FIX: Enhance JWT handling and error management #139
Conversation
- Added CustomJwtException for improved JWT error handling. - Updated GlobalExceptionHandler to handle CustomJwtException. - Refactored JwtExceptionFilter to manage JWT-related exceptions more effectively. - Adjusted JwtTokenProvider to catch SignatureException alongside MalformedJwtException. - Updated .gitignore to include generated QueryDSL files.
Walkthrough들어봐, 친구! 이번 변경은 JWT 예외 처리 방식을 싹 정리했어. 기존에 ExpiredJwtException, MalformedJwtException 따로따로 처리하던 걸 CustomJwtException 하나로 통합했지. JwtExceptionFilter에도 CustomJwtException을 따로 잡아서 응답을 내보내도록 했고, 응답 만드는 메서드도 하나로 합쳤어. JwtTokenProvider에서는 SignatureException도 잡아서 CustomJwtException으로 던지게 했지. 그리고 .gitignore에는 QueryDSL 생성 디렉토리 무시 규칙이 추가됐어. 깔끔하게 정리됐다고! Changes
Sequence Diagram(s)sequenceDiagram
participant Client
participant JwtExceptionFilter
participant GlobalExceptionHandler
participant JwtTokenProvider
Client->>JwtExceptionFilter: 요청 전송 (JWT 포함)
JwtExceptionFilter->>JwtTokenProvider: 토큰 검증 및 인증
JwtTokenProvider-->>JwtExceptionFilter: 성공/CustomJwtException 발생
alt CustomJwtException 발생
JwtExceptionFilter->>Client: CustomJwtException에 따른 에러 응답 반환
else 인증 성공
JwtExceptionFilter->>Client: 정상 처리
end
Poem
📜 Recent review detailsConfiguration used: CodeRabbit UI 📒 Files selected for processing (4)
🔇 Additional comments (14)
✨ Finishing Touches
🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
Suspect IssuesThis pull request was deployed and Sentry observed the following issues:
Did you find this useful? React with a 👍 or 👎 |
- Added links to PR #139 in relevant documentation files for better traceability. - Cleaned up .gitignore by removing duplicate entries and ensuring proper formatting.
…141) * Refactor: Clean up code formatting and enhance JWT handling - Consolidated tag annotations in AdminController and MemberController for consistency. - Improved formatting in SecurityConfig and JwtAuthorizationFilter for better readability. - Added constants for access and refresh token durations in AuthConstants. - Updated error codes in ErrorCode for better clarity on refresh token issues. - Refactored JwtTokenProvider to streamline token creation and validation processes. - Enhanced MemberService with clearer method documentation and improved member retrieval logic. * Enhance authentication and token management features - Added Redis support for token storage in JwtTokenProvider. - Introduced device ID handling in refresh token logic to improve security. - Updated AuthConstants to include new constants for refresh token handling. - Refactored HttpRequestUtil for better IP and device ID extraction. - Removed deprecated AuthController and consolidated member-related services for improved maintainability. - Added error handling for missing device ID in requests. - Enhanced MemberService to delegate responsibilities to specialized services for better separation of concerns. * Refactor authentication and token management system - Updated Redis configuration for enhanced token storage and management. - Removed deprecated classes and methods related to refresh token handling. - Consolidated authentication logic into a single AuthService for better maintainability. - Improved error handling for device ID mismatches and token reuse detection. - Enhanced security by implementing refresh token rotation and validation mechanisms. - Updated GlobalExceptionHandler to manage new error codes and exceptions effectively. - Refactored JwtTokenProvider to streamline token creation and hashing processes. - Improved CORS configuration and security settings in SecurityConfig for better API protection. * Update documentation and .gitignore - Added links to PR #139 in relevant documentation files for better traceability. - Cleaned up .gitignore by removing duplicate entries and ensuring proper formatting. * Refactor: Clean up generated QueryDSL files and improve code formatting - Removed unused generated QueryDSL classes related to alcohol, daily life, and member domains to streamline the codebase. - Updated build.gradle to remove unnecessary dependencies and improve formatting. - Enhanced code readability by adjusting indentation and spacing in various configuration and utility classes. - Improved Redis token revocation script for better performance with large datasets by switching from KEYS to SCAN. * Enhance Redis configuration for dynamic connection settings - Updated RedisConfig to use properties for host, port, and SSL settings, allowing for more flexible configuration. - Improved connection factory setup to conditionally enable SSL based on configuration values. * Refactor ProviderConverter and enhance IP address validation - Replaced InvalidParamException with BaseException in ProviderConverter for improved error handling. - Added support for IPv6 private address validation in IpAddressExtractor, enhancing the method to check for private IP ranges. --------- Co-authored-by: Youngjun Kim <[email protected]>
Summary by CodeRabbit