dnd-side-project / dnd-11th-7-backend

๋ชจ๋‘์˜ ์ผ์ •์„ ํ•œ๋ˆˆ์—! ๊ฐ„ํŽธํ•œ ์ผ์ • ์กฐ์œจ ์„œ๋น„์Šค, ์งธ๊น
12 stars 1 forks source link

Spring REST Docs - CSRF #89

Closed f1v3-dev closed 2 months ago

f1v3-dev commented 2 months ago

๐Ÿ› ๏ธ ์–ด๋–ค ๊ธฐ๋Šฅ์ธ๊ฐ€์š”?

image

MockMvc๋ฅผ ์‚ฌ์šฉํ•˜์—ฌ ์š”์ฒญ์„ ๋ณด๋ƒˆ์„ ๊ฒฝ์šฐ, csrf ์„ค์ •์ด ํ•„์š”ํ•˜๋‹ค๋Š” ์—๋Ÿฌ๊ฐ€ ๋ฐœ์ƒํ–ˆ์—ˆ์Šต๋‹ˆ๋‹ค.

์ด๋Ÿฌํ•œ ๋ฌธ์ œ๋ฅผ ํ•ด๊ฒฐํ•˜๊ธฐ ์œ„ํ•ด ์ฝ”๋“œ ์ƒ์—์„œ ์•„๋ž˜์™€ ๊ฐ™์ด ์š”์ฒญ์‹œ, csrf๋ฅผ ํฌํ•จํ•˜๋„๋ก ํ•˜์˜€๋Š”๋ฐ request param์— ๋ถ™์–ด ๋ณด๊ธฐ ๋ถˆํŽธํ•˜๋‹ค๋Š” ๋ฌธ์ œ๊ฐ€ ์กด์žฌํ•ฉ๋‹ˆ๋‹ค.

    @BeforeEach
    void setUp(WebApplicationContext context, RestDocumentationContextProvider restDocumentation) {

        this.mockMvc = MockMvcBuilders
                .webAppContextSetup(context)
                .apply(documentationConfiguration(restDocumentation))
                .alwaysDo(MockMvcResultHandlers.print())
                .alwaysDo(restDocs)
                .addFilters(new CharacterEncodingFilter("UTF-8", true))
                .apply(springSecurity())
                .defaultRequest(post("/**").with(csrf()))
                .defaultRequest(get("/**").with(csrf()))
                .defaultRequest(patch("/**").with(csrf()))
                .defaultRequest(delete("/**").with(csrf()))
                .build();
    }

csrf์— ๋Œ€ํ•œ ์ •๋ณด๋ฅผ ํ—ค๋”๋กœ ๋ณด๋‚ด๋Š” ๋ฐฉ์‹์œผ๋กœ ์ˆ˜์ •ํ•˜๋Š” ๊ฒƒ์ด ๋” ๊น”๋”ํ•œ ๋ฌธ์„œํ™”๋ฅผ ๋งŒ๋“œ๋Š”๋ฐ ๋„์›€์ด ๋  ๊ฒƒ ๊ฐ™์•„์š”!

๐Ÿ—’๏ธ ์ž‘์—… ์ƒ์„ธ ๋‚ด์šฉ

๐Ÿ‘€ ์ฐธ๊ณ ํ• ๋งŒํ•œ ์ž๋ฃŒ

https://onedaythreecoding.tistory.com/entry/RestDocs-Request-parameters-with-the-following-names-were-not-documented-csrf