fix: 정상테스트 api를 JwtFilter에서 permit

[ParkJiYeoung8297]

fix: 정상테스트 api를 springSecurity에서 permit

Summary

정상테스트 api를 springSecurity에서 permit

Changes

Type of Change

• Bug fix (기존 기능에 영향을 주지 않는 버그 수정)
• New feature (기존 기능에 영향을 주지 않는 새로운 기능 추가)
• Breaking change (기존 기능에 영향을 주는 수정)
• Refactoring (기능 변경 없는 코드 개선)
• Documentation (문서 수정)
• Chore (빌드, 설정 등 기타 변경)
• Release (develop → main 배포)

Related Issues

참고 사항

해당 api는 서버와 정상 통신여부를 확인하기 위한 api로 권한 검증이 없어야합니다.

[gemini-code-assist]

Summary of Changes

Hello @ParkJiYeoung8297, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

이 PR은 Spring Security 설정에서 특정 테스트 API 엔드포인트에 대한 접근을 허용하여, 인증 없이 해당 API를 호출할 수 있도록 합니다. 이는 개발 및 테스트 과정에서 인증 토큰 없이도 특정 기능을 쉽게 검증할 수 있도록 지원하는 것을 목적으로 합니다.

Highlights

• 인증 우회 경로 추가: /api/test 엔드포인트가 JWT 인증 필터를 우회하도록 PERMIT_ALL_PATTERNS 목록에 추가되었습니다.

Changelog

• src/main/java/com/example/RealMatch/global/config/jwt/JwtAuthenticationFilter.java
  • /api/test 경로를 PERMIT_ALL_PATTERNS에 추가하여 JWT 인증 필터를 거치지 않도록 변경

Activity

• 현재까지 사람의 활동은 없습니다.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request adds /api/test to the JWT authentication exception list to ensure API functionality. However, a critical vulnerability has been identified: the JwtAuthenticationFilter uses an insecure startsWith path matching. This, combined with the new /api/test exclusion, inadvertently causes 401 Unauthorized errors for legitimate authenticated requests to endpoints like /api/test-auth. Furthermore, the JwtAuthenticationFilter's exception path list and SecurityConfig's permitAll list are duplicated and inconsistent, which could lead to future bugs. It is highly recommended to refactor the security configuration to manage these settings in a single, consistent location.

[gemini-code-assist]

The addition of "/api/test" to EXCLUDED_PATHS combined with the startsWith matching logic in the shouldNotFilter method (line 113) creates a security vulnerability. This causes the JWT authentication filter to be skipped for any request URI starting with "/api/test", inadvertently including the protected /api/test-auth endpoint. Consequently, legitimate authenticated requests to /api/test-auth receive a 401 Unauthorized error, breaking access to protected test endpoints. This also highlights a broader maintainability issue: the EXCLUDED_PATHS list duplicates and is inconsistent with SecurityConfig's PERMIT_ALL_URL_ARRAY. For example, paths like /api/v1/tags/** and /api/v1/auth/signup are permitAll in SecurityConfig but are missing from EXCLUDED_PATHS, potentially leading to incorrect JWT authentication requirements. It is strongly recommended to use a more precise matching mechanism, such as equals() for exact matches or Spring's AntPathMatcher for pattern matching, to ensure only intended paths are excluded. For a more robust solution, consider refactoring to manage all security configurations in a single place, perhaps using WebSecurityCustomizer in SecurityConfig to completely bypass the filter chain for ignored paths, making EXCLUDED_PATHS unnecessary.