OWASP Top 10 대응 체크리스트

GET /api/orders/12345
Authorization: Bearer <user_b_token>

POST /api/admin/users/delete
Authorization: Bearer <regular_user_token>

@RestController
@RequestMapping("/api/orders")
public class OrderController {

    @GetMapping("/{orderId}")
    public OrderResponse getOrder(
            @PathVariable Long orderId,
            @AuthenticationPrincipal UserDetails user) {

        Order order = orderRepository.findById(orderId)
                .orElseThrow(() -> new ResourceNotFoundException("Order not found"));

        // ✅ 리소스 소유자 검증 (IDOR 방어의 핵심)
        if (!order.getUserId().equals(user.getUserId())) {
            throw new AccessDeniedException("Not your order");
        }

        return OrderResponse.from(order);
    }
}

@Configuration
@EnableMethodSecurity(prePostEnabled = true)
public class SecurityConfig {
    // ...
}

@Service
public class OrderService {

    // SpEL로 소유자 검증
    @PreAuthorize("@orderSecurity.isOwner(#orderId, authentication)")
    public OrderResponse getOrder(Long orderId) {
        return orderRepository.findById(orderId)
                .map(OrderResponse::from)
                .orElseThrow();
    }
}

@Component("orderSecurity")
public class OrderSecurityEvaluator {

    private final OrderRepository orderRepository;

    public boolean isOwner(Long orderId, Authentication auth) {
        return orderRepository.findById(orderId)
                .map(order -> order.getUserId().equals(auth.getName()))
                .orElse(false);
    }
}

// 보안 테스트: 다른 사용자의 리소스 접근 시 403 반환
@Test
void shouldDenyAccessToOtherUsersOrder() {
    // User A의 주문
    Long orderIdOfUserA = createOrderAs("user-a");

    // User B로 접근 시도
    given()
        .header("Authorization", "Bearer " + tokenForUserB)
    .when()
        .get("/api/orders/" + orderIdOfUserA)
    .then()
        .statusCode(403);
}

@Configuration
public class PasswordConfig {

    @Bean
    public PasswordEncoder passwordEncoder() {
        // ✅ BCrypt (기본 cost=10, 충분)
        // 더 강한 보안이 필요하면 Argon2 사용
        return new BCryptPasswordEncoder();
    }
}

@Service
public class UserService {

    private final PasswordEncoder passwordEncoder;

    public void registerUser(UserRegisterRequest request) {
        User user = User.builder()
                .email(request.getEmail())
                // ✅ 평문 저장 금지
                .password(passwordEncoder.encode(request.getPassword()))
                .build();
        userRepository.save(user);
    }

    public boolean verifyPassword(String raw, String encoded) {
        return passwordEncoder.matches(raw, encoded);
    }
}

@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    http
        // HTTP → HTTPS 리다이렉트
        .requiresChannel(channel -> channel
            .anyRequest().requiresSecure()
        )
        // HSTS 헤더
        .headers(headers -> headers
            .httpStrictTransportSecurity(hsts -> hsts
                .includeSubDomains(true)
                .maxAgeInSeconds(31536000)  // 1년
                .preload(true)
            )
        );
    return http.build();
}

@Component
public class FieldEncryptor {

    private static final String ALGORITHM = "AES/GCM/NoPadding";
    private static final int IV_LENGTH = 12;
    private static final int TAG_LENGTH = 128;

    private final SecretKey key;

    public FieldEncryptor(@Value("${encryption.key}") String base64Key) {
        byte[] decoded = Base64.getDecoder().decode(base64Key);
        this.key = new SecretKeySpec(decoded, "AES");
    }

    public String encrypt(String plaintext) throws Exception {
        byte[] iv = new byte[IV_LENGTH];
        SecureRandom.getInstanceStrong().nextBytes(iv);

        Cipher cipher = Cipher.getInstance(ALGORITHM);
        GCMParameterSpec spec = new GCMParameterSpec(TAG_LENGTH, iv);
        cipher.init(Cipher.ENCRYPT_MODE, key, spec);

        byte[] ciphertext = cipher.doFinal(plaintext.getBytes(StandardCharsets.UTF_8));

        // IV + ciphertext를 함께 저장
        byte[] combined = new byte[iv.length + ciphertext.length];
        System.arraycopy(iv, 0, combined, 0, iv.length);
        System.arraycopy(ciphertext, 0, combined, iv.length, ciphertext.length);

        return Base64.getEncoder().encodeToString(combined);
    }
}

// ❌ 취약한 코드 (문자열 연결)
@Repository
public class BadUserRepo {
    public User findByName(String name) {
        String sql = "SELECT * FROM users WHERE name = '" + name + "'";
        // name에 "'; DROP TABLE users; --" 가 들어오면?
        return jdbcTemplate.queryForObject(sql, userMapper);
    }
}

// ✅ 안전한 코드 (파라미터 바인딩)
@Repository
public class SafeUserRepo {
    public User findByName(String name) {
        String sql = "SELECT * FROM users WHERE name = ?";
        return jdbcTemplate.queryForObject(sql, userMapper, name);
    }
}

// ✅ Spring Data JPA — 안전
public interface UserRepository extends JpaRepository<User, Long> {
    Optional<User> findByEmail(String email);

    // ✅ JPQL도 바인딩 사용
    @Query("SELECT u FROM User u WHERE u.name = :name")
    List<User> findByName(@Param("name") String name);
}

public class UserCreateRequest {

    @NotBlank(message = "이름은 필수입니다")
    @Size(min = 2, max = 50)
    @Pattern(regexp = "^[가-힣a-zA-Z0-9]+$",
             message = "이름에 특수문자를 사용할 수 없습니다")
    private String name;

    @Email(message = "유효한 이메일 형식이 아닙니다")
    @Size(max = 255)
    private String email;

    @Min(0) @Max(150)
    private Integer age;
}

// ❌ 취약: 사용자 입력이 쉘 명령에 직접 포함
Runtime.getRuntime().exec("ping " + userInput);

// ✅ 안전: ProcessBuilder + 배열 인자 (쉘 해석 없음)
ProcessBuilder pb = new ProcessBuilder("ping", "-c", "3", sanitizedHost);
pb.redirectErrorStream(true);
Process process = pb.start();

// ❌ 위험: 무제한 재설정 요청 → 이메일 폭탄 / 브루트포스
@PostMapping("/reset-password")
public ResponseEntity<Void> resetPassword(@RequestBody ResetRequest req) {
    passwordService.sendResetEmail(req.getEmail());
    return ResponseEntity.ok().build();
}

// ✅ 안전: 레이트리밋 + 동일 응답 (이메일 존재 여부 노출 방지)
@PostMapping("/reset-password")
@RateLimiter(name = "passwordReset", fallbackMethod = "rateLimitFallback")
public ResponseEntity<Void> resetPassword(@RequestBody ResetRequest req) {
    // 이메일 존재 여부와 관계없이 동일 응답
    passwordService.sendResetEmailIfExists(req.getEmail());
    return ResponseEntity.ok().build();
}

@PostMapping("/transfer")
public ResponseEntity<Void> transfer(
        @RequestBody TransferRequest req,
        @AuthenticationPrincipal UserDetails user) {

    // ✅ 금액이 100만 원 이상이면 재인증 요구
    if (req.getAmount().compareTo(BigDecimal.valueOf(1_000_000)) >= 0) {
        if (!req.hasReauthToken()) {
            throw new ReauthenticationRequiredException("고액 이체는 재인증이 필요합니다");
        }
        reauthService.verify(user, req.getReauthToken());
    }

    transferService.execute(req, user);
    return ResponseEntity.ok().build();
}

# application-prod.yml
management:
  endpoints:
    web:
      exposure:
        # ✅ 필요한 것만 열기 (health, info, prometheus)
        include: health, info, prometheus
      base-path: /internal/actuator  # 기본 경로 변경
  endpoint:
    health:
      show-details: when_authorized  # 인증된 사용자만 상세 정보
    env:
      enabled: false  # ❌ 환경변수 노출 금지
    beans:
      enabled: false
    configprops:
      enabled: false

  # Prometheus 메트릭은 인증 필수
  server:
    port: 9090  # 별도 포트로 분리

@Configuration
public class ActuatorSecurityConfig {

    @Bean
    @Order(1)
    public SecurityFilterChain actuatorSecurity(HttpSecurity http) throws Exception {
        http
            .securityMatcher("/internal/actuator/**")
            .authorizeHttpRequests(auth -> auth
                // health와 info만 공개
                .requestMatchers("/internal/actuator/health").permitAll()
                .requestMatchers("/internal/actuator/info").permitAll()
                // 나머지는 ADMIN만
                .anyRequest().hasRole("ADMIN")
            );
        return http.build();
    }
}

@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    http.headers(headers -> headers
        // XSS 방어
        .contentTypeOptions(Customizer.withDefaults())
        // 클릭재킹 방어
        .frameOptions(frame -> frame.deny())
        // CSP (Content Security Policy)
        .contentSecurityPolicy(csp ->
            csp.policyDirectives("default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'")
        )
        // Referrer 정보 제한
        .referrerPolicy(referrer ->
            referrer.policy(ReferrerPolicyHeaderWriter.ReferrerPolicy.STRICT_ORIGIN_WHEN_CROSS_ORIGIN)
        )
        // HTTPS 강제
        .httpStrictTransportSecurity(hsts -> hsts
            .includeSubDomains(true)
            .maxAgeInSeconds(31536000)
        )
    );
    return http.build();
}

@Configuration
public class CorsConfig implements WebMvcConfigurer {

    @Override
    public void addCorsMappings(CorsRegistry registry) {
        registry.addMapping("/api/**")
                // ✅ 구체적 오리진만 허용 (*는 금지)
                .allowedOrigins("https://myapp.com", "https://admin.myapp.com")
                .allowedMethods("GET", "POST", "PUT", "DELETE")
                .allowedHeaders("Authorization", "Content-Type")
                .allowCredentials(true)
                .maxAge(3600);
    }
}

# application-prod.yml
springdoc:
  api-docs:
    enabled: false
  swagger-ui:
    enabled: false

# ✅ 프로덕션 에러 응답 설정
server:
  error:
    include-stacktrace: never
    include-message: never
    include-binding-errors: never

# .github/workflows/security-scan.yml
name: Security Scan
on: [push, pull_request]

jobs:
  dependency-check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      # Gradle 의존성 취약점 스캔
      - name: OWASP Dependency-Check
        uses: dependency-check/Dependency-Check_Action@main
        with:
          project: 'my-app'
          path: '.'
          format: 'HTML'
          args: '--failOnCVSS 7'  # CVSS 7 이상이면 실패

      # Trivy로 컨테이너 이미지 스캔
      - name: Trivy Container Scan
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: 'my-app:latest'
          format: 'sarif'
          severity: 'CRITICAL,HIGH'
          exit-code: '1'  # 발견 시 빌드 실패

      # SBOM 생성
      - name: Generate SBOM
        run: |
          syft my-app:latest -o spdx-json > sbom.spdx.json

# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: "gradle"
    directory: "/"
    schedule:
      interval: "weekly"
    open-pull-requests-limit: 5
    labels:
      - "dependencies"
      - "security"

@Component
public class LoginAttemptService {

    private final LoadingCache<String, Integer> attemptsCache;

    public LoginAttemptService() {
        this.attemptsCache = CacheBuilder.newBuilder()
                .expireAfterWrite(15, TimeUnit.MINUTES)
                .build(new CacheLoader<>() {
                    @Override
                    public Integer load(String key) { return 0; }
                });
    }

    public void loginFailed(String key) {
        int attempts = attemptsCache.getUnchecked(key) + 1;
        attemptsCache.put(key, attempts);
    }

    public boolean isBlocked(String key) {
        return attemptsCache.getUnchecked(key) >= 5;
    }

    public void loginSucceeded(String key) {
        attemptsCache.invalidate(key);
    }
}

@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    http.sessionManagement(session -> session
        // 세션 고정 공격 방어
        .sessionFixation().changeSessionId()
        // 동시 세션 제한
        .maximumSessions(3)
        // 최대 세션 초과 시 이전 세션 만료
        .maxSessionsPreventsLogin(false)
    );
    return http.build();
}

@Component
public class PasswordPolicyValidator {

    private static final int MIN_LENGTH = 8;
    private static final Pattern UPPER = Pattern.compile("[A-Z]");
    private static final Pattern LOWER = Pattern.compile("[a-z]");
    private static final Pattern DIGIT = Pattern.compile("[0-9]");
    private static final Pattern SPECIAL = Pattern.compile("[!@#$%^&*()_+\\-=\\[\\]{};':\"\\\\|,.<>/?]");

    public void validate(String password) {
        List<String> violations = new ArrayList<>();

        if (password.length() < MIN_LENGTH) violations.add("최소 " + MIN_LENGTH + "자");
        if (!UPPER.matcher(password).find()) violations.add("대문자 1개 이상");
        if (!LOWER.matcher(password).find()) violations.add("소문자 1개 이상");
        if (!DIGIT.matcher(password).find()) violations.add("숫자 1개 이상");
        if (!SPECIAL.matcher(password).find()) violations.add("특수문자 1개 이상");

        if (!violations.isEmpty()) {
            throw new WeakPasswordException("비밀번호 정책 위반: " + String.join(", ", violations));
        }
    }
}

# Cosign으로 이미지 서명
- name: Sign Image
  run: |
    cosign sign --key cosign.key ${{ env.IMAGE_TAG }}

# 배포 시 서명 검증 (Kyverno 정책)
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: verify-image-signature
spec:
  validationFailureAction: Enforce
  rules:
    - name: verify-cosign
      match:
        resources:
          kinds:
            - Pod
      verifyImages:
        - imageReferences:
            - "myregistry.io/myapp:*"
          attestors:
            - entries:
                - keys:
                    publicKeys: |-
                      -----BEGIN PUBLIC KEY-----
                      ...
                      -----END PUBLIC KEY-----

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: read     # ✅ 최소 권한
      packages: write
    steps:
      - uses: actions/checkout@v4  # ✅ 태그 대신 SHA 고정
      # ❌ 위험: uses: some-action@main
      # ✅ 안전: uses: some-action@<commit-sha>

@Component
public class SecurityEventLogger {

    private static final Logger securityLog =
            LoggerFactory.getLogger("SECURITY_AUDIT");

    // ✅ 구조화된 보안 이벤트 로그
    public void logAuthEvent(String eventType, String userId,
                             String ip, boolean success, String detail) {
        securityLog.info("security_event={} user={} ip={} success={} detail={}",
                eventType, userId, ip, success, detail);
    }

    // 로그인 실패
    public void logLoginFailure(String username, String ip, String reason) {
        logAuthEvent("LOGIN_FAILURE", username, ip, false, reason);
    }

    // 권한 실패
    public void logAccessDenied(String userId, String resource, String ip) {
        logAuthEvent("ACCESS_DENIED", userId, ip, false,
                "resource=" + resource);
    }

    // 중요 데이터 접근
    public void logSensitiveAccess(String userId, String resource, String ip) {
        logAuthEvent("SENSITIVE_ACCESS", userId, ip, true,
                "resource=" + resource);
    }
}

@Component
public class SecurityMetrics {

    private final Counter loginFailures;
    private final Counter accessDenied;

    public SecurityMetrics(MeterRegistry registry) {
        this.loginFailures = Counter.builder("security.login.failures")
                .description("로그인 실패 횟수")
                .tag("type", "password")
                .register(registry);

        this.accessDenied = Counter.builder("security.access.denied")
                .description("접근 거부 횟수")
                .register(registry);
    }

    public void recordLoginFailure() { loginFailures.increment(); }
    public void recordAccessDenied() { accessDenied.increment(); }
}

groups:
  - name: security
    rules:
      - alert: HighLoginFailureRate
        expr: rate(security_login_failures_total[5m]) > 10
        for: 2m
        labels:
          severity: critical
        annotations:
          summary: "로그인 실패 급증 ({{ $value }}/sec)"

// ❌ 위험: PII/시크릿이 로그에 남음
log.info("User login: email={}, password={}", email, password);
log.info("API call with token: {}", authToken);

// ✅ 안전: 마스킹 처리
log.info("User login: email={}", maskEmail(email));
// password/token은 로그에 절대 남기지 않음

@Component
public class SafeUrlValidator {

    // ✅ 허용 도메인 화이트리스트
    private static final Set<String> ALLOWED_HOSTS = Set.of(
            "api.partner.com",
            "cdn.myapp.com"
    );

    // ✅ 차단 대상: 내부망/메타데이터 IP
    private static final List<String> BLOCKED_PREFIXES = List.of(
            "10.", "172.16.", "172.17.", "172.18.", "172.19.",
            "172.20.", "172.21.", "172.22.", "172.23.", "172.24.",
            "172.25.", "172.26.", "172.27.", "172.28.", "172.29.",
            "172.30.", "172.31.", "192.168.", "127.", "0.",
            "169.254."  // AWS 메타데이터 서비스
    );

    public void validate(String url) {
        URI uri = URI.create(url);

        // 스킴 검증
        if (!"https".equals(uri.getScheme())) {
            throw new SecurityException("HTTPS만 허용됩니다");
        }

        // 호스트 화이트리스트 검증
        String host = uri.getHost();
        if (!ALLOWED_HOSTS.contains(host)) {
            throw new SecurityException("허용되지 않은 호스트: " + host);
        }

        // IP 주소 직접 사용 차단
        try {
            InetAddress addr = InetAddress.getByName(host);
            String ip = addr.getHostAddress();
            for (String prefix : BLOCKED_PREFIXES) {
                if (ip.startsWith(prefix)) {
                    throw new SecurityException("내부 IP 접근 차단: " + ip);
                }
            }
        } catch (UnknownHostException e) {
            throw new SecurityException("호스트를 확인할 수 없습니다: " + host);
        }
    }
}

# Kubernetes NetworkPolicy: 외부 나가는 트래픽 제한
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: restrict-egress
spec:
  podSelector:
    matchLabels:
      app: webhook-service
  policyTypes:
    - Egress
  egress:
    - to:
        - ipBlock:
            cidr: 0.0.0.0/0
            except:
              - 10.0.0.0/8       # 내부망 차단
              - 172.16.0.0/12
              - 192.168.0.0/16
              - 169.254.169.254/32  # 메타데이터 차단
      ports:
        - protocol: TCP
          port: 443

┌──────────┐    ┌──────────┐    ┌──────────┐    ┌──────────┐
│   Code   │    │  Build   │    │   Test   │    │  Deploy  │
│  Commit  │───▶│  + SAST  │───▶│  + DAST  │───▶│  + Sign  │
└──────────┘    └──────────┘    └──────────┘    └──────────┘
     │               │               │               │
     ▼               ▼               ▼               ▼
  gitleaks      SpotBugs/       OWASP ZAP       Cosign
  pre-commit    SonarQube       Trivy           Kyverno
                Dep-Check