SpringBoot, Node Express JS 활용한 세션으로 페이지 변경

DB 값을 받아와 웹브라우저에서 해당 권한을 세션값에 따라 웹 페이지에 보여주거나 보여주지 않게 하는 동적인 부분이다.

[서론]
쿠키 방식은 누구나 키를 통해 벨류를 확인할 수 있다. 그렇기 때문에 내가 하고 있는 프로젝트는 스프링을 서버로 사용하여 데이터를 저장하고 웹브라우저인 Node Express JS를 사용하여 sessionId를 활용하여 보안에 대비하고 있다. 
 

Controller

스프링에서 먼저 디비 테이블의 내용을 읽어오는 예시이다.

 @GetMapping("")
    public ResponseVO getUserInfo() {
    String userId = ((UserDetails) SecurityContextHolder.getContext().getAuthentication().getPrincipal()).getUsername();	
    System.out.println("getUserInfo");
    log.debug("getUserInfo[" + userId + "]");
    return userService.getUserInfo(userId);
        
    }

Service

public ResponseVO getUserInfo(String userId) {
AccountVO account = null;
try {
    account = userProxy.selectAccountInfo(userId);
} catch (EmptyResultDataAccessException e) {
    return new ResponseVO("404", "회원 정보가 없습니다.");
}

UserInfoVO userInfo = new UserInfoVO();
(생략)

try {

AmountCpInfoVO amount = cpInfoProxy.selectUserAmountMunja(account.getMgwDbName(), userId);

    userInfo.setUserId(userId);
    (생략)

    try {
        AcsUserInfoVO acsUser = userProxy.selectAcsUserInfo(userId);
        String useACS = "N";
        if ("R".equals(acsUser.getStatusCode())) {
            useACS = "Y";
        }

        userInfo.setUseACS(useACS);

    } catch (EmptyResultDataAccessException e) {
        userInfo.setUseACS("N");
    }

    return new ResponseVO("200", RETMESSAGE.SUCCESS, userInfo);

} catch (EmptyResultDataAccessException e) {
    return new ResponseVO("404", "회원 정보가 없습니다.");
}

}

DAO

public AmountCpInfoVO selectUserAmountMunja(String dbName, String userId) {
    String sql = 
            "SELECT	"
            + " c.CPNAME, "
            (생략)
            + " d.USECDR "
            + "FROM "
            +   dbName+".정보테이블 c, "
            +   dbName+".디테일정보테이블 d "
            + "WHERE "
            + " c.SP_NUM = d.SP_NUM "
            + " AND "
            + " c.CPID = ?	";

    if("3".equals(dbSelect(dbName))) {
        return jdbcMultiTemplate.queryForObject(sql, new AmountCpInfoRowMapper(), userId);
    } else if("2".equals(dbSelect(dbName))) {
        return jdbcSubTemplate.queryForObject(sql, new AmountCpInfoRowMapper(), userId);
    } else {
        return jdbcTemplate.queryForObject(sql, new AmountCpInfoRowMapper(), userId);
    }
}

콘솔에찍히는 내용

 

로그인 라우터 부분

function(req, res, next) {
		var user_id  = (req.body.id == null) ? "" : req.body.id;

		request({
				   uri:`${common.serverUrl}/user/amount`, 
				   method: 'GET',
				   timeout: time_out,
                   headers: {
						'Content-Type': 'application/json',
                        'Authorization': `Bearer ${accessToken}`
				   },
				   json:true
				 },function(error, response, result) { 
					res.clearCookie("JSESSIONID");
					
            if(error){//throw error;
                console.log(error);
                res.json({code: "500", message: "로그인에 실패했습니다."});
        }else{
            if(result.code == "200") {
                console.log("result.data: ", result.data);
                var rate = {};


                rate.sms = result.data.smsRate;

                (생략)
                req.session.regenerate(function(){ 			
                    req.session.user_id = user_id;
                    req.session.current_amount_acs = result.data.currentAmountAcs;
                    req.session.use_munja = result.data.useMunja;


                    if(result.data.pwExpirationCheck) {
                        res.json({code:`201`, message:`로그인성공.`});
                    } else {
                        res.json({code:`200`, message:`로그인성공.`});
                    }

                });	

            }else{ 
                res.json({code: result.code, message: result.message});
            }
        }
    }
);

    }

로그인을 한 경우 세션값을 넣어준다. 이 때 다른 페이지마다 내가 원하는 세션값을 넣어줘야 한다.

HTML

<% if(session.useMunja == 1) { %>
			<h1 class="titleType_1">문자발송</h1>
			<div class="tabType_1 w_100">
				<ul>
					<li class="on"><a href="/result_shipment2/view">sms발송</a></li>
					<li><a href="/result_shipment3/view">lms발송</a></li>
					<li><a href="/result_shipment4/view">mms발송</a></li>
				</ul>
			</div>
			<% }else { %>

				(생략)			
				<% } %>

이렇게 세션값을 통해 로그인 한 아이디의 정보와 권한을 확인하고 사용자에 따라 페이지를 보여주거나 접근을 막을 수 있게 사용하였다.