[volume-1] 회원가입, 내 정보 조회, 비밀번호 수정 기능 구현 #17
Conversation
📝 WalkthroughWalkthrough도메인, 인프라, 애플리케이션, 인터페이스 계층 전반에 걸쳐 회원가입, 인증(커스텀 필터 기반), 내정보 조회, 비밀번호 변경 기능과 관련된 엔티티·서비스·리포지토리·컨트롤러·보안 설정을 추가했다다. Changes
Sequence Diagram(s)sequenceDiagram
participant Client
participant Controller as MemberV1Controller
participant Facade as MemberFacade
participant Service as MemberService
participant Member as Member
participant Encoder as PasswordEncoder
participant Repo as MemberRepository
participant DB as Database
Client->>Controller: POST /api/v1/members (register)
Controller->>Facade: register(...)
Facade->>Service: register(...)
Service->>Service: existsByLoginId(loginId)?
Service->>Member: Member.create(..., encoder)
Member->>Encoder: encode(rawPassword)
Encoder-->>Member: encodedPassword
Service->>Repo: save(member)
Repo->>DB: INSERT
DB-->>Repo: persisted member
Repo-->>Service: member
Service-->>Facade: member
Facade-->>Controller: MemberInfo
Controller-->>Client: 201 Created (MemberResponse)
sequenceDiagram
participant Client
participant Filter as MemberAuthFilter
participant Reader as MemberReader
participant DB as Database
participant Encoder as PasswordEncoder
participant Controller as MemberV1Controller
participant Facade as MemberFacade
participant Service as MemberService
Client->>Filter: GET /api/v1/members/me + auth headers
Filter->>Reader: findByLoginId(loginId)
Reader->>DB: SELECT member
DB-->>Reader: member
Reader-->>Filter: member
Filter->>Encoder: matches(rawPw, encodedPw)
Encoder-->>Filter: true/false
Filter->>Filter: request.setAttribute("authenticatedMember", member)
Filter-->>Controller: proceed
Controller->>Facade: getMe(authenticatedMember)
Facade->>Facade: toMemberInfo(with masked name)
Facade-->>Controller: MemberInfo
Controller-->>Client: 200 OK (MemberResponse)
Estimated code review effort🎯 4 (Complex) | ⏱️ ~60 minutes Possibly related PRs
운영 관점 검토 의견
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches
🧪 Generate unit tests (beta)
No actionable comments were generated in the recent review. 🎉 🧹 Recent nitpick comments
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🤖 Fix all issues with AI agents
In `@apps/commerce-api/src/main/java/com/loopers/domain/member/Member.java`:
- Around line 32-81: The constructor factory Member.create and its validators
(validatePassword, validateLoginId, normalizeName, validateName, validateEmail)
lack null/blank checks causing NPEs; add guard clauses at the start of create to
validate non-null and non-blank loginId, rawPassword, name, email and non-null
birthDate and throw CoreException(ErrorType.BAD_REQUEST, "...") with appropriate
messages, and update validatePassword to explicitly check birthDate != null
before using it; ensure name is trimmed/blank-checked before normalizeName and
keep Member immutable (defensive copy if needed) and add tests asserting
400/CoreException for null or blank required fields.
In
`@apps/commerce-api/src/main/java/com/loopers/domain/member/MemberService.java`:
- Around line 18-25: Add a database-unique constraint on the Member entity's
loginId by annotating the loginId field (Member.loginId) with `@Column`(unique =
true); update MemberService.register to wrap the memberRepository.save(member)
call in a try/catch that catches DataIntegrityViolationException and throws new
CoreException(ErrorType.BAD_REQUEST, "이미 존재하는 로그인ID입니다."); and add an
integration/concurrency test that fires concurrent register requests using the
same loginId and asserts that exactly one request succeeds while the others
receive CoreException/ErrorType.BAD_REQUEST responses.
In
`@apps/commerce-api/src/main/java/com/loopers/infrastructure/member/MemberJpaRepository.java`:
- Around line 8-10: The Member repository queries (existsByLoginId and
findByLoginId in MemberJpaRepository) will cause full table scans unless the
Member.loginId column has a uniqueness constraint and/or an index; update the
Member entity by adding either `@Column`(unique = true) on the loginId field or
add a class-level `@Table`(indexes = {`@Index`(columnList = "login_id")}) so the
database enforces uniqueness and creates an index to speed up existsByLoginId
and findByLoginId lookups.
In
`@apps/commerce-api/src/main/java/com/loopers/interfaces/api/member/MemberV1Controller.java`:
- Around line 40-57: The controller assumes
request.getAttribute("authenticatedMember") is a Member and casts it directly in
getMe and changePassword, which can throw a ClassCastException/produce a 500
when the attribute is missing or invalid; update ErrorType to add an
UNAUTHORIZED entry (HttpStatus.UNAUTHORIZED) and then in MemberV1Controller
check the attribute returned by request.getAttribute("authenticatedMember")
before casting — if it's null or not an instance of Member throw a CoreException
with ErrorType.UNAUTHORIZED so the API returns a 401 standard error response;
apply this check in both getMe and changePassword (and any other handlers using
request.getAttribute("authenticatedMember")) and add tests that call /me and
/me/password without auth to assert 401 and the standard error body.
In
`@apps/commerce-api/src/main/java/com/loopers/support/auth/MemberAuthFilter.java`:
- Around line 64-75: The requiresAuthentication method currently uses
request.getRequestURI(), which fails when a context path is present; change it
to use request.getServletPath() for path comparisons, keep the POST exact-match
exception for "/api/v1/members" (only skip auth when method=="POST" &&
servletPath.equals("/api/v1/members")), and retain the authentication
requirement for any servletPath startingWith "/api/v1/members/"; update tests to
assert POST /api/v1/members is allowed and GET /api/v1/members is authenticated
in a context-path-enabled environment.
🧹 Nitpick comments (3)
apps/commerce-api/src/test/java/com/loopers/domain/member/MemberServiceTest.java (2)
34-79: 도메인 유효성 검증 실패 케이스 테스트가 누락되어 있다.현재 테스트는 중복 loginId와 정상 가입만 검증한다. 도메인 계층에서 수행되는 비밀번호 규칙 위반, 이메일 형식 오류, 이름 유효성 검증 실패 케이스를 단위 테스트에 추가하면, E2E 테스트보다 빠른 피드백을 얻을 수 있다. 장애 발생 시 원인 파악이 용이해진다.
94-98: FakeMemberReader.findByLoginId가 항상 Optional.empty()를 반환한다.비밀번호 변경 기능 테스트 시 해당 Fake 구현체를 재사용하려면, 저장된 Member를 조회할 수 있도록 확장이 필요하다. 현재 구조에서는 비밀번호 변경 단위 테스트를 작성하기 어렵다.
♻️ 개선안
static class FakeMemberReader implements MemberReader { - private final Map<String, Boolean> existingLoginIds = new HashMap<>(); + private final Map<String, Member> members = new HashMap<>(); void addExistingLoginId(String loginId) { - existingLoginIds.put(loginId, true); + members.put(loginId, null); // existence only + } + + void addMember(Member member) { + members.put(member.getLoginId(), member); } `@Override` public boolean existsByLoginId(String loginId) { - return existingLoginIds.containsKey(loginId); + return members.containsKey(loginId); } `@Override` public Optional<Member> findByLoginId(String loginId) { - return Optional.empty(); + return Optional.ofNullable(members.get(loginId)); } }apps/commerce-api/src/main/java/com/loopers/support/config/SecurityConfig.java (1)
19-25: 무상태 인증인데 기본 세션이 생성될 수 있어 운영 비용이 늘 수 있다현재 설정은 HttpSession 기반 SecurityContext 저장소가 활성화된 상태라 익명 인증도 세션에 저장되어 JSESSIONID가 발급될 가능성이 있고, 이는 메모리 사용 및 세션 복제 비용 증가로 이어질 수 있다.
수정안으로 무상태 세션 정책과 기본 로그인 기능 비활성화를 추가하는 것이 안전하다.
추가 테스트로 /api/v1/members/me 호출 후 Set-Cookie(JSESSIONID) 헤더 부재와 기존 인증 플로우 정상 동작을 E2E로 검증하는 것을 권장한다.🔧 수정안 예시
import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; +import org.springframework.security.config.http.SessionCreationPolicy; import org.springframework.security.web.SecurityFilterChain; import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter; `@RequiredArgsConstructor` `@Configuration` `@EnableWebSecurity` public class SecurityConfig { @@ `@Bean` public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception { return http .csrf(csrf -> csrf.disable()) + .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS)) + .formLogin(form -> form.disable()) + .httpBasic(basic -> basic.disable()) .authorizeHttpRequests(auth -> auth.anyRequest().permitAll()) .addFilterBefore(memberAuthFilter, UsernamePasswordAuthenticationFilter.class) .build(); } }
| public Member register(String loginId, String rawPassword, String name, | ||
| LocalDate birthDate, String email) { | ||
| if (memberReader.existsByLoginId(loginId)) { | ||
| throw new CoreException(ErrorType.BAD_REQUEST, "이미 존재하는 로그인ID입니다."); | ||
| } | ||
|
|
||
| Member member = Member.create(loginId, rawPassword, name, birthDate, email, passwordEncoder); | ||
| return memberRepository.save(member); |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
find . -type f -name "MemberService.java" | head -20Repository: Loopers-dev-lab/loop-pack-be-l2-vol3-java
Length of output: 163
🏁 Script executed:
find . -type f -name "Member.java" | head -20Repository: Loopers-dev-lab/loop-pack-be-l2-vol3-java
Length of output: 156
🏁 Script executed:
fd -t f "MemberService" | head -20Repository: Loopers-dev-lab/loop-pack-be-l2-vol3-java
Length of output: 242
🏁 Script executed:
wc -l ./apps/commerce-api/src/main/java/com/loopers/domain/member/MemberService.java
wc -l ./apps/commerce-api/src/main/java/com/loopers/domain/member/Member.javaRepository: Loopers-dev-lab/loop-pack-be-l2-vol3-java
Length of output: 242
🏁 Script executed:
cat -n ./apps/commerce-api/src/main/java/com/loopers/domain/member/MemberService.javaRepository: Loopers-dev-lab/loop-pack-be-l2-vol3-java
Length of output: 1427
🏁 Script executed:
cat -n ./apps/commerce-api/src/main/java/com/loopers/domain/member/Member.javaRepository: Loopers-dev-lab/loop-pack-be-l2-vol3-java
Length of output: 4823
🏁 Script executed:
find . -type f -name "MemberRepository.java" -o -name "MemberReader.java"Repository: Loopers-dev-lab/loop-pack-be-l2-vol3-java
Length of output: 244
🏁 Script executed:
grep -r "DataIntegrityViolationException" ./apps/commerce-api/src --include="*.java" | head -20Repository: Loopers-dev-lab/loop-pack-be-l2-vol3-java
Length of output: 67
🏁 Script executed:
cat -n ./apps/commerce-api/src/test/java/com/loopers/domain/member/MemberServiceTest.javaRepository: Loopers-dev-lab/loop-pack-be-l2-vol3-java
Length of output: 4987
🏁 Script executed:
cat -n ./apps/commerce-api/src/main/java/com/loopers/domain/member/MemberRepository.javaRepository: Loopers-dev-lab/loop-pack-be-l2-vol3-java
Length of output: 225
🏁 Script executed:
cat -n ./apps/commerce-api/src/main/java/com/loopers/domain/member/MemberReader.javaRepository: Loopers-dev-lab/loop-pack-be-l2-vol3-java
Length of output: 335
🏁 Script executed:
grep -r "unique\|@Column\|@Index" ./apps/commerce-api/src/main/java/com/loopers/domain/member --include="*.java"Repository: Loopers-dev-lab/loop-pack-be-l2-vol3-java
Length of output: 67
🏁 Script executed:
find ./apps/commerce-api -type f -name "*.java" | xargs grep -l "implements MemberRepository\|implements MemberReader" | head -20Repository: Loopers-dev-lab/loop-pack-be-l2-vol3-java
Length of output: 351
🏁 Script executed:
find ./apps/commerce-api -type f -name "*MemberRepository*.java" -o -name "*MemberReader*.java"Repository: Loopers-dev-lab/loop-pack-be-l2-vol3-java
Length of output: 428
🏁 Script executed:
grep -r "class.*MemberRepository\|class.*MemberReader" ./apps/commerce-api/src --include="*.java"Repository: Loopers-dev-lab/loop-pack-be-l2-vol3-java
Length of output: 682
🏁 Script executed:
cat -n ./apps/commerce-api/src/main/java/com/loopers/infrastructure/member/MemberRepositoryImpl.javaRepository: Loopers-dev-lab/loop-pack-be-l2-vol3-java
Length of output: 699
🏁 Script executed:
cat -n ./apps/commerce-api/src/main/java/com/loopers/infrastructure/member/MemberReaderImpl.javaRepository: Loopers-dev-lab/loop-pack-be-l2-vol3-java
Length of output: 929
🏁 Script executed:
grep -n "Column\|Index\|unique\|constraint" ./apps/commerce-api/src/main/java/com/loopers/domain/member/Member.javaRepository: Loopers-dev-lab/loop-pack-be-l2-vol3-java
Length of output: 67
🏁 Script executed:
find ./apps/commerce-api -type f -name "MemberJpaRepository.java"Repository: Loopers-dev-lab/loop-pack-be-l2-vol3-java
Length of output: 177
🏁 Script executed:
cat -n ./apps/commerce-api/src/main/java/com/loopers/infrastructure/member/MemberJpaRepository.javaRepository: Loopers-dev-lab/loop-pack-be-l2-vol3-java
Length of output: 511
🏁 Script executed:
find ./apps/commerce-api -type f \( -name "*.sql" -o -name "*Migration*.java" -o -name "schema*" \) | head -20Repository: Loopers-dev-lab/loop-pack-be-l2-vol3-java
Length of output: 67
🏁 Script executed:
find ./apps -type f -name "*.xml" -o -name "*.sql" | xargs grep -l "member" 2>/dev/null | head -10Repository: Loopers-dev-lab/loop-pack-be-l2-vol3-java
Length of output: 67
🏁 Script executed:
grep -r "DataIntegrityViolationException\|ConstraintViolationException" ./apps/commerce-api/src/main/java --include="*.java" -A 3 | head -30Repository: Loopers-dev-lab/loop-pack-be-l2-vol3-java
Length of output: 67
🏁 Script executed:
grep -r "@Transactional\|@Column" ./apps/commerce-api/src/main/java/com/loopers/domain/member --include="*.java"Repository: Loopers-dev-lab/loop-pack-be-l2-vol3-java
Length of output: 67
🏁 Script executed:
find ./apps/commerce-api -type f -name "application*.yml" -o -name "application*.yaml" | xargs cat 2>/dev/null | grep -A 20 "jpa\|hibernate" | head -30Repository: Loopers-dev-lab/loop-pack-be-l2-vol3-java
Length of output: 356
동시 가입 요청에서 로그인ID 중복 경쟁 상태 처리 필수
현재 코드는 existsByLoginId 검사 후 저장하는 사이에 다른 요청이 동일 loginId를 저장할 수 있어, 데이터베이스 중복 제약 위반 시 DataIntegrityViolationException이 발생하면 500 에러로 노출된다. 운영 안정성을 위해 다음을 필수 처리해야 한다:
- Member 엔티티의 loginId 필드에
@Column(unique=true)추가로 데이터베이스 수준 중복 방지 - MemberService.register 메서드에서 DataIntegrityViolationException을 포착하여 CoreException(ErrorType.BAD_REQUEST)로 변환해 일관된 400 응답 반환
- 동시 등록 시나리오 테스트 추가 (동일 loginId로 다중 요청 시 하나만 성공, 나머지는 400 반환 확인)
🤖 Prompt for AI Agents
In `@apps/commerce-api/src/main/java/com/loopers/domain/member/MemberService.java`
around lines 18 - 25, Add a database-unique constraint on the Member entity's
loginId by annotating the loginId field (Member.loginId) with `@Column`(unique =
true); update MemberService.register to wrap the memberRepository.save(member)
call in a try/catch that catches DataIntegrityViolationException and throws new
CoreException(ErrorType.BAD_REQUEST, "이미 존재하는 로그인ID입니다."); and add an
integration/concurrency test that fires concurrent register requests using the
same loginId and asserts that exactly one request succeeds while the others
receive CoreException/ErrorType.BAD_REQUEST responses.
apps/commerce-api/src/main/java/com/loopers/infrastructure/member/MemberJpaRepository.java
Show resolved
Hide resolved
apps/commerce-api/src/main/java/com/loopers/interfaces/api/member/MemberV1Controller.java
Show resolved
Hide resolved
| private boolean requiresAuthentication(HttpServletRequest request) { | ||
| String path = request.getRequestURI(); | ||
| String method = request.getMethod(); | ||
|
|
||
| // POST /api/v1/members (회원가입)는 인증 불필요 | ||
| if ("POST".equals(method) && "/api/v1/members".equals(path)) { | ||
| return false; | ||
| } | ||
|
|
||
| // /api/v1/members/** 경로는 인증 필요 | ||
| return path.startsWith("/api/v1/members/"); | ||
| } |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
find . -name "MemberAuthFilter.java" -type fRepository: Loopers-dev-lab/loop-pack-be-l2-vol3-java
Length of output: 165
🏁 Script executed:
cat -n apps/commerce-api/src/main/java/com/loopers/support/auth/MemberAuthFilter.javaRepository: Loopers-dev-lab/loop-pack-be-l2-vol3-java
Length of output: 3203
🌐 Web query:
HttpServletRequest getRequestURI vs getServletPath difference context path
💡 Result:
In the Servlet API, these three values are different slices of the incoming request path:
-
request.getRequestURI(): the full request path within the server, from the start of the path up to (but not including) the query string. (So it includes the context path + servlet mapping + any extra path info.) [1] -
request.getContextPath(): the webapp’s context root (the portion of the URI that identifies which app is being addressed). It starts with/, does not end with/, and is""for the root (default) context. [2] -
request.getServletPath(): the portion of the URL that matched the servlet mapping (the “servlet’s own path”), excluding any extra path info and query string. If the servlet was matched by the"/*"mapping, this can be"". [1]
A common way to relate them is:
getRequestURI()=getContextPath()+getServletPath()+getPathInfo()(wheregetPathInfo()may benull)
Example
Request URL: http://host:8080/shop/api/orders/123?x=1
getContextPath()→/shopgetServletPath()→/api(depending on your servlet mapping)getPathInfo()→/orders/123(if the mapping is/api/*)getRequestURI()→/shop/api/orders/123[1][2]
Sources: Jakarta Servlet HttpServletRequest Javadoc for getRequestURI(), getServletPath(), getContextPath() [1][2].
[1] (jakarta.ee)
[2] (jakarta.ee)
Citations:
- 1: https://jakarta.ee/specifications/servlet/4.0/apidocs/javax/servlet/http/httpservletrequest?utm_source=openai
- 2: https://jakarta.ee/specifications/servlet/5.0/apidocs/jakarta/servlet/http/httpservletrequest?utm_source=openai
컨텍스트 경로 환경에서 회원가입 엔드포인트 인증 요구 문제
getRequestURI() 사용 시 컨텍스트 경로가 포함되므로, 컨텍스트 경로가 있는 배포 환경에서 POST /api/v1/members(회원가입) 요청이 경로 비교 실패로 인해 인증을 요구하게 되어 의도한 공개 엔드포인트가 차단된다.
수정안: request.getServletPath() 기준으로 처리하고, "/api/v1/members" 정확 일치 조건에서 POST만 예외 처리한다.
추가 테스트: 컨텍스트 경로가 있는 환경에서 POST /api/v1/members가 401로 차단되지 않는지, GET /api/v1/members는 401로 차단되는지 검증한다.
🔧 수정 예시
private boolean requiresAuthentication(HttpServletRequest request) {
- String path = request.getRequestURI();
+ String path = request.getServletPath();
String method = request.getMethod();
- // POST /api/v1/members (회원가입)는 인증 불필요
- if ("POST".equals(method) && "/api/v1/members".equals(path)) {
- return false;
- }
-
- // /api/v1/members/** 경로는 인증 필요
- return path.startsWith("/api/v1/members/");
+ if ("/api/v1/members".equals(path)) {
+ return !"POST".equals(method);
+ }
+ return path.startsWith("/api/v1/members/");
}📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| private boolean requiresAuthentication(HttpServletRequest request) { | |
| String path = request.getRequestURI(); | |
| String method = request.getMethod(); | |
| // POST /api/v1/members (회원가입)는 인증 불필요 | |
| if ("POST".equals(method) && "/api/v1/members".equals(path)) { | |
| return false; | |
| } | |
| // /api/v1/members/** 경로는 인증 필요 | |
| return path.startsWith("/api/v1/members/"); | |
| } | |
| private boolean requiresAuthentication(HttpServletRequest request) { | |
| String path = request.getServletPath(); | |
| String method = request.getMethod(); | |
| if ("/api/v1/members".equals(path)) { | |
| return !"POST".equals(method); | |
| } | |
| return path.startsWith("/api/v1/members/"); | |
| } |
🤖 Prompt for AI Agents
In
`@apps/commerce-api/src/main/java/com/loopers/support/auth/MemberAuthFilter.java`
around lines 64 - 75, The requiresAuthentication method currently uses
request.getRequestURI(), which fails when a context path is present; change it
to use request.getServletPath() for path comparisons, keep the POST exact-match
exception for "/api/v1/members" (only skip auth when method=="POST" &&
servletPath.equals("/api/v1/members")), and retain the authentication
requirement for any servletPath startingWith "/api/v1/members/"; update tests to
assert POST /api/v1/members is allowed and GET /api/v1/members is authenticated
in a context-path-enabled environment.
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Fix all issues with AI agents
In `@apps/commerce-api/build.gradle.kts`:
- Around line 12-14: Spring Security 6.4.4 (managed by the Spring Boot BOM) is
vulnerable to CVE-2025-22234; override the managed version by adding a
dependencyManagement entry that forces
org.springframework.security:spring-security-core to 6.4.5 or later (use
dependencyManagement and specify the
org.springframework.security:spring-security-core:6.4.5 coordinate), then update
CI to run a dependency-vulnerability scan task and add smoke tests for signup,
login, and password-change authorization flows to validate the fix.
In `@apps/commerce-api/src/main/java/com/loopers/domain/member/Member.java`:
- Around line 32-43: Validate null inputs at the start of Member.create and
Member.changePassword: check that encoder is not null in create, and that
encoder, currentPassword, and newRawPassword are not null in changePassword; if
any are null, throw a CoreException with BAD_REQUEST to ensure unified error
handling via ApiControllerAdvice. Update Member.create (method name: create) and
Member.changePassword (method name: changePassword) to perform these null-guards
before any processing (e.g., before calling encoder.encode or password checks).
Add unit tests asserting that calling Member.create with a null encoder and
Member.changePassword with null encoder/currentPassword/newRawPassword each
result in a CoreException with BAD_REQUEST. Ensure messages in exceptions
provide minimal context for debugging while keeping the error type consistent.
In
`@apps/commerce-api/src/main/java/com/loopers/support/auth/MemberAuthFilter.java`:
- Around line 36-57: MemberAuthFilter's authentication failures currently send
only a 401 status without the standard ApiResponse JSON; update the filter
(doFilterInternal in MemberAuthFilter) to serialize the standard ApiResponse
with ErrorType.UNAUTHORIZED into the response body instead of returning empty
status: ensure ErrorType includes an UNAUTHORIZED(401) entry, set
response.setStatus(HttpServletResponse.SC_UNAUTHORIZED), set
response.setContentType("application/json;charset=UTF-8"), write the
JSON-serialized ApiResponse (containing error code/message) to
response.getWriter() and return without proceeding the filter chain on
header-missing, user-not-found (memberReader.findByLoginId), and
password-mismatch (passwordEncoder.matches) branches; add tests verifying
header-missing, non-existent user, and wrong-password scenarios return 401 plus
the standard ApiResponse JSON.
In
`@apps/commerce-api/src/main/java/com/loopers/support/config/SecurityConfig.java`:
- Around line 19-25: Security is too lax: in securityFilterChain(HttpSecurity)
you must stop accepting plaintext passwords via headers and tighten
CSRF/authorization; replace the current permissive config
(authorizeHttpRequests(...).anyRequest().permitAll()) and the memberAuthFilter
approach with a token-based authentication flow (e.g., JWT/Bearer via a
JwtAuthenticationFilter) or at minimum HTTP Basic, enable CSRF unless you
explicitly choose stateless JWT (document the reason if you call
csrf().disable()), and register an
AuthenticationEntryPoint/AuthenticationFailureHandler to log authentication
failures (log non-sensitive context such as loginId and failure reason but never
the password). Locate SecurityFilterChain securityFilterChain, memberAuthFilter,
addFilterBefore(..., UsernamePasswordAuthenticationFilter.class) and update them
accordingly to implement token parsing/validation, proper authorization rules,
CSRF handling, and secure failure logging.
🧹 Nitpick comments (1)
apps/commerce-api/src/main/java/com/loopers/infrastructure/member/PasswordEncoderImpl.java (1)
7-19: BCrypt 강도 하드코딩은 성능 튜닝을 제한한다.BCryptPasswordEncoder의 기본 strength는 10이며, 각 +1마다 해시/검증 시간이 약 2배 증가한다. 기본값 고정 시 트래픽 증가에 따른 로그인 지연이 발생하면, 하드웨어 성능에 맞춰 강도를 조정할 수 없어 운영 유연성이 떨어진다. Spring Security 권장사항에 따르면 본 운영 환경에서 검증이 약 1초 이내로 완료되는 최대 강도를 선택하고, 이후 하드웨어 개선 시 점진적으로 증가시켜야 한다.
strength를 설정값으로 주입해 환경별 조정을 가능하게 하고, PasswordEncoderImpl은 주입받은 BCryptPasswordEncoder 인스턴스를 사용하도록 변경한다.
수정 예시
import com.loopers.domain.member.PasswordEncoder; +import org.springframework.beans.factory.annotation.Value; import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder; import org.springframework.stereotype.Component; `@Component` public class PasswordEncoderImpl implements PasswordEncoder { - private final BCryptPasswordEncoder bCryptPasswordEncoder = new BCryptPasswordEncoder(); + private final BCryptPasswordEncoder bCryptPasswordEncoder; + + public PasswordEncoderImpl(`@Value`("${security.bcrypt.strength:10}") int strength) { + this.bCryptPasswordEncoder = new BCryptPasswordEncoder(strength); + }application.yml(또는 환경별 프로파일)에 설정값을 추가하고, application-test.yml에는 더 낮은 strength(예: 4)를 지정한 뒤 인코딩/매칭이 정상 동작하는지 스프링 컨텍스트 통합 테스트를 작성한다. 또한 본 운영 환경에서 목표 검증 시간에 맞는 strength 값을 벤치마킹으로 결정해야 한다.
|
|
||
| // security | ||
| implementation("org.springframework.boot:spring-boot-starter-security") |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
cat -n apps/commerce-api/build.gradle.ktsRepository: Loopers-dev-lab/loop-pack-be-l2-vol3-java
Length of output: 1271
🏁 Script executed:
# Find root build.gradle.kts or gradle configuration
fd -t f "build.gradle.kts" | head -5Repository: Loopers-dev-lab/loop-pack-be-l2-vol3-java
Length of output: 242
🏁 Script executed:
cat -n build.gradle.ktsRepository: Loopers-dev-lab/loop-pack-be-l2-vol3-java
Length of output: 4538
🏁 Script executed:
cat -n gradle.propertiesRepository: Loopers-dev-lab/loop-pack-be-l2-vol3-java
Length of output: 747
🌐 Web query:
Spring Boot 3.4.4 spring-boot-starter-security version CVE
💡 Result:
Spring Boot 3.4.4’s spring-boot-starter-security pulls in Spring Security 6.4.4 (via the Spring Boot BOM). [1]
CVE context for Spring Security 6.4.4
- 6.4.4 fixes: CVE-2025-22223 and CVE-2025-22228. [2]
- But 6.4.4 is also affected by: CVE-2025-22234 (Spring advises upgrading; fixed in 6.4.5). [3]
So, if you’re on Boot 3.4.4, you’re on Spring Security 6.4.4 (includes fixes for CVE-2025-22223/22228, but is impacted by CVE-2025-22234). [1][2][3]
What to do
- Upgrade Spring Boot to a release that manages Spring Security ≥ 6.4.5, or override the managed version to 6.4.5+. [3]
References:
[1] (github.com)
[2] (spring.io)
[3] (spring.io)
Citations:
- 1: https://github.com/spring-projects/spring-boot/releases/tag/v3.4.4
- 2: https://spring.io/blog/2025/03/19/spring-security-6-3-8-6-4-4-are-now-available?utm_source=openai
- 3: https://spring.io/security/cve-2025-22234?utm_source=openai
🏁 Script executed:
# Search for dependency scanning or security tasks in gradle files
rg -i "(dependenc.*scan|security.*scan|owasp|snyk|checkmarx)" --type gradleRepository: Loopers-dev-lab/loop-pack-be-l2-vol3-java
Length of output: 233
🏁 Script executed:
# Search for CI configuration and security scanning
find . -type f \( -name "*.yml" -o -name "*.yaml" -o -name ".gradle" \) | grep -E "(github|gitlab|workflow|ci)" | head -10Repository: Loopers-dev-lab/loop-pack-be-l2-vol3-java
Length of output: 110
🏁 Script executed:
# Search for GitHub workflows
find .github/workflows -type f 2>/dev/null | head -10Repository: Loopers-dev-lab/loop-pack-be-l2-vol3-java
Length of output: 67
🏁 Script executed:
# Check if there are any security scanning plugins in any gradle file
rg "dependency.*check|owasp|snyk" --type-listRepository: Loopers-dev-lab/loop-pack-be-l2-vol3-java
Length of output: 474
🏁 Script executed:
# Check build gradle files for any security-related configuration
find . -name "build.gradle.kts" -type f | xargs grep -l "security\|cve\|vulnerability" 2>/dev/nullRepository: Loopers-dev-lab/loop-pack-be-l2-vol3-java
Length of output: 121
Spring Security 6.4.4의 CVE-2025-22234 취약점 해결이 필수다.
Spring Boot 3.4.4 BOM에 의해 Spring Security 6.4.4가 관리되고 있으나, 해당 버전은 CVE-2025-22234에 영향을 받는다. 이 취약점은 인증/인가 처리 과정에서 발생하는 보안 결함이며, 상용 환경에서 미해결 시 인증 우회 등의 위험에 노출된다.
수정안으로 dependencyManagement 블록에서 Spring Security를 6.4.5 이상으로 명시적으로 오버라이드한다.
dependencyManagement {
dependencies {
dependency("org.springframework.security:spring-security-core:6.4.5")
}
}이후 의존성 취약점 스캔 태스크를 CI에 포함하고, 회원가입/로그인/비밀번호 변경 API의 인증/인가 관련 스모크 테스트를 추가한다.
🤖 Prompt for AI Agents
In `@apps/commerce-api/build.gradle.kts` around lines 12 - 14, Spring Security
6.4.4 (managed by the Spring Boot BOM) is vulnerable to CVE-2025-22234; override
the managed version by adding a dependencyManagement entry that forces
org.springframework.security:spring-security-core to 6.4.5 or later (use
dependencyManagement and specify the
org.springframework.security:spring-security-core:6.4.5 coordinate), then update
CI to run a dependency-vulnerability scan task and add smoke tests for signup,
login, and password-change authorization flows to validate the fix.
| public static Member create(String loginId, String rawPassword, | ||
| String name, LocalDate birthDate, | ||
| String email, PasswordEncoder encoder) { | ||
| validateLoginId(loginId); | ||
| validatePassword(rawPassword, birthDate); | ||
| String normalizedName = normalizeName(name); | ||
| validateName(normalizedName); | ||
| validateEmail(email); | ||
|
|
||
| String encodedPassword = encoder.encode(rawPassword); | ||
| return new Member(loginId, encodedPassword, normalizedName, birthDate, email); | ||
| } |
There was a problem hiding this comment.
비밀번호 변경/생성 입력값 null 가드가 필요하다.
encoder 또는 currentPassword/newRawPassword가 null이면 NPE로 500이 발생해 운영에서 표준 오류 포맷이 깨지고 원인 분석이 어려워진다.
수정안으로 create와 changePassword 시작부에서 null을 검사해 CoreException(BAD_REQUEST)로 통일한다.
수정 예시
public static Member create(String loginId, String rawPassword,
String name, LocalDate birthDate,
String email, PasswordEncoder encoder) {
+ if (encoder == null) {
+ throw new CoreException(ErrorType.BAD_REQUEST, "비밀번호 인코더가 필요합니다.");
+ }
validateLoginId(loginId);
validatePassword(rawPassword, birthDate);
String normalizedName = normalizeName(name);
validateName(normalizedName);
validateEmail(email);
String encodedPassword = encoder.encode(rawPassword);
return new Member(loginId, encodedPassword, normalizedName, birthDate, email);
}
public void changePassword(String currentPassword, String newRawPassword,
PasswordEncoder encoder) {
+ if (currentPassword == null || newRawPassword == null || encoder == null) {
+ throw new CoreException(ErrorType.BAD_REQUEST, "비밀번호 입력값이 누락되었습니다.");
+ }
// 현재 비밀번호 확인
if (!encoder.matches(currentPassword, this.password)) {
throw new CoreException(ErrorType.BAD_REQUEST, "현재 비밀번호가 일치하지 않습니다.");
}추가 테스트로 currentPassword/newRawPassword/encoder가 null일 때 BAD_REQUEST가 발생하는지 단위 테스트를 추가한다.
Based on learnings 'In the loop-pack-be-l2-vol3-java project, enforce unified error handling by routing errors through CoreException to ApiControllerAdvice to ensure a consistent response format. Do not introduce MethodArgumentNotValidException handlers or Bean Validation handling, as that would create inconsistent error handling patterns. This guidance applies to all Java files under the commerce-api module (source code under apps/commerce-api/src/main/java/).'를 근거로 했다.
As per coding guidelines 'null 처리, 방어적 복사, 불변성, equals/hashCode/toString 구현 안정성을 점검한다'를 근거로 했다.
Also applies to: 83-97
🤖 Prompt for AI Agents
In `@apps/commerce-api/src/main/java/com/loopers/domain/member/Member.java` around
lines 32 - 43, Validate null inputs at the start of Member.create and
Member.changePassword: check that encoder is not null in create, and that
encoder, currentPassword, and newRawPassword are not null in changePassword; if
any are null, throw a CoreException with BAD_REQUEST to ensure unified error
handling via ApiControllerAdvice. Update Member.create (method name: create) and
Member.changePassword (method name: changePassword) to perform these null-guards
before any processing (e.g., before calling encoder.encode or password checks).
Add unit tests asserting that calling Member.create with a null encoder and
Member.changePassword with null encoder/currentPassword/newRawPassword each
result in a CoreException with BAD_REQUEST. Ensure messages in exceptions
provide minimal context for debugging while keeping the error type consistent.
apps/commerce-api/src/main/java/com/loopers/support/auth/MemberAuthFilter.java
Show resolved
Hide resolved
| @Bean | ||
| public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception { | ||
| return http | ||
| .csrf(csrf -> csrf.disable()) | ||
| .authorizeHttpRequests(auth -> auth.anyRequest().permitAll()) | ||
| .addFilterBefore(memberAuthFilter, UsernamePasswordAuthenticationFilter.class) | ||
| .build(); |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
fd "SecurityConfig.java" --type fRepository: Loopers-dev-lab/loop-pack-be-l2-vol3-java
Length of output: 163
🏁 Script executed:
wc -l apps/commerce-api/src/main/java/com/loopers/support/config/SecurityConfig.javaRepository: Loopers-dev-lab/loop-pack-be-l2-vol3-java
Length of output: 166
🏁 Script executed:
cat -n apps/commerce-api/src/main/java/com/loopers/support/config/SecurityConfig.javaRepository: Loopers-dev-lab/loop-pack-be-l2-vol3-java
Length of output: 1339
🏁 Script executed:
fd "MemberAuthFilter.java" --type fRepository: Loopers-dev-lab/loop-pack-be-l2-vol3-java
Length of output: 163
🏁 Script executed:
wc -l apps/commerce-api/src/main/java/com/loopers/support/auth/MemberAuthFilter.javaRepository: Loopers-dev-lab/loop-pack-be-l2-vol3-java
Length of output: 166
🏁 Script executed:
cat -n apps/commerce-api/src/main/java/com/loopers/support/auth/MemberAuthFilter.javaRepository: Loopers-dev-lab/loop-pack-be-l2-vol3-java
Length of output: 3203
비밀번호를 HTTP 헤더로 직접 전달하는 것은 보안상 매우 위험하다.
X-Loopers-LoginPw 헤더로 비밀번호를 평문 형태로 전달하면 HTTP 헤더 로그, 프록시 로그, 네트워크 추적 등에서 민감정보가 노출될 수 있다. 또한 CSRF 보호를 비활성화한 상태에서 인가 검증(anyRequest().permitAll())이 없으므로 보안 방어층이 미흡하다.
개선안:
- Bearer 토큰 기반 인증(JWT) 또는 HTTP Basic 인증(Base64 인코딩)으로 변경
- CSRF 보호를 활성화하거나 stateless 설정(JWT) 선택 시 disable 이유 문서화
- 인증 실패 로그를 추가해 보안 모니터링 가능하도록 구성 (시도한 loginId, 실패 사유 등)
- 로그에는 민감정보(비밀번호) 기록 금지
🤖 Prompt for AI Agents
In
`@apps/commerce-api/src/main/java/com/loopers/support/config/SecurityConfig.java`
around lines 19 - 25, Security is too lax: in securityFilterChain(HttpSecurity)
you must stop accepting plaintext passwords via headers and tighten
CSRF/authorization; replace the current permissive config
(authorizeHttpRequests(...).anyRequest().permitAll()) and the memberAuthFilter
approach with a token-based authentication flow (e.g., JWT/Bearer via a
JwtAuthenticationFilter) or at minimum HTTP Basic, enable CSRF unless you
explicitly choose stateless JWT (document the reason if you call
csrf().disable()), and register an
AuthenticationEntryPoint/AuthenticationFailureHandler to log authentication
failures (log non-sensitive context such as loginId and failure reason but never
the password). Locate SecurityFilterChain securityFilterChain, memberAuthFilter,
addFilterBefore(..., UsernamePasswordAuthenticationFilter.class) and update them
accordingly to implement token parsing/validation, proper authorization rules,
CSRF handling, and secure failure logging.
- MemberV1Controller: getAuthenticatedMember() 헬퍼 메서드 추가로 null 체크 - MemberInfo: maskName()에서 null 입력 시 빈 문자열 반환 - MemberAuthFilter: Optional.get() 대신 filter().orElse(null) 패턴 적용 - Member: create(), changePassword()에 null/blank guard clause 추가 - MemberTest: 필수값 검증 테스트 8개 추가
- ExampleV1Dto: 중첩 구조를 flat 구조로 변경 - MemberV1ApiE2ETest: 중첩 DTO 접근자 .member() 추가
- DB 인덱스 생성으로 existsByLoginId/findByLoginId 쿼리 성능 개선
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
2 participants
📌 Summary
🧭 Context & Decision
선택지와 결정
1. 왜 User가 아니라 Member인가?
문제: 엔티티 이름을
User로 할지Member로 할지UserUser와 충돌, 너무 포괄적Member결정:
Member사용이유:
org.springframework.security.core.userdetails.User와 import 충돌 없음2. TDD 접근법 선택
문제: TDD를 어떤 방향으로 진행할 것인가?
결정: Inside-Out 방식 채택
이유: 의존성이 없는 도메인부터 견고하게 만들 수 있고, Mock/Stub 사용 최소화
3. 비밀번호 변경 로직 위치
문제:
changePassword()를 Member 엔티티 vs MemberService 어디에 둘 것인가?Member.create()와 동일 패턴결정: 엔티티에 위치 (Rich Domain Model)
트레이드오프: encoder를 파라미터로 넘겨야 하지만,
Member.create()와 일관성 유지4. Facade 필요성 의문
문제: Facade가 단순 위임만 하는데 필요한가?
결정: 유지
이유:
5. PasswordEncoder 인터페이스 분리
문제: Spring Security의
PasswordEncoder를 직접 쓰면 안 되나?결정: Domain 레이어에 커스텀 인터페이스 정의
이유: 도메인을 순수 Java로 유지 → Stub으로 쉽게 테스트 가능
6. Reader/Repository 분리 (CQRS 스타일)
문제: 일반적인 JPA 방식처럼 하나의 Repository에서 조회/저장을 모두 처리할지, 분리할지
결정: 조회(Reader)와 저장(Repository)으로 분리
이유:
트레이드오프: 현재 규모에서는 오버엔지니어링처럼 보일 수 있지만, 테스트 작성 편의성과 의존성 명확화를 위해 채택
🏗️ Design Overview
apps/commerce-api- member 도메인Member,MemberService,MemberReader,MemberRepository,PasswordEncoderMemberJpaRepository,MemberReaderImpl,MemberRepositoryImpl,PasswordEncoderImplMemberFacade,MemberInfoMemberV1Controller,MemberV1DtoMemberAuthFilter,SecurityConfigMemberTest,MemberServiceTest,MemberV1ApiE2ETesthttp/commerce-api/member-v1.httpapps/commerce-api/build.gradle.kts- Spring Security 의존성 추가MemberModel→Member로 rename (더 명확한 네이밍)핵심 구조
주요 컴포넌트 책임
MemberV1ControllerMemberV1DtoMemberFacadeMemberInfoMemberMemberServiceMemberReaderMemberRepositoryPasswordEncoderMemberJpaRepositoryMemberReaderImplMemberRepositoryImplPasswordEncoderImplMemberAuthFilterSecurityConfig🔁 Flow Diagram
Main Flow
회원가입 흐름
sequenceDiagram autonumber participant Client participant Controller as MemberV1Controller participant Facade as MemberFacade participant Service as MemberService participant Reader as MemberReader participant Member participant Repository as MemberRepository Client->>Controller: POST /api/v1/members Controller->>Facade: register(loginId, password, ...) Facade->>Service: register(loginId, password, ...) Service->>Reader: existsByLoginId(loginId) Reader-->>Service: false Service->>Member: Member.create(loginId, password, ..., encoder) Note over Member: 정적 팩토리 메서드에서<br/>모든 검증 수행 Member-->>Service: member Service->>Repository: save(member) Repository-->>Service: member Service-->>Facade: member Facade->>Facade: MemberInfo.from(member) Facade-->>Controller: MemberInfo Controller-->>Client: 201 Created + MemberResponse비밀번호 변경 흐름
sequenceDiagram autonumber participant Client participant Filter as MemberAuthFilter participant Controller as MemberV1Controller participant Facade as MemberFacade participant Service as MemberService participant Member participant Repository as MemberRepository Client->>Filter: PATCH /api/v1/members/me/password<br/>+ X-Loopers-LoginId/Pw 헤더 Filter->>Filter: 인증 검증 Filter->>Controller: request.setAttribute("authenticatedMember", member) Controller->>Facade: changePassword(member, currentPw, newPw) Facade->>Service: changePassword(member, currentPw, newPw) Service->>Member: member.changePassword(currentPw, newPw, encoder) Note over Member: 1. 현재 비밀번호 일치 확인<br/>2. 새 비밀번호 ≠ 현재<br/>3. 새 비밀번호 규칙 검증 Member-->>Service: void (상태 변경됨) Service->>Repository: save(member) Repository-->>Service: member Service-->>Facade: void Facade-->>Controller: void Controller-->>Client: 200 OK내 정보 조회 흐름
sequenceDiagram autonumber participant Client participant Filter as MemberAuthFilter participant Controller as MemberV1Controller participant Facade as MemberFacade Client->>Filter: GET /api/v1/members/me<br/>+ X-Loopers-LoginId/Pw 헤더 Filter->>Filter: 인증 검증 (Reader + PasswordEncoder) Filter->>Controller: request.setAttribute("authenticatedMember", member) Controller->>Facade: getMe(authenticatedMember) Facade->>Facade: MemberInfo.fromWithMaskedName(member) Note over Facade: 이름 마스킹 처리<br/>"홍길동" → "홍길*" Facade-->>Controller: MemberInfo (마스킹된 이름) Controller-->>Client: 200 OK + MemberResponse변경 목적: Spring Security 의존을 도입해 회원가입, 내 정보 조회, 비밀번호 수정 기능을 도메인 주도(Inside-Out TDD)로 구현하여 인증·회원 관리를 마련함.
핵심 변경점: Member 도메인에 엄격한 유효성 검증(로그인ID 영숫자, 비밀번호 8–16자·생년월일 미포함, 이름 한글/영문 정규화, 이메일 형식)과 changePassword 로직 포함; 도메인 PasswordEncoder 인터페이스 + BCrypt 구현으로 보안 분리; MemberReader/MemberRepository(CQRS 스타일)와 MemberFacade, Controller, JPA 리포지토리 및 unique index 추가; 커스텀 헤더(X-Loopers-LoginId/X-Loopers-LoginPw) 기반 인증 필터와 SecurityConfig 적용.
리스크/주의사항: 커스텀 헤더 인증은 표준 인증 방식이 아니며 SecurityConfig가 현재 모든 요청을 허용하고 CSRF를 비활성화해 운영 환경용 보안 설정 보완이 필요; 비밀번호에 대한 생년월일 검사(문자열 매칭)와 이름 마스킹/정규화 로직의 국제화/형식 변경 영향 검토 권장; 로그인Id 고유 제약(DB 인덱스) 충돌 처리 경로 확인 필요 — 이들에 대해 운영 정책(토큰 기반 인증 도입 계획 등)이 있나요?
테스트/검증: 도메인 단위(MemberTest), 서비스 단위(MemberServiceTest) 유닛 테스트로 검증 규칙과 변경 비밀번호 로직 확인 및 E2E(MemberV1ApiE2ETest)로 회원가입·인증·비밀번호 변경의 성공/오류 시나리오와 데이터 격리 검증, 또한 http/commerce-api/member-v1.http에 사용 예시 및 오류 케이스 수록.