스프링 시큐리티 공식 레퍼런스를 한글로 번역한 문서입니다.

버전은 5.3.2.RELEASE 기준입니다.

---

Ben Alex, Luke Taylor, Rob Winch, Gunnar Hillert, Joe Grandja, Jay Bryant, Eddú Meléndez, Josh Cummings, Dave Syer - Version 5.3.2.RELEASE

---

스프링 시큐리티는 인증, 인가를 지원하고 주요 공격으로부터 어플리케이션을 보호해주는 프레임워크다. 명령형과 리액티브 어플리케이션 모두에서 가장 잘 동작하는, 사실상 스프링 기반 어플리케이션의 표준 보안 프레임워크다.

---

목차:

1. Prerequisites
2. Spring Security Community
   • 2.1. Getting Help
   • 2.2. Becoming Involved
   • 2.3. Source Code
   • 2.4. Apache 2 License
   • 2.5. Social Media
3. What’s New in Spring Security 5.3
   • 3.1. Documentation Updates
   • 3.2. Servlet
   • 3.3. WebFlux
   • 3.4. RSocket
   • 3.5. Additional Updates
   • 3.6. Build Changes
4. Getting Spring Security
   • 4.1. Release Numbering
   • 4.2. Usage with Maven
     • 4.2.1. Spring Boot with Maven
     • 4.2.2. Maven Without Spring Boot
     • 4.2.3. Maven Repositories
   • 4.3. Gradle
     • 4.3.1. Spring Boot with Gradle
     • 4.3.2. Gradle Without Spring Boot
     • 4.3.3. Gradle Repositories
5. Features
   • 5.1. Authentication
     • 5.1.1. Authentication Support
     • 5.1.2. Password Storage
   • 5.2. Protection Against Exploits
     • 5.2.1. Cross Site Request Forgery (CSRF)
     • 5.2.2. Security HTTP Response Headers
     • 5.2.3. HTTP
6. Project Modules
   • 6.1. Core — spring-security-core.jar
   • 6.2. Remoting — spring-security-remoting.jar
   • 6.3. Web — spring-security-web.jar
   • 6.4. Config — spring-security-config.jar
   • 6.5. LDAP — spring-security-ldap.jar
   • 6.6. OAuth 2.0 Core — spring-security-oauth2-core.jar
   • 6.7. OAuth 2.0 Client — spring-security-oauth2-client.jar
   • 6.8. OAuth 2.0 JOSE — spring-security-oauth2-jose.jar
   • 6.9. OAuth 2.0 Resource Server — spring-security-oauth2-resource-server.jar
   • 6.10. ACL — spring-security-acl.jar
   • 6.11. CAS — spring-security-cas.jar
   • 6.12. OpenID — spring-security-openid.jar
   • 6.13. Test — spring-security-test.jar
7. Samples
8. Hello Spring Security
   • 8.1. Updating Dependencies
   • 8.2. Starting Hello Spring Security Boot
   • 8.3. Spring Boot Auto Configuration
9. Servlet Security: The Big Picture
   • 9.1. A Review of Filters
   • 9.2. DelegatingFilterProxy
   • 9.3. FilterChainProxy
   • 9.4. SecurityFilterChain
   • 9.5. Security Filters
   • 9.6. Handling Security Exceptions
10. Authentication
    • 10.1. SecurityContextHolder
    • 10.2. SecurityContext
    • 10.3. Authentication
    • 10.4. GrantedAuthority
    • 10.5. AuthenticationManager
    • 10.6. ProviderManager
    • 10.7. AuthenticationProvider
    • 10.8. Request Credentials with AuthenticationEntryPoint
    • 10.9. AbstractAuthenticationProcessingFilter
    • 10.10. Username/Password Authentication
      • 10.10.1. Form Login
      • 10.10.2. Basic Authentication
      • 10.10.3. Digest Authentication
      • 10.10.4. In-Memory Authentication
      • 10.10.5. JDBC Authentication
      • 10.10.6. UserDetails
      • 10.10.7. UserDetailsService
      • 10.10.8. PasswordEncoder
      • 10.10.9. DaoAuthenticationProvider
      • 10.10.10. LDAP Authentication
    • 10.11. Session Management
      • 10.11.1. Detecting Timeouts
      • 10.11.2. Concurrent Session Control
      • 10.11.3. Session Fixation Attack Protection
      • 10.11.4. SessionManagementFilter
      • 10.11.5. SessionAuthenticationStrategy
      • 10.11.6. Concurrency Control
    • 10.12. Remember-Me Authentication
      • 10.12.1. Overview
      • 10.12.2. Simple Hash-Based Token Approach
      • 10.12.3. Persistent Token Approach
      • 10.12.4. Remember-Me Interfaces and Implementations
    • 10.13. OpenID Support
      • 10.13.1. Attribute Exchange
    • 10.14. Anonymous Authentication
      • 10.14.1. Overview
      • 10.14.2. Configuration
      • 10.14.3. AuthenticationTrustResolver
    • 10.15. Pre-Authentication Scenarios
      • 10.15.1. Pre-Authentication Framework Classes
      • 10.15.2. Concrete Implementations
    • 10.16. Java Authentication and Authorization Service (JAAS) Provider
      • 10.16.1. Overview
      • 10.16.2. AbstractJaasAuthenticationProvider
      • 10.16.3. DefaultJaasAuthenticationProvider
      • 10.16.4. JaasAuthenticationProvider
      • 10.16.5. Running as a Subject
    • 10.17. CAS Authentication
      • 10.17.1. Overview
      • 10.17.2. How CAS Works
      • 10.17.3. Configuration of CAS Client
    • 10.18. X.509 Authentication
      • 10.18.1. Overview
      • 10.18.2. Adding X.509 Authentication to Your Web Application
      • 10.18.3. Setting up SSL in Tomcat
    • 10.19. Run-As Authentication Replacement
      • 10.19.1. Overview
      • 10.19.2. Configuration
    • 10.20. Handling Logouts
      • 10.20.1. Logout Java Configuration
      • 10.20.2. Logout XML Configuration
      • 10.20.3. LogoutHandler
      • 10.20.4. LogoutSuccessHandler
      • 10.20.5. Further Logout-Related References
    • 10.21. Authentication Events
      • 10.21.1. Adding Exception Mappings
      • 10.21.2. Default Event
11. Authorization
    • 11.1. Authorization Architecture
      • 11.1.1. Authorities
      • 11.1.2. Pre-Invocation Handling
      • 11.1.3. After Invocation Handling
      • 11.1.4. Hierarchical Roles
    • 11.2. Authorize HttpServletRequest with FilterSecurityInterceptor
    • 11.3. Expression-Based Access Control
      • 11.3.1. Overview
      • 11.3.2. Web Security Expressions
      • 11.3.3. Method Security Expressions
    • 11.4. Secure Object Implementations
      • 11.4.1. AOP Alliance (MethodInvocation) Security Interceptor
      • 11.4.2. AspectJ (JoinPoint) Security Interceptor
    • 11.5. Method Security
      • 11.5.1. EnableGlobalMethodSecurity
      • 11.5.2. GlobalMethodSecurityConfiguration
      • 11.5.3. The <global-method-security> Element
      • 11.5.4. Adding Security Pointcuts using protect-pointcut
    • 11.6. Domain Object Security (ACLs)
      • 11.6.1. Overview
      • 11.6.2. Key Concepts
      • 11.6.3. Getting Started
12. OAuth2
    • 12.1. OAuth 2.0 Login
      • 12.1.1. Spring Boot 2.x Sample
      • 12.1.2. Spring Boot 2.x Property Mappings
      • 12.1.3. CommonOAuth2Provider
      • 12.1.4. Configuring Custom Provider Properties
      • 12.1.5. Overriding Spring Boot 2.x Auto-configuration
      • 12.1.6. Java Configuration without Spring Boot 2.x
      • 12.1.7. Advanced Configuration
    • 12.2. OAuth 2.0 Client
      • 12.2.1. Core Interfaces / Classes
      • 12.2.2. Authorization Grant Support
      • 12.2.3. Additional Features
      • 12.2.4. WebClient integration for Servlet Environments
    • 12.3. OAuth 2.0 Resource Server
      • 12.3.1. Dependencies
      • 12.3.2. Minimal Configuration for JWTs
      • 12.3.3. Specifying the Authorization Server JWK Set Uri Directly
      • 12.3.4. Overriding or Replacing Boot Auto Configuration
      • 12.3.5. Configuring Trusted Algorithms
      • 12.3.6. Trusting a Single Asymmetric Key
      • 12.3.7. Trusting a Single Symmetric Key
      • 12.3.8. Configuring Authorization
      • 12.3.9. Configuring Validation
      • 12.3.10. Configuring Claim Set Mapping
      • 12.3.11. Configuring Timeouts
      • 12.3.12. Minimal Configuration for Introspection
      • 12.3.13. Looking Up Attributes Post-Authentication
      • 12.3.14. Overriding or Replacing Boot Auto Configuration
      • 12.3.15. Configuring Authorization
      • 12.3.16. Configuring Timeouts
      • 12.3.17. Using Introspection with JWTs
      • 12.3.18. Calling a /userinfo Endpoint
      • 12.3.19. Supporting both JWT and Opaque Token
      • 12.3.20. Multi-tenancy
      • 12.3.21. Bearer Token Resolution
      • 12.3.22. Bearer Token Propagation
      • 12.3.23. Bearer Token Failure
13. SAML2
    • 13.1. SAML 2.0 Login
      • 13.1.1. SAML 2 Support in Spring Security
      • 13.1.2. Saml 2 Login - High Level Concepts
      • 13.1.3. Saml 2 Login - Current Feature Set
      • 13.1.4. Saml 2 Login - Introduction to Java Configuration
      • 13.1.5. Customizing Authentication Logic
      • 13.1.6. Spring Boot 2.x Sample
14. Protection Against Exploits
    • 14.1. Cross Site Request Forgery (CSRF) for Servlet Environments
      • 14.1.1. Using Spring Security CSRF Protection
      • 14.1.2. CSRF Considerations
    • 14.2. Security HTTP Response Headers
      • 14.2.1. Default Security Headers
      • 14.2.2. Cache Control
      • 14.2.3. Content Type Options
      • 14.2.4. HTTP Strict Transport Security (HSTS)
      • 14.2.5. HTTP Public Key Pinning (HPKP)
      • 14.2.6. X-Frame-Options
      • 14.2.7. X-XSS-Protection
      • 14.2.8. Content Security Policy (CSP)
      • 14.2.9. Referrer Policy
      • 14.2.10. Feature Policy
      • 14.2.11. Clear Site Data
      • 14.2.12. Custom Headers
    • 14.3. HTTP
      • 14.3.1. Redirect to HTTPS
      • 14.3.2. Strict Transport Security
      • 14.3.3. Proxy Server Configuration
    • 14.4. HttpFirewall
15. Integrations
    • 15.1. Servlet API integration
      • 15.1.1. Servlet 2.5+ Integration
      • 15.1.2. Servlet 3+ Integration
      • 15.1.3. Servlet 3.1+ Integration
    • 15.2. Spring Data Integration
      • 15.2.1. Spring Data & Spring Security Configuration
      • 15.2.2. Security Expressions within @Query
    • 15.3. Concurrency Support
      • 15.3.1. DelegatingSecurityContextRunnable
      • 15.3.2. DelegatingSecurityContextExecutor
      • 15.3.3. Spring Security Concurrency Classes
    • 15.4. Jackson Support
    • 15.5. Localization
    • 15.6. Spring MVC Integration
      • 15.6.1. @EnableWebMvcSecurity
      • 15.6.2. MvcRequestMatcher
      • 15.6.3. @AuthenticationPrincipal
      • 15.6.4. Spring MVC Async Integration
      • 15.6.5. Spring MVC and CSRF Integration
    • 15.7. WebSocket Security
      • 15.7.1. WebSocket Configuration
      • 15.7.2. WebSocket Authentication
      • 15.7.3. WebSocket Authorization
      • 15.7.4. Enforcing Same Origin Policy
      • 15.7.5. Working with SockJS
    • 15.8. CORS
    • 15.9. JSP Tag Libraries
      • 15.9.1. Declaring the Taglib
      • 15.9.2. The authorize Tag
      • 15.9.3. The authentication Tag
      • 15.9.4. The accesscontrollist Tag
      • 15.9.5. The csrfInput Tag
      • 15.9.6. The csrfMetaTags Tag
16. Java Configuration
    • 16.1. Hello Web Security Java Configuration
      • 16.1.1. AbstractSecurityWebApplicationInitializer
      • 16.1.2. AbstractSecurityWebApplicationInitializer without Existing Spring
      • 16.1.3. AbstractSecurityWebApplicationInitializer with Spring MVC
    • 16.2. HttpSecurity
    • 16.3. Multiple HttpSecurity
    • 16.4. Custom DSLs
    • 16.5. Post Processing Configured Objects
17. Kotlin Configuration
    • 17.1. HttpSecurity
    • 17.2. Multiple HttpSecurity
18. Security Namespace Configuration
    • 18.1. Introduction
      • 18.1.1. Design of the Namespace
    • 18.2. Getting Started with Security Namespace Configuration
      • 18.2.1. web.xml Configuration
      • 18.2.2. A Minimal <http> Configuration
    • 18.3. Advanced Web Features
      • 18.3.1. Adding in Your Own Filters
    • 18.4. Method Security
    • 18.5. The Default AccessDecisionManager
      • 18.5.1. Customizing the AccessDecisionManager
19. Testing
    • 19.1. Testing Method Security
      • 19.1.1. Security Test Setup
      • 19.1.2. @WithMockUser
      • 19.1.3. @WithAnonymousUser
      • 19.1.4. @WithUserDetails
      • 19.1.5. @WithSecurityContext
      • 19.1.6. Test Meta Annotations
    • 19.2. Spring MVC Test Integration
      • 19.2.1. Setting Up MockMvc and Spring Security
      • 19.2.2. SecurityMockMvcRequestPostProcessors
      • 19.2.3. SecurityMockMvcRequestBuilders
      • 19.2.4. SecurityMockMvcResultMatchers
20. Spring Security Crypto Module
    • 20.1. Introduction
    • 20.2. Encryptors
      • 20.2.1. BytesEncryptor
      • 20.2.2. TextEncryptor
    • 20.3. Key Generators
      • 20.3.1. BytesKeyGenerator
      • 20.3.2. StringKeyGenerator
    • 20.4. Password Encoding
21. Appendix
22. Security Database Schema
    • 22.1. User Schema
      • 22.1.1. For Oracle database
      • 22.1.2. Group Authorities
    • 22.2. Persistent Login (Remember-Me) Schema
    • 22.3. ACL Schema
      • 22.3.1. HyperSQL
      • 22.3.2. PostgreSQL
      • 22.3.3. MySQL and MariaDB
      • 22.3.4. Microsoft SQL Server
      • 22.3.5. Oracle Database
    • 22.4. OAuth 2.0 Client Schema
    • 22.5. The Security Namespace
      • 22.5.1. Web Application Security
      • 22.5.2. WebSocket Security
      • 22.5.3. Authentication Services
      • 22.5.4. Method Security
      • 22.5.5. LDAP Namespace Options
    • 22.6. Spring Security Dependencies
      • 22.6.1. spring-security-core
      • 22.6.2. spring-security-remoting
      • 22.6.3. spring-security-web
      • 22.6.4. spring-security-ldap
      • 22.6.5. spring-security-config
      • 22.6.6. spring-security-acl
      • 22.6.7. spring-security-cas
      • 22.6.8. spring-security-openid
      • 22.6.9. spring-security-taglibs
    • 22.7. Spring Security FAQ
      • 22.7.1. General Questions
      • 22.7.2. Common Problems
      • 22.7.3. Spring Security Architecture Questions
      • 22.7.4. Common “Howto” Requests
23. WebFlux Security
    • 23.1. Minimal WebFlux Security Configuration
    • 23.2. Explicit WebFlux Security Configuration
24. Protection Against Exploits
    • 24.1. Cross Site Request Forgery (CSRF) for WebFlux Environments
      • 24.1.1. Using Spring Security CSRF Protection
      • 24.1.2. CSRF Considerations
    • 24.2. Security HTTP Response Headers
      • 24.2.1. Default Security Headers
      • 24.2.2. Cache Control
      • 24.2.3. Content Type Options
      • 24.2.4. HTTP Strict Transport Security (HSTS)
      • 24.2.5. X-Frame-Options
      • 24.2.6. X-XSS-Protection
      • 24.2.7. Content Security Policy (CSP)
      • 24.2.8. Referrer Policy
      • 24.2.9. Feature Policy
      • 24.2.10. Clear Site Data
    • 24.3. HTTP
      • 24.3.1. Redirect to HTTPS
      • 24.3.2. Strict Transport Security
      • 24.3.3. Proxy Server Configuration
25. OAuth2 WebFlux
    • 25.1. OAuth 2.0 Login
      • 25.1.1. Spring Boot 2.0 Sample
      • 25.1.2. Using OpenID Provider Configuration
      • 25.1.3. Explicit OAuth2 Login Configuration
    • 25.2. OAuth2 Client
    • 25.3. OAuth 2.0 Resource Server
      • 25.3.1. Dependencies
      • 25.3.2. Minimal Configuration for JWTs
      • 25.3.3. Configuring Trusted Algorithms
      • 25.3.4. Multi-tenancy
      • 25.3.5. Bearer Token Propagation
26. @RegisteredOAuth2AuthorizedClient
27. Reactive X.509 Authentication
28. WebClient
    • 28.1. WebClient OAuth2 Setup
    • 28.2. Implicit OAuth2AuthorizedClient
    • 28.3. Explicit OAuth2AuthorizedClient
    • 28.4. clientRegistrationId
29. EnableReactiveMethodSecurity
30. Reactive Test Support
    • 30.1. Testing Reactive Method Security
    • 30.2. WebTestClientSupport
      • 30.2.1. Authentication
      • 30.2.2. CSRF Support
      • 30.2.3. Testing OAuth 2.0
      • 30.2.4. Testing OIDC Login
      • 30.2.5. Testing OAuth 2.0 Login
      • 30.2.6. Testing OAuth 2.0 Clients
      • 30.2.7. Testing JWT Authentication
      • 30.2.8. Testing Opaque Token Authentication
31. RSocket Security
    • 31.1. Minimal RSocket Security Configuration
    • 31.2. Adding SecuritySocketAcceptorInterceptor
    • 31.3. RSocket Authentication
      • 31.3.1. Authentication at Setup vs Request Time
      • 31.3.2. Simple Authentication
      • 31.3.3. JWT
    • 31.4. RSocket Authorization

---

Next :

Prerequisites
스프링 시큐리티에서 요구하는 환경을 설명합니다. 공식 문서에 있는 "prerequisites" 챕터를 한글로 번역한 문서입니다.