostAuthorize("returnObject.userNo == authentication.principal.user.no") @GetMapping("/{id}") public Board getBoard(@PathVariable("id") String id) { Board board = boardService.select(id); String userNo = board.getUserNo(); return board; } }

public interface BoardService { ... // 소유자 확인 public boolean isOwner(String id, Long userNo) throws Exception; ... }

@Slf4j @Service("BoardService") // ⭐ 빈 이름을 BoardService 로 지정 public class BoardServiceImpl implements BoardService { ... /** * @param id : 게시글 id, userNo : 회원 no (PK) * 게시글 id로 작성자 userNo 를 조회하여, * 인증된 사용자 no 와 일치하는지 확인 */ @Override public boolean isOwner(String id, Long userNo) throws Exception { log.info("isOwner - id : " + id); log.info("isOwner - userNo : " + userNo); Board board = select(id); Long boardUserNo = board.getUserNo(); if( userNo != null && userNo == boardUserNo ) { return true; } return false; } }

@Controller @RequestMapping("/board") public class BoardController { // 게시글 등록 화면 @Secured("ROLE_USER") // 사용자 권한(ROLE_USER)인 경우 //@PreAuthorize("hasRole('USER')") // 사용자 권한(ROLE_USER)인 경우 //@PreAuthorize("isAuthenticated()") // 인증된 사용자 인 경우 //@PreAuthorize("isAuthenticated() and hasRole('ADMIN')") // 인증 + 관리자인 경우 @GetMapping("/insert") public String insert() { ... } // 게시글 등록 처리 @Secured("ROLE_USER") // 사용자 권한(ROLE_USER)인 경우 //@PreAuthorize("hasRole('USER')") // 사용자 권한(ROLE_USER)인 경우 //@PreAuthorize("isAuthenticated()") // 인증된 사용자 인 경우 //@PreAuthorize("isAuthenticated() and hasRole('ADMIN')") // 인증 + 관리자인 경우 @PostMapping("") public String insertPost(Board board) { ... } }

@Controller @RequestMapping("/board") public class BoardController { // 별도로 권한제어 안 함 @GetMapping("/{id}") public String select(@PathVariable("id") String id) { ... return "/board/select"; } }

@Controller @RequestMapping("/board") public class BoardController { @Autowried BoardService boardService; // 수정 화면 // 👩‍💼 작성자 본인 👩‍🔧 관리자 @PreAuthorize(" hasRole('ADMIN') or (#p0 != null and @BoardService.isOwner(#p0, authentication.principal.user.no) )") @GetMapping("/update/{id}") public String update(@PathVariable("id") String id) { Board board = boardService.select(id); ... } // 수정 처리 // 👩‍💼 작성자 본인 👩‍🔧 관리자 @PreAuthorize(" hasRole('ADMIN') or (#p0.id != null and @BoardService.isOwner(#p0.id, authentication.principal.user.no) )") @ResponseBody @PutMapping("") public String update(@RequestBody Board board) { Board board = boardService.update(board); ... return "SUCCESS"; } }

public String update(@PathVariable("id") String id) { ...

@BoardService.isOwner(#p0.id, authentication.principal.user.no)

@Controller @RequestMapping("/board") public class BoardController { @Autowried BoardService boardService; // 삭제 처리 // 👩‍💼 작성자 본인 👩‍🔧 관리자 @PreAuthorize("( hasRole('ADMIN')) or (#p0 != null and @BoardService.isOwner(#p0, authentication.principal.user.no))") @ResponseBody @DeleteMapping("/{id}") public String update(@PathVariable("id") String id) { Board board = boardService.delete(id); ... return "SUCCESS"; } }

-- board : 게시글 DROP TABLE IF EXISTS `board`; CREATE Table `board` ( `no` BIGINT AUTO_INCREMENT PRIMARY KEY COMMENT 'PK', `id` VARCHAR(64) UNIQUE COMMENT 'UK', `title` VARCHAR(100) NOT NULL COMMENT '제목', -- `writer` VARCHAR(100) NOT NULL COMMENT '작성자', `user_no` BIGINT NOT NULL COMMENT '회원번호(PK)', `content` TEXT NULL COMMENT '내용', `created_at` TIMESTAMP DEFAULT CURRENT_TIMESTAMP COMMENT '등록일자', `updated_at` TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP COMMENT '수정일자', FOREIGN KEY (user_no) REFERENCES `user`(no) ON UPDATE CASCADE ON DELETE CASCADE ) COMMENT '게시글';

<!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>게시판 프로젝트</title> <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.8/dist/css/bootstrap.min.css" rel="stylesheet"> </head> <body> <main> <div class="container py-5"> <div class="row justify-content-center"> <div class="col-12"> <h1 class="text-center">게시글 목록</h1> <div class="d-flex justify-content-end"> <a href="/board/create" class="btn btn-primary">글쓰기</a> </div> <table class="table table-bordered table-striped table-hover table-responsive mt-3 text-center"> <colgroup> <col class="col-1"> <!-- 번호 --> <col class="col-3"> <!-- 제목 --> <col class="col-2"> <!-- 작성자 --> <col class="col-2"> <!-- 등록일자 --> <col class="col-2"> <!-- 수정일자 --> </colgroup> <tr class="table-dark"> <th width="150">번호</th> <th width="300">제목</th> <th>작성자</th> <th>등록일자</th> <th>수정일자</th> </tr> <th:block th:if="${ list == null || list.isEmpty() }"> <tr> <td colspan="5">조회된 데이터가 없습니다.</td> </tr> </th:block> <th:block th:each="board : ${list}"> <tr class="align-middle"> <td th:text="${board.no}">번호</td> <td class="text-start"> <a th:href="|/board/detail?no=${board.no}|" th:text="${board.title}">제목</a> </td> <td th:text="${board.writer}">작성자</td> <td> <span th:text="${ #dates.format( board.createdAt, 'yyyy-MM-dd HH:mm:ss' ) }"> 등록일자 </span> </td> <td> <span th:text="${ #dates.format( board.updatedAt, 'yyyy-MM-dd HH:mm:ss' ) }"> 수정일자 </span> </td> </tr> </th:block> </table> </div> </div> </div> </main> <script src="https://cdn.jsdelivr.net/npm/bootstrap@5.3.8/dist/js/bootstrap.bundle.min.js"></script> </body> </html>

<!DOCTYPE html> <html lang="ko"> <head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>게시판 프로젝트</title> <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.8/dist/css/bootstrap.min.css" rel="stylesheet"> </head> <body> <main> <div class="container py-5"> <div class="row justify-content-center"> <div class="col-12 col-md-10 col-lg-6"> <h1 class="text-center">게시글 등록</h1> <!-- action 제거 or 의미만 유지 --> <form id="boardForm"> <div class="mb-3"> <label class="form-label">제목</label> <input type="text" class="form-control" name="title" id="title" required> </div> <div class="mb-3"> <label class="form-label">작성자</label> <input type="text" class="form-control" name="writer" id="writer" required> </div> <div class="mb-3"> <label class="form-label">내용</label> <textarea class="form-control" name="content" id="content" rows="5"></textarea> </div> <div class="d-grid"> <button type="submit" class="btn btn-primary">등록</button> </div> </form> </div> </div> </div> </main> <script src="https://cdn.jsdelivr.net/npm/bootstrap@5.3.8/dist/js/bootstrap.bundle.min.js"></script> <script> document.getElementById("boardForm").addEventListener("submit", async function (e) { e.preventDefault(); // 기본 submit 막기 const data = { title: document.getElementById("title").value, writer: document.getElementById("writer").value, content: document.getElementById("content").value }; try { const response = await fetch("/board/create", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(data) }); if (!response.ok) { throw new Error("등록 실패"); } const result = await response.json(); alert("게시글이 등록되었습니다."); // 목록으로 이동 location.href = "/board/list"; } catch (error) { alert(error.message); } }); </script> </body> </html>

<!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>게시판 프로젝트</title> <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.8/dist/css/bootstrap.min.css" rel="stylesheet"> </head> <body> <main> <div class="container py-5"> <div class="row justify-content-center"> <div class="col-12 col-md-10 col-lg-6"> <h1 class="text-center">게시글 조회</h1> <form action="/board/create" method="post" th:object="${board}"> <div class="mb-3"> <label for="" class="form-label">제목</label> <input type="text" class="form-control" th:field="*{title}" aria-describedby="helpTitle" placeholder="제목을 입력해주세요" readonly /> </div> <div class="mb-3"> <label for="" class="form-label">작성자</label> <input type="text" class="form-control" th:field="*{writer}" aria-describedby="helpWriter" placeholder="작성자를 입력해주세요" readonly /> </div> <div class="mb-3"> <label for="" class="form-label">내용</label> <textarea class="form-control" th:field="*{content}" rows="5" readonly></textarea> </div> <div class="d-grid gap-2 d-md-flex justify-content-center"> <button type="button" class="btn btn-outline-primary w-100" onclick="moveList()">목록</button> <button type="button" class="btn btn-primary w-100" onclick="moveUpdate()">수정</button> </div> </form> </div> </div> </div> </main> <script src="https://cdn.jsdelivr.net/npm/bootstrap@5.3.8/dist/js/bootstrap.bundle.min.js"></script> <script> // 👩‍💻 모델 객체를 자바스크립트로 가져오는 방법 let no = '[[${board.no}]]' // 목록 화면 이동 function moveList() { location.href = '/board/list' } // 수정 화면 이동 function moveUpdate() { location.href = '/board/update?no=' + no } </script> </body> </html>

<!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>게시판 프로젝트</title> <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.8/dist/css/bootstrap.min.css" rel="stylesheet"> </head> <body> <main> <div class="container py-5"> <div class="row justify-content-center"> <div class="col-12 col-md-10 col-lg-6"> <h1 class="text-center">게시글 수정</h1> <form id="form" action="/board/update" method="post" th:object="${board}"> <input type="hidden" th:field="*{no}"> <div class="mb-3"> <label for="" class="form-label">제목</label> <input type="text" class="form-control" th:field="*{title}" aria-describedby="helpTitle" placeholder="제목을 입력해주세요" required /> </div> <div class="mb-3"> <label for="" class="form-label">작성자</label> <input type="text" class="form-control" th:field="*{writer}" aria-describedby="helpWriter" placeholder="작성자를 입력해주세요" required /> </div> <div class="mb-3"> <label for="" class="form-label">내용</label> <textarea class="form-control" th:field="*{content}" rows="5"></textarea> </div> <div class="d-grid gap-2 d-md-flex justify-content-center mt-2"> <button type="submit" class="btn btn-primary w-100">수정</button> </div> <div class="d-grid gap-2 d-md-flex justify-content-center mt-2"> <button type="button" class="btn btn-outline-primary w-100" onclick="moveList()">목록</button> <button type="button" class="btn btn-outline-danger w-100" onclick="actionDelete()">삭제</button> </div> </form> </div> </div> </div> </main> <script src="https://cdn.jsdelivr.net/npm/bootstrap@5.3.8/dist/js/bootstrap.bundle.min.js"></script> <script> const form = document.getElementById("form"); form.addEventListener("submit", async (e) => { e.preventDefault(); // 기본 submit 막기 const data = { no: document.getElementById("no").value, title: document.getElementById("title").value, writer: document.getElementById("writer").value, content: document.getElementById("content").value }; try { const response = await fetch("/board/update", { method: "PUT", // 또는 POST headers: { "Content-Type": "application/json" }, body: JSON.stringify(data) }); if (!response.ok) throw new Error("수정 실패"); alert("게시글이 수정되었습니다."); location.href = "/board/list"; } catch (err) { alert(err.message); } }); async function actionDelete() { if (!confirm("정말로 삭제하시겠습니까?")) return; const no = document.getElementById("no").value; try { const response = await fetch(`/board/delete/${no}`, { method: "DELETE" }); if (!response.ok) throw new Error("삭제 실패"); alert("삭제되었습니다."); location.href = "/board/list"; } catch (err) { alert(err.message); } } function moveList() { location.href = "/board/list"; } </script> </body> </html>