d15ffe3fce
- CSRF: CookieCsrfTokenRepository(이중제출 토큰) + SPA용 CsrfTokenRequestAttributeHandler,
CsrfCookieFilter로 XSRF-TOKEN 쿠키 강제 렌더. /api/auth/login·/api/public/** 는 예외.
프론트 api.ts가 변경요청에 X-XSRF-TOKEN 헤더 자동 주입.
- 세션쿠키 SameSite=Lax·HttpOnly, prod는 Secure=${ACS_COOKIE_SECURE:false}(HTTPS 시 활성).
- h2-console permitAll·frameOptions.sameOrigin을 spring.h2.console.enabled에 연동 → prod 자동 비노출.
- CORS allowed-origins를 acs.cors.allowed-origins 프로퍼티로 외부화(prod 기본 빈 값, nginx 동일출처).
- .env.example·docker-compose에 ACS_CORS_ALLOWED_ORIGINS·ACS_COOKIE_SECURE 추가.
검증: 빌드/테스트 통과, curl로 CSRF 차단(403)·토큰 통과(404)·로그인/공개 예외·dev h2-console 확인.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
27 lines
1.0 KiB
Plaintext
27 lines
1.0 KiB
Plaintext
# ACS (Access Control System) environment — copy to .env and edit
|
|
|
|
# Database
|
|
POSTGRES_USER=acs
|
|
POSTGRES_PASSWORD=change_me
|
|
POSTGRES_DB=acs
|
|
|
|
# Web (nginx) published port
|
|
WEB_PORT=80
|
|
|
|
# ===== Pass delivery (SMS/LMS) =====
|
|
# dev : no network — logs the message + writes the QR image to the outbox
|
|
# hanbank : sends an LMS with the public pass link via the in-house DMZ API
|
|
ACS_SMS_PROVIDER=dev
|
|
ACS_SMS_API_URL=http://210.104.132.59:8000
|
|
# URL the SMS link points to — MUST be reachable from the visitor's phone
|
|
# (the server's real address/domain, not localhost). e.g. https://acs.example.co.kr
|
|
ACS_PUBLIC_BASE_URL=http://localhost
|
|
|
|
# ===== Security =====
|
|
# CORS allowed origins (comma-separated). Leave EMPTY when web+API share one origin
|
|
# via nginx (default). Set only if the SPA is hosted on a different origin.
|
|
ACS_CORS_ALLOWED_ORIGINS=
|
|
# Set to true ONLY when the site is served over HTTPS — marks the session cookie Secure.
|
|
# Leaving it false over plain http keeps login working; true over http would break it.
|
|
ACS_COOKIE_SECURE=false
|