[BE] JWT 토큰 사용 제거, Interceptor와 ArgumentResolver 중복 로직 제거

backend/build.gradle

@@ -36,10 +36,6 @@ dependencies {
 	implementation 'org.flywaydb:flyway-core'
 	implementation 'org.flywaydb:flyway-mysql'
 
-	implementation 'io.jsonwebtoken:jjwt-api:0.11.5'
-	implementation 'io.jsonwebtoken:jjwt-impl:0.11.5'
-	implementation 'io.jsonwebtoken:jjwt-jackson:0.11.5'
-
 	implementation 'mysql:mysql-connector-java:8.0.33'
 
 	compileOnly 'org.projectlombok:lombok'

backend/src/main/java/harustudy/backend/auth/AuthArgumentResolver.java

@@ -1,25 +1,19 @@
 package harustudy.backend.auth;
 
 import harustudy.backend.auth.dto.AuthMember;
-import harustudy.backend.auth.service.AuthService;
-import harustudy.backend.auth.util.BearerAuthorizationParser;
 import lombok.RequiredArgsConstructor;
 import org.springframework.core.MethodParameter;
-import org.springframework.http.HttpHeaders;
 import org.springframework.stereotype.Component;
 import org.springframework.web.bind.support.WebDataBinderFactory;
 import org.springframework.web.context.request.NativeWebRequest;
+import org.springframework.web.context.request.RequestAttributes;
 import org.springframework.web.method.support.HandlerMethodArgumentResolver;
 import org.springframework.web.method.support.ModelAndViewContainer;
 
 @RequiredArgsConstructor
 @Component
 public class AuthArgumentResolver implements HandlerMethodArgumentResolver {
 
-    private final AuthService authService;
-
-    private final BearerAuthorizationParser bearerAuthorizationParser;
-
     @Override
     public boolean supportsParameter(MethodParameter parameter) {
         return parameter.hasParameterAnnotation(Authenticated.class);
@@ -28,9 +22,7 @@ public boolean supportsParameter(MethodParameter parameter) {
     @Override
     public AuthMember resolveArgument(MethodParameter parameter, ModelAndViewContainer mavContainer,
                                       NativeWebRequest webRequest, WebDataBinderFactory binderFactory) {
-        String authorizationHeader = webRequest.getHeader(HttpHeaders.AUTHORIZATION);
-        String accessToken = bearerAuthorizationParser.parse(authorizationHeader);
-        long memberId = Long.parseLong(authService.parseMemberId(accessToken));
+        Long memberId = (Long) webRequest.getAttribute("memberId", RequestAttributes.SCOPE_REQUEST);
         return new AuthMember(memberId);
     }
 }

backend/src/main/java/harustudy/backend/auth/AuthInterceptor.java

@@ -25,7 +25,8 @@ public boolean preHandle(HttpServletRequest request, HttpServletResponse respons
         }
         String authorizationHeader = request.getHeader(HttpHeaders.AUTHORIZATION);
         String accessToken = bearerAuthorizationParser.parse(authorizationHeader);
-        authService.validateAccessToken(accessToken);
+        Long memberId = authService.parseMemberId(accessToken);
+        request.setAttribute("memberId", memberId);
         return HandlerInterceptor.super.preHandle(request, response, handler);
     }
 }

backend/src/main/java/harustudy/backend/auth/config/TokenConfig.java

@@ -5,9 +5,9 @@
 
 @Component
 public record TokenConfig(
-        @Value("${jwt.secret-key}") String secretKey,
-        @Value("${jwt.expire-length}") long accessTokenExpireLength,
-        @Value("${jwt.guest-expire-length}") long guestAccessTokenExpireLength,
+        @Value("${access-token.secret-key}") String secretKey,
+        @Value("${access-token.expire-length}") long accessTokenExpireLength,
+        @Value("${access-token.guest-expire-length}") long guestAccessTokenExpireLength,
         @Value("${refresh-token.expire-length}") long refreshTokenExpireLength) {
 
 }

backend/src/main/java/harustudy/backend/auth/exception/InvalidAccessTokenException.java

@@ -2,7 +2,13 @@
 
 import harustudy.backend.common.exception.HaruStudyException;
 
-public class InvalidAccessTokenException extends
-        HaruStudyException {
+public class InvalidAccessTokenException extends HaruStudyException {
 
+    public InvalidAccessTokenException() {
+
+    }
+
+    public InvalidAccessTokenException(Exception e) {
+        super(e);
+    }
 }

backend/src/main/java/harustudy/backend/auth/service/AuthService.java

@@ -5,17 +5,14 @@
 import harustudy.backend.auth.dto.OauthLoginRequest;
 import harustudy.backend.auth.dto.TokenResponse;
 import harustudy.backend.auth.dto.UserInfo;
-import harustudy.backend.auth.exception.InvalidAccessTokenException;
 import harustudy.backend.auth.exception.InvalidRefreshTokenException;
 import harustudy.backend.auth.repository.RefreshTokenRepository;
-import harustudy.backend.auth.util.JwtTokenProvider;
+import harustudy.backend.auth.util.AesTokenProvider;
 import harustudy.backend.member.domain.LoginType;
 import harustudy.backend.member.domain.Member;
 import harustudy.backend.member.repository.MemberRepository;
-import io.jsonwebtoken.JwtException;
 import java.util.UUID;
 import lombok.RequiredArgsConstructor;
-import org.springframework.beans.factory.annotation.Value;
 import org.springframework.stereotype.Service;
 import org.springframework.transaction.annotation.Transactional;
 
@@ -24,7 +21,7 @@
 @Service
 public class AuthService {
 
-    private final JwtTokenProvider jwtTokenProvider;
+    private final AesTokenProvider aesTokenProvider;
     private final TokenConfig tokenConfig;
     private final MemberRepository memberRepository;
     private final RefreshTokenRepository refreshTokenRepository;
@@ -44,11 +41,8 @@ private Member saveOrUpdateMember(String oauthProvider, UserInfo userInfo) {
     }
 
     private String generateAccessToken(Long memberId) {
-        return jwtTokenProvider.builder()
-                .subject(String.valueOf(memberId))
-                .accessTokenExpireLength(tokenConfig.accessTokenExpireLength())
-                .secretKey(tokenConfig.secretKey())
-                .build();
+        return aesTokenProvider.createAccessToken(memberId, tokenConfig.accessTokenExpireLength(),
+                tokenConfig.secretKey());
     }
 
     private RefreshToken saveRefreshTokenOf(Member member) {
@@ -67,11 +61,8 @@ public TokenResponse guestLogin() {
     }
 
     private String generateGuestAccessToken(Long memberId) {
-        return jwtTokenProvider.builder()
-                .subject(String.valueOf(memberId))
-                .accessTokenExpireLength(tokenConfig.guestAccessTokenExpireLength())
-                .secretKey(tokenConfig.secretKey())
-                .build();
+        return aesTokenProvider.createAccessToken(memberId,
+                tokenConfig.guestAccessTokenExpireLength(), tokenConfig.secretKey());
     }
 
     public TokenResponse refresh(String refreshTokenRequest) {
@@ -80,19 +71,12 @@ public TokenResponse refresh(String refreshTokenRequest) {
         refreshToken.validateExpired();
         refreshToken.updateUuidAndExpireDateTime(tokenConfig.refreshTokenExpireLength());
         String accessToken = generateAccessToken(refreshToken.getMember().getId());
-        return TokenResponse.forLoggedIn(accessToken, refreshToken, tokenConfig.refreshTokenExpireLength());
-    }
-
-    public void validateAccessToken(String accessToken) {
-        try {
-            jwtTokenProvider.validateAccessToken(accessToken, tokenConfig.secretKey());
-        } catch (JwtException e) {
-            throw new InvalidAccessTokenException();
-        }
+        return TokenResponse.forLoggedIn(accessToken, refreshToken,
+                tokenConfig.refreshTokenExpireLength());
     }
 
-    public String parseMemberId(String accessToken) {
-        return jwtTokenProvider.parseSubject(accessToken, tokenConfig.secretKey());
+    public Long parseMemberId(String accessToken) {
+        return aesTokenProvider.parseSubject(accessToken, tokenConfig.secretKey());
     }
 
     public void deleteStringifiedRefreshToken(String refreshToken) {

backend/src/main/java/harustudy/backend/auth/util/AccessTokenUtils.java

@@ -0,0 +1,57 @@
+package harustudy.backend.auth.util;
+
+import com.fasterxml.jackson.core.JsonProcessingException;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import harustudy.backend.auth.exception.InvalidAccessTokenException;
+import java.nio.charset.StandardCharsets;
+import java.util.Date;
+import lombok.Getter;
+import lombok.RequiredArgsConstructor;
+
+public class AccessTokenUtils {
+
+    public static String issue(ObjectMapper objectMapper, Long subject, Long accessTokenExpireLength) {
+        Date now = new Date();
+        Date expireAt = new Date(now.getTime() + accessTokenExpireLength);
+        RawToken rawToken = new RawToken(subject, expireAt);
+        return stringify(objectMapper, rawToken);
+    }
+
+    private static String stringify(ObjectMapper objectMapper, RawToken rawToken) {
+        try {
+            return objectMapper.writeValueAsString(rawToken);
+        } catch (JsonProcessingException e) {
+            throw new InvalidAccessTokenException(e);
+        }
+    }
+
+    public static Long parseSubject(ObjectMapper objectMapper, byte[] decrypted) {
+        RawToken rawToken = toRawToken(objectMapper, decrypted);
+        validateExpiration(rawToken);
+        return rawToken.subject;
+    }
+
+    private static RawToken toRawToken(ObjectMapper objectMapper, byte[] decrypted) {
+        String string = new String(decrypted, StandardCharsets.UTF_8);
+        try {
+            return objectMapper.readValue(string, RawToken.class);
+        } catch (JsonProcessingException e) {
+            throw new InvalidAccessTokenException(e);
+        }
+    }
+
+    private static void validateExpiration(RawToken rawToken) {
+        if (rawToken.expireAt.before(new Date())) {
+            throw new InvalidAccessTokenException();
+        }
+    }
+
+    @Getter
+    @RequiredArgsConstructor
+    private static class RawToken {
+
+        private final Long subject;
+
+        private final Date expireAt;
+    }
+}

backend/src/main/java/harustudy/backend/auth/util/AesTokenProvider.java

@@ -0,0 +1,60 @@
+package harustudy.backend.auth.util;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+import harustudy.backend.auth.exception.InvalidAccessTokenException;
+import java.nio.charset.StandardCharsets;
+import java.security.GeneralSecurityException;
+import java.util.Base64;
+import javax.crypto.Cipher;
+import javax.crypto.spec.IvParameterSpec;
+import javax.crypto.spec.SecretKeySpec;
+import lombok.RequiredArgsConstructor;
+import org.springframework.stereotype.Component;
+
+@RequiredArgsConstructor
+@Component
+public class AesTokenProvider {
+
+    private static final String alg = "AES/CBC/PKCS5Padding";
+    private static final String iv = "0123456789abcdef"; // 16byte
+
+    private final ObjectMapper objectMapper;
+
+    public String createAccessToken(Long subject, Long accessTokenExpireLength, String secretKey) {
+        String token = AccessTokenUtils.issue(objectMapper, subject, accessTokenExpireLength);
+        return encrypt(token, secretKey);
+    }
+
+    private String encrypt(String text, String secretKey) {
+        try {
+            Cipher cipher = Cipher.getInstance(alg);
+            SecretKeySpec keySpec = new SecretKeySpec(secretKey.getBytes(), "AES");
+            IvParameterSpec ivParamSpec = new IvParameterSpec(iv.getBytes());
+            cipher.init(Cipher.ENCRYPT_MODE, keySpec, ivParamSpec);
+
+            byte[] encrypted = cipher.doFinal(text.getBytes(StandardCharsets.UTF_8));
+            return Base64.getEncoder().encodeToString(encrypted);
+        } catch (GeneralSecurityException e) {
+            throw new InvalidAccessTokenException(e);
+        }
+    }
+
+    public Long parseSubject(String accessToken, String secretKey) {
+        byte[] decrypted = decrypt(accessToken, secretKey);
+        return AccessTokenUtils.parseSubject(objectMapper, decrypted);
+    }
+
+    private byte[] decrypt(String accessToken, String secretKey) {
+        try {
+            Cipher cipher = Cipher.getInstance(alg);
+            SecretKeySpec keySpec = new SecretKeySpec(secretKey.getBytes(), "AES");
+            IvParameterSpec ivParamSpec = new IvParameterSpec(iv.getBytes());
+            cipher.init(Cipher.DECRYPT_MODE, keySpec, ivParamSpec);
+
+            byte[] decodedBytes = Base64.getDecoder().decode(accessToken);
+            return cipher.doFinal(decodedBytes);
+        } catch (GeneralSecurityException | IllegalArgumentException e) {
+            throw new InvalidAccessTokenException();
+        }
+    }
+}

backend/src/main/java/harustudy/backend/common/exception/HaruStudyException.java

@@ -5,6 +5,10 @@ public abstract class HaruStudyException extends RuntimeException {
     protected HaruStudyException() {
     }
 
+    protected HaruStudyException(Exception e) {
+        super(e);
+    }
+
     protected HaruStudyException(String message) {
         super(message);
     }