잘못된 접근 제한(사용자의 행동 기록)

사용자의 행동 기록

1. 사용자가 메뉴를 사용할 때 모든 행위는 기록되어야 한다.

• 아이디
• 시간
• 접근한 IP
• 접근한 Menu
• 실행한 Action(CRUD)

2. 권한이 없는 사용자는 그 메뉴자체를 보여주지 않아야 한다.
삭제에 대한 권한이 없는 사용자에게 삭제 버튼을 보여주어서는 안된다.
URL을 통한 접근을 시도할 때, 현재 요청자가 그 기능에 대한 권한이 있는지 체크하고 없다면 서비스를 거부해야한다.

 

1. 사용자의 행동을 Console창에 log로 보여주기(실무에서는 DB에 저장 함).

ActionHistoryInterceptor class 생성

package kr.co.hucloud.security.code.example.common.interceptor;
 
import java.util.Date;
 
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;
 
import kr.co.hucloud.security.code.example.common.Session;
import kr.co.hucloud.security.code.example.member.vo.MemberVO;
 
import org.springframework.web.servlet.handler.HandlerInterceptorAdapter;
 
public class ActionHistoryInterceptor extends HandlerInterceptorAdapter {
 
    // 컨트롤러 실행 전
    @Override
    public boolean preHandle(HttpServletRequest request,
            HttpServletResponse response, Object handler) throws Exception {
    /*
        아이디 - 로그인 하지 않았다면 공백
        시간 - Date 객체 사용
        접근한 IP 
        접근한 Menu - URL로 대체
        실행한 Action(CRUD) - Method로 대체
    */
        String userId = gerUserId(request);
        String dateTime = new Date().toString();
        String userIp = request.getRemoteAddr();
        // uri - 앞에 host가 빠져있음 (http://localhost:8080)
        String accessUrl = request.getRequestURI();
        String action = getAction(handler);
        
        String logMessage = String.format("%s, %s, %s, %s, %s",userId, dateTime, userIp, accessUrl, action);
        
        System.out.println(logMessage);
        
        return super.preHandle(request, response, handler);
    }
 
    private String gerUserId(HttpServletRequest request) {
        
        HttpSession session = request.getSession();
        
        MemberVO memberVO = (MemberVO)session.getAttribute(Session.MEMBER);
        
        if(memberVO == null){
            return "";
        }
        
        return memberVO.getId();
        
    }
 
    private String getAction(Object handler) {
        
        String classMethod = handler.toString();
        String[] splitMethod = classMethod.split("\\.");
        int size = splitMethod.length;
        
        return splitMethod[size-1];
    }
}
 

dispatcherServlet.xml 에 historyInterceptor bean 추가

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns:mvc="http://www.springframework.org/schema/mvc"
    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
        http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc-4.1.xsd">
 
    <mvc:annotation-driven />
 
    <bean id="viewResolver"
        class="org.springframework.web.servlet.view.InternalResourceViewResolver">
        <property name="prefix" value="/WEB-INF/view/" />
        <property name="suffix" value=".jsp" />
    </bean>
    
    <mvc:resources mapping="/resources/**" location="/WEB-INF/resources/" />
    
    <mvc:interceptors>
        <mvc:interceptor>
            <mvc:mapping path="/**" />
            <mvc:exclude-mapping path="/"/>
            <mvc:exclude-mapping path="/common/top"/>
            <mvc:exclude-mapping path="/common/bottom"/>
            <mvc:exclude-mapping path="/common/menu"/>
            <mvc:exclude-mapping path="/resources/**"/>
            <mvc:exclude-mapping path="/member/login"/>
            <mvc:exclude-mapping path="/member/registry"/>
            <bean id="loginInterceptor" class="kr.co.hucloud.security.code.example.common.interceptor.LoginInterceptor" />
        </mvc:interceptor>
        
            <!-- 잘못된 접근 제한   -->
            <bean id="historyInterceptor" class="kr.co.hucloud.security.code.example.common.interceptor.ActionHistoryInterceptor"/>
 
    </mvc:interceptors>    
    <!--<mvc:interceptors>
        <mvc:interceptor>
            <mvc:mapping path="/**" />
            <mvc:exclude-mapping path="/member/login"/>
            <mvc:exclude-mapping path="/member/registry"/>
            <mvc:exclude-mapping path="/member/logout"/>
            <bean id="csrfInterceptor" class="kr.co.hucloud.security.code.example.common.interceptor.CSRFInterceptor" />
        </mvc:interceptor>
    </mvc:interceptors> -->
    
    <bean id="multipartResolver"
          class="org.springframework.web.multipart.commons.CommonsMultipartResolver" >
        <property name="maxUploadSize" value="104857600" /> <!-- 100MB -->
        <property name="defaultEncoding" value="UTF-8" />
    </bean>
    
    <!-- Controllers -->
    <bean id="commonController" class="kr.co.hucloud.security.code.example.common.web.CommonController" />
    
    <bean id="indexController"  class="kr.co.hucloud.security.code.example.index.web.IndexController">
           <property name="tableValidService" ref="tableValidService" />
    </bean>
    <bean id="tableController"  class="kr.co.hucloud.security.code.example.valid.table.web.TableController">
           <property name="tableValidService" ref="tableValidService" />
    </bean>
    <bean id="memberController"  class="kr.co.hucloud.security.code.example.member.web.MemberController">
        <property name="memberService" ref="memberService" />
    </bean>
    <bean id="boardController"     class="kr.co.hucloud.security.code.example.board.web.BoardController">
        <property name="boardService" ref="boardService" />
        <property name="replyService" ref="replyService" />
    </bean>
    <bean id="replyController"     class="kr.co.hucloud.security.code.example.reply.web.ReplyController">
        <property name="replyService" ref="replyService" />
    </bean>
    
    <bean id="sqlInjectionController"  class="kr.co.hucloud.security.code.example.attack.sql.injection.web.SQLInjectionController">
        <property name="memberService" ref="memberService" />
    </bean>
    <bean id="passwordController"  class="kr.co.hucloud.security.code.example.attack.check.password.web.PasswordController" />
    <bean id="xssController"  class="kr.co.hucloud.security.code.example.attack.xss.web.XSSController">
        <property name="boardService" ref="boardService" />
    </bean>
    <bean id="encryptoPasswordController" class="kr.co.hucloud.security.code.example.encrypto.password.web.EncryptoPasswordController">
        <property name="encryptoPasswordService" ref="encryptoPasswordService" />
    </bean>
    <bean id="openRedirectController" class="kr.co.hucloud.security.code.example.attack.openredirect.OpenRedirectController" />
    
</beans>