HTTPS  기능 

https 는 http 에 SSL 기능을 추가한것인데 ,  HTTP 는 문자를 가지고 누가 엿보기가 쉽다. 따라서 

통신하는데 해당 문자를 암호화해주며, 암호화 하기위한 키에 대해 안전성을 보장해주는 기술이 들어가있다. 

 

SSL : https://wiki.kldp.org/HOWTO/html/SSL-Certificates-HOWTO/x70.html

출처: http://hamait.tistory.com/330 [HAMA 블로그]

 

1. security-context.xml 파일에 설정 추가 

 

<?xml version="1.0" encoding="UTF-8"?>

<beans:beans xmlns="http://www.springframework.org/schema/security"

  xmlns:beans="http://www.springframework.org/schema/beans"

  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

  xsi:schemaLocation="http://www.springframework.org/schema/beans

           http://www.springframework.org/schema/beans/spring-beans-3.2.xsd

           http://www.springframework.org/schema/security

           http://www.springframework.org/schema/security/spring-security-3.2.xsd">

            

	<http auto-config='true'  use-expressions="true">      

		<intercept-url pattern="/login" access="permitAll" />   

		<intercept-url pattern="/resources/**" access="permitAll" />  

		<intercept-url pattern="/**" access="hasRole('ROLE_USER')"  requires-channel="https" />  

		

			<form-login login-page="/login"                    

				default-target-url="/monitering"          

				username-parameter="username"        

				password-parameter="password"          

				authentication-failure-url="/login?error" 

				always-use-default-target='true'           

			/> 

	

		<logout invalidate-session="true"   

     delete-cookies="JSESSIONID,SPRING_SECURITY_REMEMBER_ME_COOKIE"  

logout-success-url="/login?logout" /> 

		<remember-me key="wmoskey" token-validity-seconds="2419200"/> <!-- 4 weeks -->

		<!-- enable csrf protection -->

		<csrf/> 

	</http> 



        <authentication-manager>

		    <authentication-provider user-service-ref="memberService"/> 

	</authentication-manager>	

		

	<beans:bean id="memberService" class="com.starkoff.wmos.auth.MemberService"> 

   	</beans:bean>

   

</beans:beans>

 

 

설명)

requires-channel 를 추가하였다. (한줄이면됨)

설정은 위에 한줄이면 되며 , 톰캣에 HTTPS 설정을 하면되는데 아래 싸이트를 참고하자

 

http://visu4l.tistory.com/419


싸이트 내용중에 참고로 국가코드는 KR 을 넣어주면 되며, 
아래에서 명령에서 trustcscerts  들은 모두 오타이다. trustcacerts 로 바꿔주자.

keytool -import -alias Root -trustcscerts -file TrialRoot.pem -keystore testserver

keytool -import -alias Intermediate -trustcscerts -file TrialIntermediate.pem -keystore testserver

keytool -import -alias testserver -trustcscerts -file cert.pem -keystore testserver

 

 

HTTPS 설정을 위한 다른 방법  ( 번역글 ) 

http://www.javacodegeeks.com/2012/12/securing-your-tomcat-app-with-ssl-and-spring-security.html\

 

 

SSL 과 Spring Security 를 가지고 톰캣 웹어플리케이션을 보호해보자.

 

keytool -genkey -alias MyKeyAlias -keyalg RSA -keystore /Users/Roger/tmp/roger.keystore

 

위의 명령어에서 

• -alias 키에 대한 유니크한 ID
• -keyalg   'RSA',  'DSA' , 'DES' 같은 키를 만들기위한 알고리즘 . 
• -keystore  키스토어가 저장될 위치 

 

Roger$ keytool -genkey -alias MyKeyAlias -keyalg RSA -keystore /Users/Roger/tmp/roger.keystore
Enter keystore password: 
Re-enter new password:
What is your first and last name?
  [Unknown]:  localhost
What is the name of your organizational unit?
  [Unknown]:  MyDepartmentName
What is the name of your organization?
  [Unknown]:  MyCompanyName
What is the name of your City or Locality?
  [Unknown]:  Stafford
What is the name of your State or Province?
  [Unknown]:  NA
What is the two-letter country code for this unit?
  [Unknown]:  UK
Is CN=localhost, OU=MyDepartmentName, O=MyCompanyName, L=Stafford, ST=UK, C=UK correct?
  [no]:  Y

Enter key password for 
     (RETURN if same as keystore password): 

 

 

<Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
               maxThreads="150" scheme="https" secure="true"
               clientAuth="false" sslProtocol="TLS" />

…and making it look something like this:
 

<Connector SSLEnabled="true" keystoreFile="/Users/Roger/tmp/roger.keystore" keystorePass="password" port="8443" scheme="https" secure="true" sslProtocol="TLS"/> 

 

위에서 password에 평문을 넣는것은 보안에 좋지 않다. 여러 방법이 있는데 이 포스트를 넘어서는것이다.

3. security-context.xml  설정 

 

<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security"
	xmlns:beans="http://www.springframework.org/schema/beans"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.1.xsd">
	<http auto-config='true'>
	<intercept-url pattern="/**" requires-channel="https" />
	</http>
	<authentication-manager>
	</authentication-manager>
</beans:beans>

 

requires-channel="https" 를 추가하고 톰캣을 이용해서 시작하면  HTTPS 을 사용해서 접근할수있다.