Spring Security 7.0 — 주요 변경점과 마이그레이션 가이드

@Bean
SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    http
        .formLogin(Customizer.withDefaults())
        .mfa(mfa -> mfa
            // TOTP 기반 MFA 활성화
            .totpAuthentication(totp -> totp
                .issuer("my-app")
                .codeLength(6)
            )
        );
    return http.build();
}

@Bean
SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    http
        .oneTimeTokenLogin(ott -> ott
            // 토큰 생성 후 이메일 전송 로직
            .tokenGenerationSuccessHandler(
                new SendLinkOneTimeTokenGenerationSuccessHandler("/login/ott")
            )
            // 토큰 저장소 설정 (기본: 인메모리)
            .tokenService(new JdbcOneTimeTokenService(dataSource))
        );
    return http.build();
}

public class EmailOneTimeTokenHandler
        implements OneTimeTokenGenerationSuccessHandler {

    private final JavaMailSender mailSender;

    @Override
    public void handle(HttpServletRequest request,
                       HttpServletResponse response,
                       OneTimeToken oneTimeToken) throws IOException {
        // 매직링크 URL 생성
        String loginUrl = "https://my-app.com/login/ott?token="
                + oneTimeToken.getTokenValue();

        // 이메일 전송
        SimpleMailMessage message = new SimpleMailMessage();
        message.setTo(oneTimeToken.getUsername());
        message.setSubject("로그인 링크");
        message.setText("아래 링크를 클릭하면 로그인됩니다:\n" + loginUrl);
        mailSender.send(message);

        // 안내 페이지로 리다이렉트
        response.sendRedirect("/login/ott/sent");
    }
}

일반 Bearer 토큰:
  토큰 탈취 → 공격자가 그대로 사용 가능

DPoP 토큰:
  토큰 탈취 → 클라이언트의 개인키가 없으면 사용 불가

@Bean
SecurityFilterChain resourceServerFilterChain(HttpSecurity http) throws Exception {
    http
        .oauth2ResourceServer(oauth2 -> oauth2
            .jwt(jwt -> jwt
                // DPoP 검증 활성화
                .dpop(Customizer.withDefaults())
            )
        );
    return http.build();
}

@Bean
SecurityFilterChain clientFilterChain(HttpSecurity http) throws Exception {
    http
        .oauth2Client(oauth2 -> oauth2
            .authorizationCodeGrant(code -> code
                // DPoP 바인딩 활성화
                .dpop(dpop -> dpop
                    .keyPairProvider(new InMemoryDPoPKeyPairProvider())
                )
            )
        );
    return http.build();
}

@Bean
SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    http
        .oauth2Login(oauth2 -> oauth2
            .authorizationEndpoint(auth -> auth
                // 기밀 클라이언트에서도 PKCE 자동 적용 (7.0 기본값)
                .authorizationRequestResolver(
                    new PkceOAuth2AuthorizationRequestResolver(
                        clientRegistrationRepository
                    )
                )
            )
        );
    return http.build();
}

@Bean
SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    http
        .webAuthn(webAuthn -> webAuthn
            // Relying Party 설정
            .rpName("My Application")
            .rpId("my-app.com")
            .allowedOrigins("https://my-app.com")
        );
    return http.build();
}

@Bean
SecurityFilterChain authorizationServerFilterChain(HttpSecurity http)
        throws Exception {
    // Authorization Server 기본 설정 적용
    OAuth2AuthorizationServerConfigurer authorizationServer =
        OAuth2AuthorizationServerConfigurer.authorizationServer();

    http
        .securityMatcher(authorizationServer.getEndpointsMatcher())
        .with(authorizationServer, authServer -> authServer
            // OIDC 활성화
            .oidc(Customizer.withDefaults())
        )
        .authorizeHttpRequests(authorize -> authorize
            .anyRequest().authenticated()
        );

    return http.build();
}

// 6.x
implementation 'org.springframework.security:spring-security-oauth2-authorization-server:1.3.x'

// 7.0 — Spring Boot 스타터로 통합
implementation 'org.springframework.boot:spring-boot-starter-oauth2-authorization-server'

// ---- 6.x (deprecated 방식) ----
http
    .authorizeRequests()                    // deprecated
        .antMatchers("/admin/**")           // deprecated
            .hasRole("ADMIN")
        .antMatchers("/api/**")             // deprecated
            .authenticated()
        .anyRequest().permitAll()
    .and()                                  // deprecated
    .formLogin();

// ---- 7.0 (새로운 방식) ----
http
    .authorizeHttpRequests(authorize -> authorize
        .requestMatchers("/admin/**").hasRole("ADMIN")
        .requestMatchers("/api/**").authenticated()
        .anyRequest().permitAll()
    )
    .formLogin(Customizer.withDefaults());

// 6.x — 메서드 체이닝 (7.0에서 제거)
http.csrf().ignoringRequestMatchers("/api/**");
http.cors().configurationSource(corsConfigurationSource());
http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);

// 7.0 — Lambda DSL (유일한 방식)
http.csrf(csrf -> csrf.ignoringRequestMatchers("/api/**"));
http.cors(cors -> cors.configurationSource(corsConfigurationSource()));
http.sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS));

# 빌드 시 deprecated 경고 확인
./gradlew compileJava -Xlint:deprecation

// 이것들을 전부 찾아서
.antMatchers("/api/**")
.mvcMatchers("/api/**")
.regexMatchers("/api/.*")

// 이것으로 변경
.requestMatchers("/api/**")

// and() 체이닝을 모두 제거하고 Lambda 방식으로 전환
http
    .httpBasic(Customizer.withDefaults())
    .formLogin(form -> form
        .loginPage("/login")
        .permitAll()
    )
    .logout(logout -> logout
        .logoutSuccessUrl("/")
    );

// build.gradle
plugins {
    id 'org.springframework.boot' version '4.0.0'
}
dependencies {
    implementation 'org.springframework.boot:spring-boot-starter-security'
}