ERD

CORE 모듈

• domain
  • 공통의 entity 가 선언됨
• common
  • 공통의 서비스가 선언됨
    • security
    • utils

API 모듈

• kitten-api
  • 모루인형 생성 api 제공 모듈
• pay-api
  • 결제관련 제공 api 모듈

EC2 배포 설치

• IAM EC2 역할 할당 -> s3FullAccess
• 다음의 명령을 실행
• sudo apt update
• sudo apt install ruby-full
• sudo apt install wget
• cd /home/ubuntu
• wget https://aws-codedeploy-ap-northeast-2.s3.ap-northeast-2.amazonaws.com/latest/install
• chmod +x ./install
• sudo ./install auto > /tmp/logfile
• sudo service codedeploy-agent status
• sudo apt install openjdk-21-jdk
• sudo lsof -i :8080 # 포트 확인하기

트러블 슈팅

1. 로컬에서는 정상 api 호출되나 ec2 에서 호출시 302 /login redirect 되는 현상

• 커밋 : 13c3698
• 원인 : H2 콘솔 접근을 위해 설정한 스프링 시큐리티 설정이 원인
  • .headers(headersConfigurer -> headersConfigurer.frameOptions(HeadersConfigurer.FrameOptionsConfig::sameOrigin)) )
• 해당 옵션은 csrf 와 same origin 정책을 허용 시킴
• 하지만 csrf 가 허용되면 302 redirect 되는 현상이 발생함
• 따라서 해당 옵션 disabled 처리함
• 의문 .. 해당 옵션은 최초 설정 후 변경한게 없는데, 왜 EC2 에 올렸을시 발생하는가..
• 참고
  • https://velog.io/@kide77/Spring-Boot-3.x-Security-%EA%B8%B0%EB%B3%B8-%EC%84%A4%EC%A0%95-%EB%B0%8F-%EB%B3%80%ED%99%94

2. CORS 에러 설정

• nginx 설정을 다음과 같이 수정

##
# You should look at the following URL's in order to grasp a solid understanding
# of Nginx configuration files in order to fully unleash the power of Nginx.
# https://www.nginx.com/resources/wiki/start/
# https://www.nginx.com/resources/wiki/start/topics/tutorials/config_pitfalls/
# https://wiki.debian.org/Nginx/DirectoryStructure
#
# In most cases, administrators will remove this file from sites-enabled/ and
# leave it as reference inside of sites-available where it will continue to be
# updated by the nginx packaging team.
#
# This file will automatically load configuration files provided by other
# applications, such as Drupal or Wordpress. These applications will be made
# available underneath a path with that package name, such as /drupal8.
#
# Please see /usr/share/doc/nginx-doc/examples/ for more detailed examples.
##

# Default server configuration
#
server {
        listen 80 default_server;
        listen [::]:80 default_server;

        # SSL configuration
        #
        # listen 443 ssl default_server;
        # listen [::]:443 ssl default_server;
        #
        # Note: You should disable gzip for SSL traffic.
        # See: https://bugs.debian.org/773332
        #
        # Read up on ssl_ciphers to ensure a secure configuration.
        # See: https://bugs.debian.org/765782
        #
        # Self signed certs generated by the ssl-cert package
        # Don't use them in a production server!
        #
        # include snippets/snakeoil.conf;

        root /var/www/html;

        # Add index.php to the list if you are using PHP
        index index.html index.htm index.nginx-debian.html;

        server_name core-api.diykitten-backend.site;

        location / {
                if ($request_method = 'OPTIONS') {
                add_header 'Access-Control-Allow-Origin' 'http://localhost:3000';
                add_header 'Access-Control-Allow-Methods' 'GET, POST, DELETE, PATCH, OPTIONS';
                add_header 'Access-Control-Allow-Headers' 'Content-Type, Authorization';
                add_header 'Access-Control-Allow-Credentials' 'true';
                return 204;
            }

                proxy_set_header Host $host;
                proxy_pass http://localhost:8080;

            
                add_header 'Access-Control-Allow-Credentials' 'true';
                add_header 'Access-Control-Allow-Origin' '*' always;
                #add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range';
                proxy_http_version 1.1;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection "upgrade";
                proxy_set_header Origin "";
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        }

        # pass PHP scripts to FastCGI server
        #
        #location ~ \.php$ {
        #       include snippets/fastcgi-php.conf;
        #
        #       # With php-fpm (or other unix sockets):
        #       fastcgi_pass unix:/run/php/php7.4-fpm.sock;
        #       # With php-cgi (or other tcp sockets):
        #       fastcgi_pass 127.0.0.1:9000;
        #}

        # deny access to .htaccess files, if Apache's document root
        # concurs with nginx's one
        #
        #location ~ /\.ht {
        #       deny all;
        #}
}


# Virtual Host configuration for example.com
#
# You can move that to a different file under sites-available/ and symlink that
# to sites-enabled/ to enable it.
#
#server {
#       listen 80;
#       listen [::]:80;
#
#       server_name example.com;
#
#       root /var/www/example.com;
#       index index.html;
#
#       location / {
#               try_files $uri $uri/ =404;
#       }
#}

server {

        # SSL configuration
        #
        # listen 443 ssl default_server;
        # listen [::]:443 ssl default_server;
        #
        # Note: You should disable gzip for SSL traffic.
        # See: https://bugs.debian.org/773332
        #
        # Read up on ssl_ciphers to ensure a secure configuration.
        # See: https://bugs.debian.org/765782
        #
        # Self signed certs generated by the ssl-cert package
        # Don't use them in a production server!
        #
        # include snippets/snakeoil.conf;

        root /var/www/html;

        # Add index.php to the list if you are using PHP
        index index.html index.htm index.nginx-debian.html;
    server_name core-api.diykitten-backend.site; # managed by Certbot


        location / {
                                if ($request_method = 'OPTIONS') {
                add_header 'Access-Control-Allow-Origin' 'http://localhost:3000';
                add_header 'Access-Control-Allow-Methods' 'GET, POST, DELETE, PATCH, OPTIONS';
                add_header 'Access-Control-Allow-Headers' 'Content-Type, Authorization';
                add_header 'Access-Control-Allow-Credentials' 'true';
                return 204;
            }

                proxy_set_header Host $host;
                proxy_pass http://localhost:8080;


                add_header 'Access-Control-Allow-Credentials' 'true';
                add_header 'Access-Control-Allow-Origin' '*' always;
                #add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range';
                proxy_http_version 1.1;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection "upgrade";
                proxy_set_header Origin "";
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        }

        # pass PHP scripts to FastCGI server
        #
        #location ~ \.php$ {
        #       include snippets/fastcgi-php.conf;
        #
        #       # With php-fpm (or other unix sockets):
        #       fastcgi_pass unix:/run/php/php7.4-fpm.sock;
        #       # With php-cgi (or other tcp sockets):
        #       fastcgi_pass 127.0.0.1:9000;
        #}

        # deny access to .htaccess files, if Apache's document root
        # concurs with nginx's one
        #
        #location ~ /\.ht {
        #       deny all;
        #}


    listen [::]:443 ssl ipv6only=on; # managed by Certbot
    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/core-api.diykitten-backend.site/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/core-api.diykitten-backend.site/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

}
server {
        return 301 http://localhost:8080;
    #if ($host = core-api.diykitten-backend.site) {
    #    return 301 http://13.124.132.215:8080; 
    # } # managed by Certbot


        listen 80 ;
        listen [::]:80 ;
    server_name core-api.diykitten-backend.site;
    return 404; # managed by Certbot


}

• customFilter 에 cors 빈 다시 생성하여 추가설정함

3. 모바일 환경에셔 authorization_request_not_found 로 로그인 안되는 현상

• AuthorizationRequestRepository 를 상속받아 커스텀하게 repository를 구현하였으나 동작안함
• 쿠키에 secure = true로 주어서 https 환경이 아닌 경우에는 쿠기가 날라가지 않아 인증 쿠키를 다시보내지 않아 OAuth2LoginAuthenticationFilter 필터체인에서 발생한 문제
• secure = true를 주석처리하여 해결함