Spring Security 7.x HttpSecurity와 WebSecurity의 차이점

@Configuration
@EnableWebSecurity
@EnableMethodSecurity  // 메서드 보안 활성화를 위한 표준 어노테이션
public class SecurityConfig {

    /**
     * API 전용 SecurityFilterChain
     * - Stateless 세션 정책
     * - JWT 기반 인증
     * - CSRF 비활성화
     */
    @Bean
    @Order(1)  // 우선순위 높음
    public SecurityFilterChain apiSecurityFilterChain(HttpSecurity http) throws Exception {
        http
            // securityMatcher: 이 체인이 /api/**에만 적용됨을 명시
            .securityMatcher("/api/**")
            
            // requestMatchers: 체인 내부에서의 세부 규칙
            // securityMatcher에서 /api 로 시작하기 때문에
            // authorizeHttpRequests도 모두 /api로 시작해야함
            .authorizeHttpRequests(authorize -> authorize
                .requestMatchers("/api/public/**").permitAll()
                .requestMatchers("/api/admin/**").hasAuthority("ADMIN")
                .anyRequest().authenticated()
            )
            
            // Stateless 세션 - JWT 환경
            .sessionManagement(session -> session
                .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
            )
            
            // CSRF 비활성화 (API는 토큰 기반)
            .csrf(csrf -> csrf.disable())
            
            // HTTP Basic 인증
            .httpBasic(withDefaults())
            
            // OAuth2 Resource Server 설정
            .oauth2ResourceServer(oauth2 -> 
                oauth2.jwt(withDefaults())
            );

        return http.build();
    }

    /**
     * 웹 애플리케이션용 SecurityFilterChain
     * - 세션 기반 인증
     * - 폼 로그인
     * - CSRF 활성화
     */
    @Bean
    @Order(2)  // API 체인 다음 순위
    public SecurityFilterChain webSecurityFilterChain(HttpSecurity http) throws Exception {
        http
            // securityMatcher: 모든 요청 (API 제외)
            .securityMatcher("/**")
            
            .authorizeHttpRequests(authorize -> authorize
                // 정적 리소스 - ignoring() 대신 permitAll() 사용
                .requestMatchers(
                    "/resources/**", 
                    "/static/**", 
                    "/css/**", 
                    "/js/**", 
                    "/images/**",
                    "/webjars/**",
                    "/favicon.ico"
                ).permitAll()
                
                // 공개 페이지
                .requestMatchers("/", "/home", "/register", "/about").permitAll()
                
                // Actuator 엔드포인트
                .requestMatchers("/actuator/health", "/actuator/info").permitAll()
                
                // Swagger 문서
                .requestMatchers("/swagger-ui/**", "/v3/api-docs/**").permitAll()
                
                // 관리자 전용
                .requestMatchers("/admin/**").hasAuthority("ADMIN")
                
                // 일반 사용자
                .requestMatchers("/user/**").hasAuthority("USER")
                
                // 나머지는 인증 필요
                .anyRequest().authenticated()
            )
            
            // 폼 로그인 설정
            .formLogin(form -> form
                .loginPage("/login")
                .loginProcessingUrl("/login")
                .defaultSuccessUrl("/dashboard")
                .failureUrl("/login?error")
                .permitAll()
            )
            
            // 로그아웃 설정
            .logout(logout -> logout
                .logoutUrl("/logout")
                .logoutSuccessUrl("/login?logout")
                .deleteCookies("JSESSIONID")
                .invalidateHttpSession(true)
                .clearAuthentication(true)
                .permitAll()
            )
            
            // CSRF 설정 (기본 활성화)
            .csrf(csrf -> csrf
                .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())
            )
            
            // 세션 관리
            .sessionManagement(session -> session
                .sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED)
                .maximumSessions(1)
                .maxSessionsPreventsLogin(false)
                .expiredUrl("/login?expired")
            )
            
            // 보안 헤더
            .headers(headers -> headers
                .frameOptions(frame -> frame.sameOrigin())
                .contentSecurityPolicy(csp -> 
                    csp.policyDirectives("script-src 'self'; style-src 'self'")
                )
                .httpStrictTransportSecurity(hsts -> hsts
                    .includeSubDomains(true)
                    .maxAgeInSeconds(31536000)
                )
            )
            
            // Remember Me
            .rememberMe(remember -> remember
                .key("uniqueAndSecretKey")
                .tokenValiditySeconds(86400)  // 24시간
            );

        return http.build();
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Bean 
    public UserDetailsService userDetailsService() {
        UserDetails user = User.builder()
            .username("user")
            .password(passwordEncoder().encode("password"))
            .authorities("USER")
            .build();
            
        UserDetails admin = User.builder()
            .username("admin")
            .password(passwordEncoder().encode("admin"))
            .authorities("ADMIN", "USER")
            .build();
            
        return new InMemoryUserDetailsManager(user, admin);
    }
}

@Bean
public WebSecurityCustomizer webSecurityCustomizer() {
    return (web) -> web
        .ignoring()
        .requestMatchers("/css/**", "/js/**");
}

@Bean
@Order(0)  // 최우선 처리
public SecurityFilterChain staticResourceChain(HttpSecurity http) throws Exception {
    http
        .securityMatcher("/css/**", "/js/**", "/images/**", "/resources/**")
        .authorizeHttpRequests(auth -> 
            auth.anyRequest().permitAll()
        )
        // 성능 최적화를 위한 불필요한 필터 제거
        .securityContext(context -> context.disable())
        .requestCache(cache -> cache.disable())
        .sessionManagement(session -> session.disable());
    
    return http.build();
}

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    /**
     * 극히 예외적인 경우에만 사용
     * - Servlet Container 레벨에서 처리되는 경로
     * - Spring Security가 기술적으로 처리 불가능한 요청
     */
    @Bean
    public WebSecurityCustomizer webSecurityCustomizer() {
        return (web) -> web
            .ignoring()
            .requestMatchers("/actuator/health", "/actuator/info");
    }
}

// 잘못된 설정
web.ignoring().requestMatchers("/css/**");

// 잘못된 설정
web.ignoring().requestMatchers("/images/**");

// 잘못된 설정
web.ignoring().requestMatchers("/api/public/**");

@Bean
public WebSecurityCustomizer webSecurityCustomizer() {
    return (web) -> web
        .ignoring()
        .requestMatchers(
            // Actuator의 일부 health check 엔드포인트
            // (로드밸런서가 매 초마다 호출하는 경우)
            "/actuator/health/liveness",
            "/actuator/health/readiness"
        );
}

http
    // ① securityMatcher: FilterChain 레벨 (어느 체인으로 들어갈까?)
    .securityMatcher("/api/**")
    
    .authorizeHttpRequests(authorize -> authorize
        // ② requestMatchers: Authorization 레벨 (체인 내부 규칙)
        .requestMatchers("/api/public/**").permitAll()
        .requestMatchers("/api/admin/**").hasAuthority("ADMIN")
        .anyRequest().authenticated()
    );

// ❌ 잘못된 사용
http
    .securityMatcher("/api/**")
    .authorizeHttpRequests(auth -> 
        // securityMatcher가 /api/**인데 /admin/** 규칙?
        auth.requestMatchers("/admin/**").hasRole("ADMIN")
    );

// ✅ 올바른 사용
http
    .securityMatcher("/api/**")
    .authorizeHttpRequests(auth -> 
        auth.requestMatchers("/api/admin/**").hasRole("ADMIN")  // 일관성
    );

@Configuration
@EnableWebSecurity
@EnableMethodSecurity
public class MultiChainSecurityConfig {

    /**
     * 1. 정적 리소스 체인 (최우선)
     * - 성능 최적화
     * - 보안 헤더는 유지
     */
    @Bean
    @Order(1)
    public SecurityFilterChain staticResourceChain(HttpSecurity http) throws Exception {
        http
            .securityMatcher("/css/**", "/js/**", "/images/**", "/webjars/**")
            .authorizeHttpRequests(auth -> auth.anyRequest().permitAll())
            .securityContext(ctx -> ctx.disable())
            .requestCache(cache -> cache.disable())
            .sessionManagement(session -> session.disable());
        
        return http.build();
    }

    /**
     * 2. 공개 API 체인
     * - 인증 불필요
     * - Rate Limiting 적용
     */
    @Bean
    @Order(2)
    public SecurityFilterChain publicApiChain(HttpSecurity http) throws Exception {
        http
            .securityMatcher("/api/public/**")
            .authorizeHttpRequests(auth -> auth.anyRequest().permitAll())
            .sessionManagement(session -> 
                session.sessionCreationPolicy(SessionCreationPolicy.STATELESS)
            )
            .csrf(csrf -> csrf.disable());
        
        return http.build();
    }

    /**
     * 3. 인증 필요 API 체인
     * - JWT 기반 인증
     * - Stateless
     */
    @Bean
    @Order(3)
    public SecurityFilterChain authenticatedApiChain(HttpSecurity http) throws Exception {
        http
            .securityMatcher("/api/**")
            .authorizeHttpRequests(authorize -> authorize
                .requestMatchers("/api/admin/**").hasAuthority("ADMIN")
                .requestMatchers("/api/user/**").hasAuthority("USER")
                .anyRequest().authenticated()
            )
            .sessionManagement(session -> 
                session.sessionCreationPolicy(SessionCreationPolicy.STATELESS)
            )
            .csrf(csrf -> csrf.disable())
            .oauth2ResourceServer(oauth2 -> oauth2.jwt(withDefaults()));

        return http.build();
    }

    /**
     * 4. 관리자 페이지 체인
     * - 폼 로그인
     * - 세션 기반
     * - 추가 보안 검증
     */
    @Bean
    @Order(4)
    public SecurityFilterChain adminWebChain(HttpSecurity http) throws Exception {
        http
            .securityMatcher("/admin/**")
            .authorizeHttpRequests(auth -> 
                auth.anyRequest().hasAuthority("ADMIN")
            )
.formLogin(form -> form
                .loginPage("/admin/login")
                .defaultSuccessUrl("/admin/dashboard")
            )
            .sessionManagement(session -> session
                .sessionFixation().changeSessionId()
                .maximumSessions(1)
            )
            .csrf(csrf -> csrf
                .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())
            );

        return http.build();
    }

    /**
     * 5. 일반 웹 페이지 체인 (기본)
     * - 가장 마지막 우선순위
     * - 모든 요청 처리
     */
    @Bean
    @Order(5)
    public SecurityFilterChain defaultWebChain(HttpSecurity http) throws Exception {
        http
            .securityMatcher("/**")
            .authorizeHttpRequests(authorize -> authorize
                .requestMatchers("/", "/home", "/about", "/register").permitAll()
                .anyRequest().authenticated()
            )
            .formLogin(form -> form
                .loginPage("/login")
                .permitAll()
            )
            .logout(logout -> logout.permitAll());

        return http.build();
    }
}

// ❌ 하나의 거대한 체인에 모든 로직
http.authorizeHttpRequests(auth -> auth
    .requestMatchers("/css/**").permitAll()
    .requestMatchers("/api/public/**").permitAll()
    .requestMatchers("/api/**").authenticated()
    .requestMatchers("/admin/**").hasRole("ADMIN")
    // ... 수십 개의 규칙
);

// ✅ 용도별로 분리된 체인
// - 정적 리소스 체인
// - 공개 API 체인
// - 인증 API 체인
// - 관리자 체인
// - 일반 웹 체인

// ❌ 6.x 스타일 (암묵적)
http.authorizeHttpRequests(auth -> 
    auth.anyRequest().authenticated()
);
// CSRF는? 세션은? 헤더는? → "기본값에 맡김"

// ✅ 7.x 스타일 (명시적)
http
    .authorizeHttpRequests(auth -> 
        auth.anyRequest().authenticated()
    )
    .csrf(csrf -> csrf.csrfTokenRepository(...))  // 명시
    .sessionManagement(session -> ...)            // 명시
    .headers(headers -> ...);                     // 명시

@Configuration
@EnableWebSecurity
public class OAuth2SecurityConfig {

    /**
     * OAuth2 Resource Server 설정
     * - JWT 검증
     * - Scope 기반 인가
     */
    @Bean
    @Order(1)
    public SecurityFilterChain apiChain(HttpSecurity http) throws Exception {
        http
            .securityMatcher("/api/**")
            .authorizeHttpRequests(authorize -> authorize
                .requestMatchers("/api/public/**").permitAll()
                .requestMatchers("/api/admin/**")
                    .hasAuthority("SCOPE_admin")
                .anyRequest()
                    .hasAuthority("SCOPE_read")
            )
            .oauth2ResourceServer(oauth2 -> oauth2
                .jwt(jwt -> jwt
                    .decoder(jwtDecoder())
                    .jwtAuthenticationConverter(jwtAuthenticationConverter())
                )
            )
            .sessionManagement(session -> 
                session.sessionCreationPolicy(SessionCreationPolicy.STATELESS)
            )
            .csrf(csrf -> csrf.disable());

        return http.build();
    }

    @Bean
    public JwtDecoder jwtDecoder() {
        return NimbusJwtDecoder.withJwkSetUri("https://auth.example.com/.well-known/jwks.json")
            .build();
    }

    @Bean
    public JwtAuthenticationConverter jwtAuthenticationConverter() {
        JwtGrantedAuthoritiesConverter grantedAuthoritiesConverter = 
            new JwtGrantedAuthoritiesConverter();
        grantedAuthoritiesConverter.setAuthoritiesClaimName("roles");
        grantedAuthoritiesConverter.setAuthorityPrefix("ROLE_");

        JwtAuthenticationConverter jwtAuthenticationConverter = 
            new JwtAuthenticationConverter();
        jwtAuthenticationConverter.setJwtGrantedAuthoritiesConverter(
            grantedAuthoritiesConverter
        );
        
        return jwtAuthenticationConverter;
    }
}

// ❌ 마이그레이션 실패
web.ignoring().requestMatchers("/css/**", "/api/public/**");

// ✅ 올바른 마이그레이션
@Bean
@Order(1)
SecurityFilterChain staticChain(HttpSecurity http) {
    http.securityMatcher("/css/**")
        .authorizeHttpRequests(auth -> auth.anyRequest().permitAll());
    return http.build();
}

@Bean
@Order(2)
SecurityFilterChain publicApiChain(HttpSecurity http) {
    http.securityMatcher("/api/public/**")
        .authorizeHttpRequests(auth -> auth.anyRequest().permitAll())
        .cors(withDefaults());  // CORS 적용
    return http.build();
}

// ❌ 체인 구분 없이 하나로 처리
@Bean
SecurityFilterChain filterChain(HttpSecurity http) {
    http.authorizeHttpRequests(auth -> auth
        .requestMatchers("/api/**").authenticated()
        .requestMatchers("/admin/**").hasRole("ADMIN")
        // ... 수십 개 규칙
    );
}

// ✅ 체인 분리
@Bean @Order(1)
SecurityFilterChain apiChain(HttpSecurity http) {
    http.securityMatcher("/api/**")
        .sessionManagement(s -> s.sessionCreationPolicy(STATELESS))
        .csrf(csrf -> csrf.disable());
    return http.build();
}

@Bean @Order(2)
SecurityFilterChain webChain(HttpSecurity http) {
    http.securityMatcher("/**")
        .sessionManagement(s -> s.sessionCreationPolicy(IF_REQUIRED))
        .csrf(withDefaults());
    return http.build();
}