[FLYW-140] CSRF 설정 분리 (JSP Web 활성화 / API Origin 검증 적용)

src/main/java/com/flyway/auth/controller/AuthController.java

@@ -116,6 +116,11 @@ public ResponseEntity<Void> refresh(
         }
     }
 
+    @GetMapping("/auth/csrf")
+    public ResponseEntity<Void> csrf() {
+        return ResponseEntity.noContent().build();
+    }
+
     private void autoLoginByEmail(String email, HttpServletRequest req, HttpServletResponse res) {
         UserDetails userDetails = emailUserDetailsService.loadUserByUsername(email);
         authenticateAndSave(userDetails, req, res);

src/main/java/com/flyway/auth/controller/AuthViewController.java

@@ -7,6 +7,7 @@
 import org.springframework.stereotype.Controller;
 import org.springframework.ui.Model;
 import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RequestParam;
 
 import javax.servlet.http.HttpSession;
 
@@ -17,7 +18,12 @@ public class AuthViewController {
     private static final String OAUTH_SIGNUP_EMAIL_ATTR = "OAUTH_SIGNUP_EMAIL";
 
     @GetMapping("/login")
-    public String loginView() {
+    public String loginView(@RequestParam(value = "returnUrl", required = false) String returnUrl,
+                            Model model) {
+        String safeReturnUrl = sanitizeReturnUrl(returnUrl);
+        if (safeReturnUrl != null) {
+            model.addAttribute("returnUrl", safeReturnUrl);
+        }
         return "login";
     }
 
@@ -57,4 +63,16 @@ public String signupView(
         return "signup";
     }
 
+    private String sanitizeReturnUrl(String raw) {
+        if (raw == null) return null;
+        String path = raw.trim();
+        if (path.isEmpty()) return null;
+        if (!path.startsWith("/")) return null;
+        if (path.startsWith("//") || path.startsWith("/\\")) return null;
+        String lower = path.toLowerCase();
+        if (lower.startsWith("/http")) return null;
+        if (path.contains("://")) return null;
+        return path;
+    }
+
 }

src/main/java/com/flyway/auth/service/AuthTokenService.java

@@ -21,6 +21,11 @@ public interface AuthTokenService {
      */
     void logout(HttpServletRequest request, HttpServletResponse response);
 
+    /**
+     * 강제 로그아웃: 세션/보안 컨텍스트 정리 + 쿠키 삭제
+     */
+    void forceLogout(HttpServletRequest request, HttpServletResponse response);
+
     /**
      * 토큰 폐기
      */

src/main/java/com/flyway/auth/service/AuthTokenServiceImpl.java

@@ -12,13 +12,15 @@
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.http.HttpHeaders;
 import org.springframework.http.ResponseCookie;
+import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.stereotype.Service;
 import org.springframework.transaction.annotation.Transactional;
 import org.springframework.util.StringUtils;
 
 import javax.servlet.http.Cookie;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
+import javax.servlet.http.HttpSession;
 import java.security.SecureRandom;
 import java.time.LocalDateTime;
 import java.util.Base64;
@@ -32,13 +34,15 @@ public class AuthTokenServiceImpl implements AuthTokenService {
     private static final String ACCESS_COOKIE = "accessToken";
     private static final String REFRESH_COOKIE = "refreshToken";
     private static final String ACCESS_COOKIE_PATH = "/";
-    private static final String REFRESH_COOKIE_PATH = "/auth";
+    private static final String REFRESH_COOKIE_PATH = "/";
+    private static final String LEGACY_REFRESH_COOKIE_PATH = "/auth";
 
     private final JwtProvider jwtProvider;
     private final JwtProperties jwtProperties;
 
     private final RefreshTokenRepository refreshTokenRepository;
     private final TokenHasher tokenHasher;
+    private final RefreshTokenRevocationService refreshTokenRevocationService;
 
     @Value("${cookie.secure:false}")
     private boolean cookieSecure;
@@ -77,23 +81,27 @@ public void refresh(HttpServletRequest request, HttpServletResponse response) {
 
         String refreshRaw = readCookie(request, REFRESH_COOKIE);
         if (!StringUtils.hasText(refreshRaw)) {
+            forceLogout(request, response);
             throw new BusinessException(ErrorCode.AUTH_REFRESH_TOKEN_MISSING);
         }
 
         String hash = tokenHasher.hash(refreshRaw);
         RefreshToken stored = refreshTokenRepository.findByTokenHash(hash);
         if (stored == null) {
+            forceLogout(request, response);
             throw new BusinessException(ErrorCode.AUTH_REFRESH_TOKEN_INVALID);
         }
 
         /* 만료/폐기 체크 */
         if (stored.getRevokedAt() != null || !stored.getExpiresAt().isAfter(now)) {
+            forceLogout(request, response);
             throw new BusinessException(ErrorCode.AUTH_REFRESH_TOKEN_EXPIRED);
         }
 
         /* 재사용 탐지 */
         if (stored.getRotatedAt() != null) {
-            refreshTokenRepository.revokeAllByUserId(stored.getUserId(), now);
+            refreshTokenRevocationService.revokeAllByUserTokens(stored.getUserId(), now);
+            forceLogout(request, response);
             throw new BusinessException(ErrorCode.AUTH_REFRESH_TOKEN_REUSED);
         }
 
@@ -123,6 +131,7 @@ public void refresh(HttpServletRequest request, HttpServletResponse response) {
 
         /* 동시 요청/레이스: 이미 회전됐거나 revoke인 경우 */
         if (rotated == 0) {
+            forceLogout(request, response);
             throw new BusinessException(ErrorCode.AUTH_REFRESH_TOKEN_ALREADY_USED);
         }
 
@@ -147,7 +156,30 @@ public void logout(HttpServletRequest request, HttpServletResponse response) {
         }
 
         deleteCookie(response, ACCESS_COOKIE, ACCESS_COOKIE_PATH);
-        deleteCookie(response, REFRESH_COOKIE, REFRESH_COOKIE_PATH);
+        deleteRefreshCookies(response);
+    }
+
+    @Override
+    @Transactional
+    public void forceLogout(HttpServletRequest request, HttpServletResponse response) {
+        try {
+            logout(request, response);
+        } catch (Exception e) {
+            log.warn("[AUTH] force logout - token cleanup failed", e);
+            deleteCookie(response, ACCESS_COOKIE, ACCESS_COOKIE_PATH);
+            deleteRefreshCookies(response);
+        }
+
+        try {
+            HttpSession session = request.getSession(false);
+            if (session != null) {
+                session.invalidate();
+            }
+        } catch (Exception e) {
+            log.warn("[AUTH] force logout - session invalidate failed", e);
+        }
+
+        SecurityContextHolder.clearContext();
     }
 
     @Transactional
@@ -195,6 +227,11 @@ private void deleteCookie(HttpServletResponse response, String name, String path
         response.addHeader(HttpHeaders.SET_COOKIE, cookie.toString());
     }
 
+    private void deleteRefreshCookies(HttpServletResponse response) {
+        deleteCookie(response, REFRESH_COOKIE, REFRESH_COOKIE_PATH);
+        deleteCookie(response, REFRESH_COOKIE, LEGACY_REFRESH_COOKIE_PATH);
+    }
+
     private String readCookie(HttpServletRequest request, String name) {
         Cookie[] cookies = request.getCookies();
         if (cookies == null) return null;

src/main/java/com/flyway/auth/service/RefreshTokenRevocationService.java

@@ -0,0 +1,21 @@
+package com.flyway.auth.service;
+
+import com.flyway.auth.repository.RefreshTokenRepository;
+import lombok.RequiredArgsConstructor;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Propagation;
+import org.springframework.transaction.annotation.Transactional;
+
+import java.time.LocalDateTime;
+
+@Service
+@RequiredArgsConstructor
+public class RefreshTokenRevocationService {
+
+    private final RefreshTokenRepository refreshTokenRepository;
+
+    @Transactional(propagation = Propagation.REQUIRES_NEW)
+    public void revokeAllByUserTokens(String userId, LocalDateTime now) {
+        refreshTokenRepository.revokeAllByUserId(userId, now);
+    }
+}

src/main/java/com/flyway/search/controller/FlightApiController.java

@@ -39,8 +39,8 @@ public List<Airline> airline(Airline vo) {
     }
 
     // 검색
-    @PostMapping("/api/public/flights/search")
-    public SearchResultDto search(@RequestBody FlightSearchRequest dto) {
+    @GetMapping("/api/public/flights/search")
+    public SearchResultDto search(@ModelAttribute FlightSearchRequest dto) {
         return service.search(dto);
     }
 

src/main/java/com/flyway/search/dto/FlightSearchRequest.java

@@ -1,6 +1,7 @@
 package com.flyway.search.dto;
 
 import lombok.Data;
+import org.springframework.format.annotation.DateTimeFormat;
 
 import java.time.LocalDate;
 
@@ -9,7 +10,9 @@ public class FlightSearchRequest {
     private String tripType;
     private String from;
     private String to;
+    @DateTimeFormat(iso = DateTimeFormat.ISO.DATE)
     private LocalDate dateStart;
+    @DateTimeFormat(iso = DateTimeFormat.ISO.DATE)
     private LocalDate dateEnd;
     private Integer passengers;
     private String cabinClass;

src/main/java/com/flyway/security/config/SecurityConfigApi.java

@@ -3,6 +3,7 @@
 import com.flyway.security.handler.JwtAccessDeniedHandler;
 import com.flyway.security.handler.JwtAuthenticationEntryPoint;
 import com.flyway.security.filter.OnboardingAccessFilter;
+import com.flyway.security.filter.OriginRefererCheckFilter;
 import com.flyway.security.jwt.JwtApiAuthFilter;
 import com.flyway.security.jwt.JwtProvider;
 import org.springframework.beans.factory.annotation.Qualifier;
@@ -16,6 +17,9 @@
 import org.springframework.security.config.http.SessionCreationPolicy;
 import org.springframework.security.core.userdetails.UserDetailsService;
 import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
+import org.springframework.security.web.csrf.CsrfFilter;
+import org.springframework.security.web.csrf.CookieCsrfTokenRepository;
+import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
 
 @Configuration
 @EnableWebSecurity
@@ -26,16 +30,19 @@ public class SecurityConfigApi extends WebSecurityConfigurerAdapter {
     private final JwtAuthenticationEntryPoint jwtAuthenticationEntryPoint;
     private final JwtAccessDeniedHandler jwtAccessDeniedHandler;
     private final UserDetailsService userIdUserDetailsService;
+    private final SecurityOriginProperties securityOriginProperties;
 
     public SecurityConfigApi(
             JwtProvider jwtProvider,
             JwtAuthenticationEntryPoint jwtAuthenticationEntryPoint,
             JwtAccessDeniedHandler jwtAccessDeniedHandler,
+            SecurityOriginProperties securityOriginProperties,
             @Qualifier("userIdUserDetailsService") UserDetailsService userIdUserDetailsService
     ) {
         this.jwtProvider = jwtProvider;
         this.jwtAuthenticationEntryPoint = jwtAuthenticationEntryPoint;
         this.jwtAccessDeniedHandler = jwtAccessDeniedHandler;
+        this.securityOriginProperties = securityOriginProperties;
         this.userIdUserDetailsService = userIdUserDetailsService;
     }
 
@@ -48,6 +55,11 @@ public JwtApiAuthFilter jwtApiAuthFilter() {
         );
     }
 
+    @Bean
+    public OriginRefererCheckFilter apiOriginRefererCheckFilter() {
+        return OriginRefererCheckFilter.forApi(securityOriginProperties.getAllowedOrigins());
+    }
+
     @Override
     protected void configure(HttpSecurity http) throws Exception {
         http
@@ -56,7 +68,15 @@ protected void configure(HttpSecurity http) throws Exception {
                 .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                 .and()
 
-                .csrf().disable()
+                .csrf(csrf -> csrf
+                        .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())
+                        // 로그인 전/토큰 재발급 같은 엔드포인트는 "의도적으로" 예외 가능
+                        .ignoringRequestMatchers(
+                                new AntPathRequestMatcher("/api/auth/loginProc", "POST"),
+                                new AntPathRequestMatcher("/api/auth/refresh", "POST"),
+                                new AntPathRequestMatcher("/api/auth/logout", "POST")
+                        )
+                )
                 .formLogin().disable()
                 .httpBasic().disable()
 
@@ -79,6 +99,7 @@ protected void configure(HttpSecurity http) throws Exception {
                 .anyRequest().authenticated()
                 .and()
 
+                .addFilterBefore(apiOriginRefererCheckFilter(), CsrfFilter.class)
                 .addFilterBefore(jwtApiAuthFilter(), UsernamePasswordAuthenticationFilter.class)
                 .addFilterAfter(new OnboardingAccessFilter(), JwtApiAuthFilter.class);
     }