서블릿 세션, 필터, 인터셉터, 예외 처리

@PostMapping("/login") public String login(@Valid @ModelAttribute LoginFrom from, BindingResult bindingResult, HttpServletResponse response) { ... Member loginMember = loginService.login(form.getLoginId(), form.getPassword()); if (loginMember == null) { bindingResult.reject("loginFail", "아이디 또는 비밀번호가 맞지 않습니다."); return "login/loginForm"; } Cookie idCookie = new Cookie("memberId, String.valueOf(loginMember.getId())); response.addCookie(idCookie); return "redirect:/"; }

@GetMapping("/") public String homeLogin( @CookieValue(name = "memberId", required = false) Long memberId, Model model) { if (memberId == null) { return "home"; } Member loginMember = memberRepository.findById(memberId); if (loginMember == null) { return "home"; } model.addAttribute("member", loginMember); return "loginHome"; }

@PostMapping("/logout") public String logout(HttpServletResponse response) { Cookie cookie = new Cookie(cookieName, null); cookie.setMaxAge(0); response.addCookie(cookie); return "redirect:/"; }

@PostMapping("/login") public String loginV3(@Valid @ModelAttribute LoginForm form, BindingResult bindingResult, HttpServletRequest request) { ... Member loginMember = loginService.login(form.getLoginId(), form.getPassword()); if (loginMember == null) { bindingResult.rejcet("loginFail", "아이디 또는 비밀번호가 맞지 않습니다."); return "login/loginForm"; } HttpSession session = request.getSession(); session.setAttribute("loginMember", loginMember); return "redirect:/"; }

@GetMapping("/") public String homeLoginV3(HttpServletRequest request, Model model) { HttpSession session = request.getSession(false); if (session == null) { return "home"; } Member loginMember = (Member)session.getAttribute("loginMember"); if (loginMember == null) { return "home"; } model.addAttribute("member", loginMember); return "loginHome"; }

@PostMapping("/logout") public String logoutV3(HttpServletRequest request) { HttpSession session = request.getSession(false); if (session != null) { session.invalidate(); } return "redirect:/"; }

@GetMapping("/") public String homeLoginV3Spring( @SessionAttribute(name = "loginMember", required = false) Member loginMember, Model model) { if (loginMember == null) { return "home"; } model.addAttribute("member", loginMember); return "loginHome"; }

server: servlet: session: tracking-modes: cookie

server: servlet: session: timeout: 60

@Target(ElementType.PARAMETER) @Retention(RetentionPolicy.RUNTIME) public @interface Login { }

@Slf4j public class LoginMemberArgumentResolver implements HandlerMethodArgumentResolver { @Override public boolean supportsParameter(MethodParameter parameter) { log.info("supportsParameter 실행"); boolean hasLoginAnnotation = parameter.hasParameterAnnotation(Login.class); boolean hasMemberType = Member.class.isAssignableFrom(parameter.getParameterType()); return hasLoginAnnotation && hasMemberType; } @Override public Object resolveArgument(MethodParameter parameter, ModelAndViewContainer mavContainer, NativeWebRequest webRequest, WebDataBinderFactory binderFactory) throws Exception { log.info("resolveArgument 실행"); HttpServletRequest request = (HttpServletRequest) webRequest.getNativeRequest(); HttpSession session = request.getSession(false); if (session == null) { return null; } return session.getAttribute("memberId"); } }

@Configuration public class WebConfig implements WebMvcConfigurer { @Override public void addArgumentResolvers(List<HandlerMethodArgumentResolver> resolvers) { resolvers.add(new LoginMemberArgumentResolver()); } ... }

@GetMapping("/") public String homeLoginV3ArgumentResolver(@Login Member loginMember, Model model) { //세션에 회원 데이터가 없으면 home if (loginMember == null) { return "home"; } //세션이 유지되면 로그인으로 이동 model.addAttribute("member", loginMember); return "loginHome"; }

HTTP 요청 -> WAS -> 필터 -> 서블릿 -> 컨트롤러

// 로그인 사용자 HTTP 요청 -> WAS -> 필터 -> 서블릿 -> 컨트롤러 // 비 로그인 사용자 HTTP 요청 -> WAS -> 필터 -> 차단(서블릿 호출 X)

HTTP 요청 -> WAS -> 필터1 -> 필터2 -> 필터3 -> 서블릿 -> 컨트롤러

public interface Filter { public default void init(FilterConfig filterConfig) throws ServletException {} public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException; public default void destroy() {} }

@Slf4j public class LogFilter implements Filter { @Override public void init(FilterConfig filterConfig) throws ServletException { log.info("log filter init"); } @Override public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { HttpServletRequest httpRequest = (HttpServletRequest) request; String requestURI = httpRequest.getRequestURI(); String uuid = UUID.randomUUID().toString(); try { log.info("REQUEST [{}][{}]", uuid, requestURI); chain.doFilter(request, response); } catch (Exception e) { throw e; } finally { log.info("RESPONSE [{}][{}]", uuid, requestURI); } } @Override public void destroy() { log.info("log filter destroy"); } }

@Configuration public class WebConfig { @Bean public FilterRegistrationBean logFilter() { FilterRegistrationBean<Filter> filterRegistrationBean = new FilterRegistrationBean<>(); filterRegistrationBean.setFilter(new LogFilter()); filterRegistrationBean.setOrder(1); filterRegistrationBean.addUrlPatterns("/*"); return filterRegistrationBean; } }

@Slf4j public class LoginCheckFilter implements Filter { private static final String[] whitelist = {"/", "/members/add", "/login", "/logout","/css/*"}; @Override public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { HttpServletRequest httpRequest = (HttpServletRequest) request; String requestURI = httpRequest.getRequestURI(); HttpServletResponse httpResponse = (HttpServletResponse) response; try { log.info("인증 체크 필터 시작 {}", requestURI); if (isLoginCheckPath(requestURI)) { log.info("인증 체크 로직 실행 {}", requestURI); HttpSession session = httpRequest.getSession(false); if (session == null || session.getAttribute(SessionConst.LOGIN_MEMBER) == null) { log.info("미인증 사용자 요청 {}", requestURI); //로그인으로 redirect httpResponse.sendRedirect("/login?redirectURL=" + requestURI); return; //여기가 중요, 미인증 사용자는 다음으로 진행하지 않고 끝! } } chain.doFilter(request, response); } catch (Exception e) { throw e; //예외 로깅 가능 하지만, 톰캣까지 예외를 보내주어야 함 } finally { log.info("인증 체크 필터 종료 {}", requestURI); } } /** * 화이트 리스트의 경우 인증 체크X */ private boolean isLoginCheckPath(String requestURI) { return !PatternMatchUtils.simpleMatch(whitelist, requestURI); } }

@Bean public FilterRegistrationBean loginCheckFilter() { FilterRegistrationBean<Filter> filterRegistrationBean = new FilterRegistrationBean<>(); filterRegistrationBean.setFilter(new LoginCheckFilter()); filterRegistrationBean.setOrder(2); filterRegistrationBean.addUrlPatterns("/*"); return filterRegistrationBean; }

HTTP 요청 -> WAS -> 필터 -> 서블릿 -> 스프링 인터셉터 -> 컨트롤러

// 로그인 사용자 HTTP 요청 -> WAS -> 필터 -> 서블릿 -> 스프링 인터셉터 -> 컨트롤러 // 비 로그인 사용자 HTTP 요청 -> WAS -> 필터 -> 서블릿 -> 스프링 인터셉터 -> 차단(컨트롤러 호출 X)

HTTP 요청 -> WAS -> 필터 -> 서블릿 -> 인터셉터1 -> 인터셉터2 -> 컨트롤러

public interface HandlerInterceptor { default boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {} default void postHandle(HttpServletRequest request, HttpServletResponseresponse, Object handler, @Nullable ModelAndView modelAndView) throws Exception {} default void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, @Nullable Excpetion ex) throws Exception {} }

@Slf4j public class LogInterceptor implements HandlerInterceptor { public static final String LOG_ID = "logId"; @Override public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception { String requestURI = request.getRequestURI(); String uuid = UUID.randomUUID().toString(); request.setAttribute(LOG_ID, uuid); //@RequestMapping: HandlerMethod //정적 리소스: ResourceHttpRequestHandler if (handler instanceof HandlerMethod) { //호출할 컨트롤러 메서드의 모든 정보가 포함되어 있다. HandlerMethod hm = (HandlerMethod) handler; } log.info("REQUEST [{}][{}][{}]", uuid, requestURI, handler); return true; //false 진행X } @Override public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler, ModelAndView modelAndView) throws Exception { log.info("postHandle [{}]", modelAndView); } @Override public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex) throws Exception { String requestURI = request.getRequestURI(); String logId = (String)request.getAttribute(LOG_ID); log.info("RESPONSE [{}][{}]", logId, requestURI); if (ex != null) { log.error("afterCompletion error!!", ex); } } }

@Configuration public class WebConfig implements WebMvcConfigurer { @Override public void addInterceptors(InterceptorRegistry registry) { registry.addInterceptor(new LogInterceptor()) .order(1) .addPathPatterns("/**") .excludePathPatterns("/css/**", "/*.ico", "/error"); } //... }

? 한 문자 일치 * 경로(/) 안에서 0개 이상의 문자 일치 ** 경로 끝까지 0개 이상의 경로(/) 일치 {spring} 경로(/)와 일치하고 spring이라는 변수로 캡처 {spring:[a-z]+} matches the regexp [a-z]+ as a path variable named "spring" {spring:[a-z]+} regexp [a-z]+ 와 일치하고, "spring" 경로 변수로 캡처 {*spring} 경로가 끝날 때 까지 0개 이상의 경로(/)와 일치하고 spring이라는 변수로 캡처 /pages/t?st.html — matches /pages/test.html, /pages/tXst.html but not /pages/ toast.html /resources/*.png — matches all .png files in the resources directory /resources/** — matches all files underneath the /resources/ path, including / resources/image.png and /resources/css/spring.css /resources/{*path} — matches all files underneath the /resources/ path and captures their relative path in a variable named "path"; /resources/image.png will match with "path" → "/image.png", and /resources/css/spring.css will match with "path" → "/css/spring.css" /resources/{filename:\\w+}.dat will match /resources/spring.dat and assign the value "spring" to the filename variable

@Slf4j public class LoginCheckInterceptor implements HandlerInterceptor { @Override public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception { String requestURI = request.getRequestURI(); log.info("인증 체크 인터셉터 실행 {}", requestURI); HttpSession session = request.getSession(false); if (session == null || session.getAttribute(SessionConst.LOGIN_MEMBER) == null) { log.info("미인증 사용자 요청"); //로그인으로 redirect response.sendRedirect("/login?redirectURL=" + requestURI); return false; } return true; } }

@Override public void addInterceptors(InterceptorRegistry registry) { ... registry.addInterceptor(new LoginCheckInterceptor()) .order(2) .addPathPatterns("/**") .excludePathPatterns("/", "/members/add", "/login", "/logout", "/css/**", "/*.ico", "/error" ); }

@GetMapping("/error-ex") public void errorEx() { throw new RuntimeException("예외 발생!"); }

컨트롤러(예외 발생) -> 인터셉터 -> 서블릿 -> 필터 -> WAS

@GetMapping("/error-404") public void error404(HttpServletResponse response) throws IOExcpetion { response.sendError(404, "404 예외 발생!"); }

컨트롤러 -> 인터셉터 -> 서블릿 -> 필터 -> WAS(sendError 호출 기록 확인)

@Component public class WebServerCustomizer implements WebServerFactoryCustomizer<ConfigurableWebServerFactory> { @Override public void customize(ConfigurableWebServerFactory factory) { ErrorPage errorPage404 = new ErrorPage(HttpStatus.NOT_FOUND, "/error-page/404"); ErrorPage errorPage500 = new ErrorPage(HttpStatus.INTERNAL_SERVER_ERROR, "/error-page/500"); ErrorPage errorPageEx = new ErrorPage(RuntimeException.class, "/error-page/500"); factory.addErrorPages(errorPage404, errorPage500, errorPageEx); } }

@Slf4j @Controller public class ErrorPageController { @RequestMapping("/error-page/404") public String errorPage404(HttpServletRequest request, HttpServletResponse response) { log.info("errorPage 404"); return "error-page/404"; } @RequestMapping("/error-page/500") public String errorPage500(HttpServletRequest request, HttpServletResponse response) { log.info("errorPage 500"); return "error-page/500"; } }

// 예외 발생 컨트롤러(예외 발생) -> 인터셉터 -> 서블릿 -> 필터 -> WAS -> ErrorPage의 Path 요청 -> 필터 -> 서블릿 -> 인터셉터 -> 컨트롤러 // sendError 컨트롤러 -> 인터셉터 -> 서블릿 -> 필터 -> WAS(sendError 호출 기록 확인) -> ErrorPage의 Path 요청 -> 필터 -> 서블릿 -> 인터셉터 -> 컨트롤러

@Slf4j @Controller public class ErrorPageController { //RequestDispatcher 상수로 정의되어 있음 public static final String ERROR_EXCEPTION = "javax.servlet.error.exception"; public static final String ERROR_EXCEPTION_TYPE = "javax.servlet.error.exception_type"; public static final String ERROR_MESSAGE = "javax.servlet.error.message"; public static final String ERROR_REQUEST_URI = "javax.servlet.error.request_uri"; public static final String ERROR_SERVLET_NAME = "javax.servlet.error.servlet_name"; public static final String ERROR_STATUS_CODE = "javax.servlet.error.status_code"; @RequestMapping("/error-page/404") public String errorPage404(HttpServletRequest request, HttpServletResponse response) { log.info("errorPage 404"); printErrorInfo(request); return "error-page/404"; } @RequestMapping("/error-page/500") public String errorPage500(HttpServletRequest request, HttpServletResponse response) { log.info("errorPage 500"); printErrorInfo(request); return "error-page/500"; } private void printErrorInfo(HttpServletRequest request) { log.info("ERROR_EXCEPTION: ex=", request.getAttribute(ERROR_EXCEPTION)); log.info("ERROR_EXCEPTION_TYPE: {}", request.getAttribute(ERROR_EXCEPTION_TYPE)); log.info("ERROR_MESSAGE: {}", request.getAttribute(ERROR_MESSAGE)); //ex의 경우 NestedServletException 스프링이 한번 감싸서 반환 log.info("ERROR_REQUEST_URI: {}", request.getAttribute(ERROR_REQUEST_URI)); log.info("ERROR_SERVLET_NAME: {}", request.getAttribute(ERROR_SERVLET_NAME)); log.info("ERROR_STATUS_CODE: {}", request.getAttribute(ERROR_STATUS_CODE)); log.info("dispatchType={}", request.getDispatcherType()); } }

// 예외 발생 컨트롤러(예외 발생) -> 인터셉터 -> 서블릿 -> 필터 -> WAS -> ErrorPage의 Path 요청 -> 필터 -> 서블릿 -> 인터셉터 -> 컨트롤러 // sendError 컨트롤러 -> 인터셉터 -> 서블릿 -> 필터 -> WAS(sendError 호출 기록 확인) -> ErrorPage의 Path 요청 -> 필터 -> 서블릿 -> 인터셉터 -> 컨트롤러

public enum DispatcherType { FORWARD, INCLUDE, REQUEST, ASYNC, ERROR }

@Bean public FilterRegistrationBean logFilter() { FilterRegistrationBean<Filter> filterRegistrationBean = new FilterRegistrationBean<>(); filterRegistrationBean.setFilter(new LogFilter()); filterRegistrationBean.setOrder(1); filterRegistrationBean.addUrlPatterns("/*"); filterRegistrationBean.setDispatcherTypes(DispatcherType.REQUEST, DispatcherType.ERROR); return filterRegistrationBean; }

@Override public void addInterceptors(InterceptorRegistry registry) { registry.addInterceptor(new LogInterceptor()) .order(1) .addPathPatterns("/**") .excludePathPatterns("/css/**", "/*.ico", "/error", "/error-page/**"); //오류 페이지 경로 }

1. WAS(/error-ex, dispatchType=REQUEST) -> 필터 -> 서블릿 -> 인터셉터 -> 컨트롤러 2. WAS(여기까지 전파) <- 필터 <- 서블릿 <- 인터셉터 <- 컨트롤러(예외발생) 3. WAS 오류 페이지 확인 4. WAS(/error-page/500, dispatchType=ERROR) -> 필터(x) -> 서블릿 -> 인터셉터(x) -> 컨트롤러(/error-page/500) -> View

* timestamp: Fri Feb 05 00:00:00 KST 2021 * status: 400 * error: Bad Request * exception: org.springframework.validation.BindException * trace: 예외 trace * message: Validation failed for object='data'. Error count: 1 * errors: Errors(BindingResult) * path: 클라이언트 요청 경로 (`/hello`)

server: error: include-exception: false # exception 포함 여부 include-message: always # message 포함 여부 include-stacktrace: never # trace 포함 여부 include-binding-errors: on_param # errors 포함 여부 # never : 사용하지 않음 # always : 항상 사용 # on_param : 이름이 동일한 쿼리 파라미터가 있을 때 사용

@RequestMapping(value = "/error-page/500", produces = MediaType.APPLICATION_JSON_VALUE) public ResponseEntity<Map<String, Object>> errorPage500Api(HttpServletRequest request, HttpServletResponse response) { log.info("API errorPage 500"); Map<String, Object> result = new HashMap<>(); Exception ex = (Exception) request.getAttribute(ERROR_EXCEPTION); result.put("status", request.getAttribute(ERROR_STATUS_CODE)); result.put("message", ex.getMessage()); Integer statusCode = (Integer) request.getAttribute(RequestDispatcher.ERROR_STATUS_CODE); return new ResponseEntity(result, HttpStatus.valueOf(statusCode)); }

{ "message": "잘못된 사용자", "status": 500 }

@RequestMapping(produces = MediaType.TEXT_HTML_VALUE) public ModelAndView errorHtml(HttpServletRequest request, HttpServletResponse response) {} @RequestMapping public ResponseEntity<Map<String, Object>> error(HttpServletRequest request) {}

{ "timestamp": "2021-04-28T00:00:00.000+00:00", "status": 500, "error": "Internal Server Error", "exception": "java.lang.RuntimeException", "trace": "java.lang.RuntimeException: 잘못된 사용자\n\tat hello.exception.web.api.ApiExceptionController.getMember(ApiExceptionController. java:19..., "message": "잘못된 사용자", "path": "/api/members/ex" }

server: error: include-exception: false # exception 포함 여부 include-message: always # message 포함 여부 include-stacktrace: never # trace 포함 여부 include-binding-errors: on_param # errors 포함 여부 # never : 사용하지 않음 # always : 항상 사용 # on_param : 이름이 동일한 쿼리 파라미터가 있을 때 사용

public interface HandlerExcpetionResolver { ModelAndView resolveException( HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex); }

@Slf4j public class MyHandlerExceptionResolver implements HandlerExceptionResolver { @Override public ModelAndView resolveException(HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex) { try { if (ex instanceof IllegalArgumentException) { log.info("IllegalArgumentException resolver to 400"); response.sendError(HttpServletResponse.SC_BAD_REQUEST, ex.getMessage()); return new ModelAndView(); } } catch (IOException e) { log.error("resolver ex", e); } return null; } }

@Override public void extendHandlerExceptionResolvers( List<HandlerExceptionResolver> resolvers) { resolvers.add(new MyHandlerExceptionResolver()); }

@Slf4j public class UserHandlerExceptionResolver implements HandlerExceptionResolver { private final ObjectMapper objectMapper = new ObjectMapper(); @Override public ModelAndView resolveException(HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex) { try { if (ex instanceof UserException) { log.info("UserException resolver to 400"); String acceptHeader = request.getHeader("accept"); response.setStatus(HttpServletResponse.SC_BAD_REQUEST); if (acceptHeader.equals("application/json")) { Map<String, Object> errorResult = new HashMap<>(); errorResult.put("ex", ex.getClass()); errorResult.put("message", ex.getMessage()); String result = objectMapper.writeValueAsString(errorResult); response.setContentType("application/json"); response.setCharacterEncoding("utf-8"); response.getWriter().write(result); return new ModelAndView(); } else { // TEXT/HTML return new ModelAndView("error/400"); } } } catch (IOException e) { log.error("resolver ex", e); } return null; } }

@Override public void extendHandlerExceptionResolvers(List<HandlerExceptionResolver> resolvers) { resolvers.add(new MyHandlerExceptionResolver()); resolvers.add(new UserHandlerExceptionResolver()); }

{ "ex": "hello.exception.exception.UserException", "message": "사용자 오류", }

@Data @AllArgsConstructor public class ErrorResult { private String code; private String message; }

@Slf4j @RestController public class ApiExceptionV2Controller { @ResponseStatus(HttpStatus.BAD_REQUEST) @ExceptionHandler(IllegalArgumentException.class) public ErrorResult illegalExHandle(IllegalArgumentException e) { log.error("[exceptionHandle] ex", e); return new ErrorResult("BAD", e.getMessage()); } @ExceptionHandler public ResponseEntity<ErrorResult> userExHandle(UserException e) { log.error("[exceptionHandle] ex", e); ErrorResult errorResult = new ErrorResult("USER-EX", e.getMessage()); return new ResponseEntity<>(errorResult, HttpStatus.BAD_REQUEST); } @ResponseStatus(HttpStatus.INTERNAL_SERVER_ERROR) @ExceptionHandler public ErrorResult exHandle(Exception e) { log.error("[exceptionHandle] ex", e); return new ErrorResult("EX", "내부 오류"); } ... }

{ "code": "BAD", "message": "잘못된 입력 값" }

@ExceptionHandler(부모예외.class) public String 부모예외처리()(부모예외 e) {} @ExceptionHandler(자식예외.class) public String 자식예외처리()(자식예외 e) {}

@ExceptionHandler({AException.class, BException.class}) public String ex(Exception e) { log.info("exception e", e); }

@ExceptionHandler public ResponseEntity<ErrorResult> userExHandle(UserException e) {}

@Slf4j @RestControllerAdvice public class ExControllerAdvice { @ResponseStatus(HttpStatus.BAD_REQUEST) @ExceptionHandler(IllegalArgumentException.class) public ErrorResult illegalExHandle(IllegalArgumentException e) { log.error("[exceptionHandle] ex", e); return new ErrorResult("BAD", e.getMessage()); } @ExceptionHandler public ResponseEntity<ErrorResult> userExHandle(UserException e) { log.error("[exceptionHandle] ex", e); ErrorResult errorResult = new ErrorResult("USER-EX", e.getMessage()); return new ResponseEntity<>(errorResult, HttpStatus.BAD_REQUEST); } @ResponseStatus(HttpStatus.INTERNAL_SERVER_ERROR) @ExceptionHandler public ErrorResult exHandle(Exception e) { log.error("[exceptionHandle] ex", e); return new ErrorResult("EX", "내부 오류"); } }

// Target all Controllers annotated with @RestController @ControllerAdvice(annotations = RestController.class) public class ExampleAdvice1 {} // Target all Controllers within specific packages @ControllerAdvice("org.example.controllers") public class ExampleAdvice2 {} // Target all Controllers assignable to specific classes @ControllerAdvice(assignableTypes = {ControllerInterface.class, AbstractController.class}) public class ExampleAdvice3 {}

@ResponseStatus(code = HttpStatus.BAD_REQUEST, reason = "잘못된 요청 오류") public class BadRequestException extends RuntimeException { }

@ResponseStatus(code = HttpStatus.BAD_REQUEST, reason = "error.bad") public class BadRequestException extends RuntimeException { }

error.bad=잘못된 요청 오류입니다.

@GetMapping("/api/response-status-ex2") public String responseStatusEx2() { throw new ResponseStatusException(HttpStatus.NOT_FOUND, "error.bad", new IllegalArgumentException()); }