|
8 | 8 | import jakarta.servlet.http.HttpServletResponse; |
9 | 9 | import jakarta.validation.Valid; |
10 | 10 | import lombok.RequiredArgsConstructor; |
| 11 | +import org.springframework.beans.factory.annotation.Value; |
11 | 12 | import org.springframework.http.HttpHeaders; |
12 | 13 | import org.springframework.http.ResponseCookie; |
13 | 14 | import org.springframework.http.ResponseEntity; |
|
26 | 27 | public class ApiV1MemberController { |
27 | 28 | private final MemberService memberService; |
28 | 29 |
|
| 30 | + @Value("${app.cookie.domain:}") |
| 31 | + private String cookieDomain; |
| 32 | + @Value("${app.cookie.secure:false}") |
| 33 | + private boolean cookieSecure; |
| 34 | + @Value("${app.cookie.sameSite:Lax}") |
| 35 | + private String cookieSameSite; |
| 36 | + |
29 | 37 | @Operation(summary = "회원가입 API", description = "이메일 비밀번호를 받아 회원가입") |
30 | 38 | @PostMapping("/auth/signup") |
31 | 39 | public ResponseEntity<RsData<MemberSignUpResponseDto>> memberSignUp(@Valid @RequestBody MemberSignUpRequestDto memberSignUpRequestDto) { |
@@ -114,18 +122,26 @@ public ResponseEntity<RsData<Void>> memberWithdraw(Authentication authentication |
114 | 122 | // 로그인 성공 후 토큰을 안전한 쿠키로 내려줌.. |
115 | 123 | private void writeAuthCookies(HttpServletResponse res, LoginResponseDto dto) { |
116 | 124 | // access 60분, refresh 7일 |
117 | | - ResponseCookie access = ResponseCookie.from("ACCESS_TOKEN", dto.accessToken()) |
118 | | - .httpOnly(true).secure(false) |
119 | | - .sameSite("Lax").path("/") |
120 | | - .maxAge(Duration.ofMinutes(60)) |
121 | | - .build(); |
122 | | - ResponseCookie refresh = ResponseCookie.from("REFRESH_TOKEN", dto.refreshToken()) |
123 | | - .httpOnly(true).secure(false) |
124 | | - .sameSite("Lax").path("/") |
125 | | - .maxAge(Duration.ofDays(7)) |
126 | | - .build(); |
127 | | - |
128 | | - res.addHeader(HttpHeaders.SET_COOKIE, access.toString()); |
129 | | - res.addHeader(HttpHeaders.SET_COOKIE, refresh.toString()); |
| 125 | + ResponseCookie.ResponseCookieBuilder accessBuilder = ResponseCookie.from("ACCESS_TOKEN", dto.accessToken()) |
| 126 | + .httpOnly(true) |
| 127 | + .secure(cookieSecure) |
| 128 | + .sameSite("Lax") |
| 129 | + .path("/") |
| 130 | + .maxAge(Duration.ofMinutes(60)); |
| 131 | + |
| 132 | + ResponseCookie.ResponseCookieBuilder refreshBuilder = ResponseCookie.from("REFRESH_TOKEN", dto.refreshToken()) |
| 133 | + .httpOnly(true) |
| 134 | + .secure(cookieSecure) |
| 135 | + .sameSite(cookieSameSite) |
| 136 | + .path("/") |
| 137 | + .maxAge(Duration.ofDays(7)); |
| 138 | + |
| 139 | + if (cookieDomain != null && !cookieDomain.isBlank()) { |
| 140 | + accessBuilder.domain(cookieDomain); |
| 141 | + refreshBuilder.domain(cookieDomain); |
| 142 | + } |
| 143 | + |
| 144 | + res.addHeader(HttpHeaders.SET_COOKIE, accessBuilder.build().toString()); |
| 145 | + res.addHeader(HttpHeaders.SET_COOKIE, refreshBuilder.build().toString()); |
130 | 146 | } |
131 | 147 | } |
0 commit comments