OAuth 2.0와 OIDC: 소셜 로그인 내부 동작 원리

sequenceDiagram
    participant User as Resource Owner
    participant Client as Client App (Backend)
    participant AuthServer as Authorization Server
    participant ResourceServer as Resource Server
    
    User->>Client: 1. "카카오 로그인" 클릭
    Client->>User: 2. Redirect to Auth Server (response_type=code)
    User->>AuthServer: 3. 로그인 및 권한 승인 (동의 화면)
    AuthServer-->>User: 4. Redirect to Client (Callback) with Authorization Code
    User->>Client: 5. 전달: Authorization Code
    
    Client->>AuthServer: 6. POST /token (code, client_id, client_secret)
    AuthServer-->>Client: 7. Access Token (+ Refresh Token, ID Token)
    
    Client->>ResourceServer: 8. GET /v2/user/me (Authorization: Bearer Token)
    ResourceServer-->>Client: 9. User Profile Data

sequenceDiagram
    participant SPA as SPA / Mobile
    participant Auth as Authorization Server
    
    Note over SPA: code_verifier 생성 (43~128자 랜덤)
    Note over SPA: code_challenge = BASE64URL(SHA256(code_verifier))
    
    SPA->>Auth: 1. /authorize?code_challenge=xxx&code_challenge_method=S256
    Auth-->>SPA: 2. Authorization Code
    SPA->>Auth: 3. /token?code=xxx&code_verifier=yyy
    Note over Auth: SHA256(code_verifier) == code_challenge 검증
    Auth-->>SPA: 4. Access Token

import java.security.MessageDigest;
import java.security.SecureRandom;
import java.util.Base64;

public class PkceGenerator {
    
    /**
     * code_verifier 생성 (43~128자, URL-safe random)
     */
    public static String generateCodeVerifier() {
        byte[] bytes = new byte[32]; // 32 bytes → 43 chars (Base64URL)
        new SecureRandom().nextBytes(bytes);
        return Base64.getUrlEncoder().withoutPadding().encodeToString(bytes);
    }
    
    /**
     * code_challenge 생성 (S256 방식)
     */
    public static String generateCodeChallenge(String codeVerifier) throws Exception {
        MessageDigest digest = MessageDigest.getInstance("SHA-256");
        byte[] hash = digest.digest(codeVerifier.getBytes("US-ASCII"));
        return Base64.getUrlEncoder().withoutPadding().encodeToString(hash);
    }
    
    // 사용 예시
    public static void main(String[] args) throws Exception {
        String verifier  = generateCodeVerifier();
        String challenge = generateCodeChallenge(verifier);
        
        // 인가 요청: ?code_challenge={challenge}&code_challenge_method=S256
        // 토큰 요청: &code_verifier={verifier}
        System.out.println("verifier:  " + verifier);
        System.out.println("challenge: " + challenge);
    }
}

{
  "iss": "https://accounts.google.com",
  "sub": "110248495921238986420",
  "aud": "my-app-client-id",
  "exp": 1711876800,
  "iat": 1711873200,
  "nonce": "abc123",
  "email": "user@example.com",
  "email_verified": true,
  "name": "홍길동",
  "picture": "https://lh3.googleusercontent.com/..."
}

import com.nimbusds.jwt.*;
import com.nimbusds.jose.jwk.source.*;
import com.nimbusds.jose.proc.*;
import com.nimbusds.jwt.proc.*;

public class IdTokenValidator {
    
    private final ConfigurableJWTProcessor<SecurityContext> processor;
    
    public IdTokenValidator(String issuerUrl, String clientId) throws Exception {
        // 1. JWKS 엔드포인트에서 공개키 자동 로드
        JWKSource<SecurityContext> keySource = new RemoteJWKSet<>(
            new URL(issuerUrl + "/.well-known/jwks.json")
        );
        
        // 2. 프로세서 설정
        processor = new DefaultJWTProcessor<>();
        processor.setJWSKeySelector(
            new JWSVerificationKeySelector<>(JWSAlgorithm.RS256, keySource)
        );
        
        // 3. Claims 검증 (iss, aud, exp, nbf)
        processor.setJWTClaimsSetVerifier(
            new DefaultJWTClaimsVerifier<>(
                new JWTClaimsSet.Builder()
                    .issuer(issuerUrl)
                    .audience(clientId)
                    .build(),
                Set.of("sub", "iat", "exp")  // 반드시 있어야 하는 claims
            )
        );
    }
    
    public JWTClaimsSet validate(String idToken) throws Exception {
        return processor.process(idToken, null);
    }
}

┌──────────┐     ①/login     ┌──────────┐    ②Authorization    ┌─────────────────┐
│          │ ─────────────→  │          │ ──────Code Flow──→   │  Auth Server    │
│  SPA     │                 │   BFF    │ ←──Token Response──  │  (Google/Kakao) │
│ (React)  │ ←─SessionID──  │ (Spring) │                      └─────────────────┘
│          │   HttpOnly      │          │    ③API 호출
│          │   Cookie        │          │ ─Bearer Token──→  ┌──────────────────┐
│          │ ────────────→   │          │ ←──Response────    │  Resource Server │
└──────────┘  ④API 프록시    └──────────┘                    └──────────────────┘

# application.yml (Spring Cloud Gateway + OAuth2 Login)
spring:
  security:
    oauth2:
      client:
        registration:
          google:
            client-id: ${GOOGLE_CLIENT_ID}
            client-secret: ${GOOGLE_CLIENT_SECRET}
            scope: openid, profile, email
            redirect-uri: "{baseUrl}/login/oauth2/code/{registrationId}"
        provider:
          google:
            issuer-uri: https://accounts.google.com
  cloud:
    gateway:
      routes:
        - id: api-route
          uri: http://localhost:8081   # 실제 API 서버
          predicates:
            - Path=/api/**
          filters:
            - TokenRelay   # ← 자동으로 Bearer Token 헤더 추가
  session:
    store-type: redis        # 세션을 Redis에 저장 (수평 확장)
    timeout: 30m

server:
  servlet:
    session:
      cookie:
        same-site: strict    # CSRF 방어
        http-only: true      # XSS 방어
        secure: true         # HTTPS만

sequenceDiagram
    participant Client
    participant Auth as Auth Server
    participant DB as Token Store
    
    Client->>Auth: POST /token (refresh_token=RT_1)
    Auth->>DB: RT_1 사용 처리 (invalidate)
    Auth->>DB: 새 RT_2 저장 (family_id=F1)
    Auth-->>Client: AT_2 + RT_2
    
    Note over Client,Auth: === 공격자가 탈취한 RT_1으로 시도 ===
    
    Client->>Auth: POST /token (refresh_token=RT_1, 재사용!)
    Auth->>DB: RT_1 이미 사용됨 감지
    Auth->>DB: family_id=F1 전체 무효화 ⚠️
    Auth-->>Client: 401 Unauthorized + 강제 재로그인

// Access Token 또는 Refresh Token 즉시 무효화
@PostMapping("/api/logout")
public ResponseEntity<Void> logout(
        @AuthenticationPrincipal OAuth2User user,
        HttpServletRequest request) {
    
    OAuth2AuthorizedClient client = authorizedClientService
        .loadAuthorizedClient("google", user.getName());
    
    // 1. Authorization Server에 토큰 취소 요청
    restTemplate.postForEntity(
        "https://oauth2.googleapis.com/revoke",
        new LinkedMultiValueMap<>(Map.of(
            "token", List.of(client.getAccessToken().getTokenValue())
        )),
        Void.class
    );
    
    // 2. 서버 세션 무효화
    request.getSession().invalidate();
    
    return ResponseEntity.noContent().build();
}

spring:
  security:
    oauth2:
      client:
        registration:
          google:
            client-id: ${GOOGLE_CLIENT_ID}
            client-secret: ${GOOGLE_CLIENT_SECRET}
            scope: openid, profile, email
          kakao:
            client-id: ${KAKAO_CLIENT_ID}
            client-secret: ${KAKAO_CLIENT_SECRET}
            scope: profile_nickname, profile_image, account_email
            authorization-grant-type: authorization_code
            redirect-uri: "{baseUrl}/login/oauth2/code/{registrationId}"
            client-authentication-method: client_secret_post
          github:
            client-id: ${GITHUB_CLIENT_ID}
            client-secret: ${GITHUB_CLIENT_SECRET}
            scope: read:user, user:email
        provider:
          google:
            issuer-uri: https://accounts.google.com
          kakao:
            authorization-uri: https://kauth.kakao.com/oauth/authorize
            token-uri: https://kauth.kakao.com/oauth/token
            user-info-uri: https://kapi.kakao.com/v2/user/me
            user-name-attribute: id
          github:
            # GitHub은 OIDC 미지원 → UserInfo로 대체
            user-info-uri: https://api.github.com/user
            user-name-attribute: id

@Service
@RequiredArgsConstructor
public class CustomOAuth2UserService extends DefaultOAuth2UserService {
    
    private final MemberRepository memberRepo;
    
    @Override
    @Transactional
    public OAuth2User loadUser(OAuth2UserRequest request) throws OAuth2AuthenticationException {
        OAuth2User oAuth2User = super.loadUser(request);
        
        String registrationId = request.getClientRegistration().getRegistrationId();
        String providerId = extractProviderId(registrationId, oAuth2User);
        String email = extractEmail(registrationId, oAuth2User);
        String name  = extractName(registrationId, oAuth2User);
        
        // Upsert: 기존 회원이면 갱신, 없으면 생성
        Member member = memberRepo
            .findByProviderAndProviderId(registrationId, providerId)
            .map(m -> m.updateProfile(name, email))
            .orElseGet(() -> memberRepo.save(
                Member.builder()
                    .provider(registrationId)
                    .providerId(providerId)
                    .email(email)
                    .name(name)
                    .role(Role.USER)
                    .build()
            ));
        
        return new CustomOAuth2User(member, oAuth2User.getAttributes());
    }
    
    private String extractProviderId(String registrationId, OAuth2User user) {
        return switch (registrationId) {
            case "google" -> user.getAttribute("sub");
            case "kakao"  -> String.valueOf(user.getAttribute("id"));
            case "github" -> String.valueOf(user.getAttribute("id"));
            default -> throw new OAuth2AuthenticationException("Unsupported: " + registrationId);
        };
    }
    
    private String extractEmail(String registrationId, OAuth2User user) {
        return switch (registrationId) {
            case "google" -> user.getAttribute("email");
            case "kakao"  -> {
                Map<String, Object> account = user.getAttribute("kakao_account");
                yield account != null ? (String) account.get("email") : null;
            }
            case "github" -> user.getAttribute("email");
            default -> null;
        };
    }
    
    private String extractName(String registrationId, OAuth2User user) {
        return switch (registrationId) {
            case "google" -> user.getAttribute("name");
            case "kakao"  -> {
                Map<String, Object> props = user.getAttribute("properties");
                yield props != null ? (String) props.get("nickname") : "Unknown";
            }
            case "github" -> user.getAttribute("login");
            default -> "Unknown";
        };
    }
}

@Configuration
@EnableWebSecurity
public class SecurityConfig {
    
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http,
            CustomOAuth2UserService customUserService) throws Exception {
        return http
            .csrf(csrf -> csrf
                .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())
            )
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/", "/login/**", "/css/**", "/js/**").permitAll()
                .requestMatchers("/api/admin/**").hasRole("ADMIN")
                .anyRequest().authenticated()
            )
            .oauth2Login(oauth2 -> oauth2
                .userInfoEndpoint(info -> info.userService(customUserService))
                .successHandler(oAuth2SuccessHandler())
                .failureUrl("/login?error=true")
            )
            .logout(logout -> logout
                .logoutSuccessUrl("/")
                .deleteCookies("JSESSIONID")
            )
            .sessionManagement(session -> session
                .maximumSessions(3)                   // 동시 세션 제한
                .maxSessionsPreventsLogin(false)       // 기존 세션 만료 (kick)
            )
            .build();
    }
}

// Spring Security OAuth2 Client (client_credentials)
@Configuration
public class M2MClientConfig {
    
    @Bean
    public OAuth2AuthorizedClientManager authorizedClientManager(
            ClientRegistrationRepository registrations,
            OAuth2AuthorizedClientRepository clients) {
        
        var provider = OAuth2AuthorizedClientProviderBuilder.builder()
            .clientCredentials()  // client_credentials grant
            .build();
        
        var manager = new DefaultOAuth2AuthorizedClientManager(registrations, clients);
        manager.setAuthorizedClientProvider(provider);
        return manager;
    }
}

// WebClient에 자동 토큰 주입
@Bean
public WebClient paymentServiceClient(OAuth2AuthorizedClientManager manager) {
    var filter = new ServletOAuth2AuthorizedClientExchangeFilterFunction(manager);
    filter.setDefaultClientRegistrationId("payment-service");
    
    return WebClient.builder()
        .baseUrl("https://payment.internal.example.com")
        .apply(filter.oauth2Configuration())
        .build();
}

디바이스 → POST /device/code → { device_code, user_code, verification_uri }
사용자   → 브라우저에서 verification_uri 접속 → user_code 입력 → 승인
디바이스 → 폴링 POST /token (device_code) → 승인 시 Access Token 발급

// CLI 도구에서 Device Authorization Flow
public class DeviceAuthFlow {
    
    public TokenResponse authenticate(String clientId) throws Exception {
        // 1. 디바이스 코드 요청
        var deviceResponse = httpClient.post("/device/code", Map.of(
            "client_id", clientId,
            "scope", "openid profile"
        ));
        
        String deviceCode = deviceResponse.get("device_code");
        String userCode   = deviceResponse.get("user_code");
        String verifyUri  = deviceResponse.get("verification_uri_complete");
        int interval      = deviceResponse.getInt("interval"); // 폴링 간격(초)
        
        // 2. 사용자에게 안내
        System.out.printf("브라우저에서 %s 에 접속하세요%n", verifyUri);
        System.out.printf("또는 %s 에서 코드 %s 를 입력하세요%n",
            deviceResponse.get("verification_uri"), userCode);
        
        // 3. 폴링으로 토큰 대기
        while (true) {
            Thread.sleep(interval * 1000L);
            try {
                return httpClient.post("/token", Map.of(
                    "grant_type", "urn:ietf:params:oauth:grant-type:device_code",
                    "device_code", deviceCode,
                    "client_id", clientId
                ));
            } catch (AuthorizationPendingException e) {
                continue; // 아직 사용자가 승인 안 함
            } catch (SlowDownException e) {
                interval += 5; // 서버가 폴링 간격 늘리라고 요청
            }
        }
    }
}

□ state 파라미터 검증을 빼먹지 않았는가?
□ redirect_uri를 와일드카드(*)로 등록하지 않았는가?
□ Client Secret이 프론트엔드 코드/JS 번들에 노출되지 않는가?
□ Access Token을 URL 쿼리 파라미터로 전달하지 않는가?
□ ID Token을 API 호출 Bearer 토큰으로 사용하지 않는가?
□ Refresh Token Rotation을 활성화했는가?
□ 로그아웃 시 서버측 토큰/세션을 무효화하는가?
□ HTTPS를 강제하고 있는가? (토큰 전송 시 평문 HTTP 차단)
□ CORS 설정이 Origin을 정확히 제한하는가?
□ 만료된 ID Token을 캐시해서 재사용하지 않는가?

// Token Introspection 호출 예시
@Component
public class IntrospectionTokenVerifier {
    
    public boolean isActive(String accessToken) {
        ResponseEntity<Map> response = restTemplate.postForEntity(
            "https://auth.example.com/oauth2/introspect",
            new LinkedMultiValueMap<>(Map.of(
                "token", List.of(accessToken),
                "token_type_hint", List.of("access_token")
            )),
            Map.class
        );
        return Boolean.TRUE.equals(response.getBody().get("active"));
    }
}

# 1. OIDC Discovery 확인
curl -s https://accounts.google.com/.well-known/openid-configuration | jq .

# 2. JWKS 엔드포인트 확인
curl -s https://www.googleapis.com/oauth2/v3/certs | jq '.keys | length'

# 3. ID Token 디코딩 (페이로드만)
echo "$ID_TOKEN" | cut -d. -f2 | base64 -d 2>/dev/null | jq .

# 4. Access Token Introspection (지원하는 서버)
curl -X POST https://auth.example.com/oauth2/introspect \
  -d "token=$ACCESS_TOKEN" \
  -u "client_id:client_secret"

# 5. Spring Security 디버그 로그
# application.yml에 추가:
# logging.level.org.springframework.security: DEBUG
# logging.level.org.springframework.security.oauth2: TRACE