여러 프론트엔드로 로그인 리다이렉트 시켜주기 :OAuth Origin 화이트리스트 설계

@ConfigurationProperties(prefix = "oauth")
public record OAuthProperties(
        String redirectUri,
        List<String> allowedFrontendOrigins
) {
    public OAuthProperties {
        redirectUri = normalizeRedirectUri(redirectUri);
        String defaultFrontendOrigin = extractOrigin(redirectUri);

        allowedFrontendOrigins = allowedFrontendOrigins == null
                ? List.of(defaultFrontendOrigin)
                : allowedFrontendOrigins.stream()
                        .map(OAuthProperties::normalizeOrigin)
                        .distinct()
                        .toList();

        if (!allowedFrontendOrigins.contains(defaultFrontendOrigin)) {
            throw new IllegalArgumentException(
                    "OAuth 기본 리다이렉트 Origin은 허용된 프론트 Origin에 포함되어야 합니다."
            );
        }
    }

    public String requireAllowedFrontendOrigin(String origin) {
        String normalizedOrigin = normalizeOrigin(origin);
        if (!allowedFrontendOrigins.contains(normalizedOrigin)) {
            throw new IllegalArgumentException("허용되지 않은 OAuth 프론트 Origin입니다.");
        }
        return normalizedOrigin;
    }
}

public void saveRequestedOrigin(HttpServletRequest request, HttpServletResponse response, String state) {
    String allowedOrigin = validateRequestedOrigin(request); // ?frontendOrigin= 쿼리파라미터 검증
    String payload = state + "\n" + allowedOrigin; // state와 origin을 묶어서 저장
    String encodedPayload = Base64.getUrlEncoder().withoutPadding().encodeToString(payload.getBytes(UTF_8));
    authCookieUtil.setCookie(response, COOKIE_NAME, encodedPayload, COOKIE_MAX_AGE); // 3분
}

public String consumeRedirectUri(HttpServletRequest request, HttpServletResponse response) {
    try {
        String encodedPayload = authCookieUtil.getCookieValue(request, COOKIE_NAME);
        String callbackState = request.getParameter("state");
        String payload = new String(Base64.getUrlDecoder().decode(encodedPayload), UTF_8);
        String savedState = payload.substring(0, payload.indexOf("\n"));

        // 타이밍 공격 방지를 위해 MessageDigest.isEqual로 비교
        if (!MessageDigest.isEqual(savedState.getBytes(UTF_8), callbackState.getBytes(UTF_8))) {
            return defaultRedirectUri();
        }
        String frontendOrigin = payload.substring(payload.indexOf("\n") + 1);
        return oAuthProperties.redirectUriFor(frontendOrigin);
    } catch (IllegalArgumentException exception) {
        return defaultRedirectUri(); // 파싱 실패 시 안전하게 기본값으로 폴백
    } finally {
        clearCookie(response);
    }
}

protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
        throws ServletException, IOException {
    try {
        redirectCookieRepository.validateRequestedOrigin(request);
    } catch (IllegalArgumentException exception) {
        redirectCookieRepository.clearCookie(response);
        response.sendError(HttpServletResponse.SC_BAD_REQUEST, "허용되지 않은 OAuth 프론트 Origin입니다.");
        return;
    }
    filterChain.doFilter(request, response);
}

// Before
@Value("${oauth.redirect-uri}")
private String redirectUri;

// After
String redirectUri = redirectCookieRepository.consumeRedirectUri(request, response);
String redirectUrl = UriComponentsBuilder.fromUriString(redirectUri)
        .queryParam("isNewUser", isNewUser)
        .build()
        .toUriString();
response.sendRedirect(redirectUrl);

// 프론트 로그인 링크도 함께 수정해야 동작한다
// Before
href={`${API_BASE_URL}/oauth/authorization/kakao`}

// After
href={`${API_BASE_URL}/oauth/authorization/kakao?frontendOrigin=${encodeURIComponent(APP_ORIGIN)}`}