permitAll()인데 왜 Redis 세션을 읽는가 — Spring Security 5 필터 체인의 동작 방식

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .authorizeRequests()
                .antMatchers("/api/event/**").permitAll()
                .anyRequest().authenticated()
            .and()
            .sessionManagement()
                .sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED);
    }
}

1713600000.123456 [0 10.0.0.1:51234] "GET" "spring:session:sessions:abc123def456..."
1713600000.234567 [0 10.0.0.1:51235] "GET" "spring:session:sessions:xyz789uvw012..."
1713600000.345678 [0 10.0.0.1:51236] "GET" "spring:session:sessions:mno345pqr678..."

HTTP 요청
  │
  ▼
SecurityContextPersistenceFilter    ← [1] 세션에서 SecurityContext 로드
  │
  ▼
UsernamePasswordAuthenticationFilter (해당 경로만)
  │
  ▼
... (기타 필터들)
  │
  ▼
FilterSecurityInterceptor           ← [2] permitAll() 판단 (인가)
  │
  ▼
DispatcherServlet → Controller

// org.springframework.security.web.context.SecurityContextPersistenceFilter
public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
        throws IOException, ServletException {

    HttpServletRequest request = (HttpServletRequest) req;
    HttpServletResponse response = (HttpServletResponse) res;

    // ...

    HttpRequestResponseHolder holder = new HttpRequestResponseHolder(request, response);

    // 세션에서 SecurityContext를 로드한다 — chain.doFilter() 이전에 실행됨
    SecurityContext contextBeforeChainExecution = repo.loadContext(holder);

    try {
        SecurityContextHolder.setContext(contextBeforeChainExecution);

        // 여기서 나머지 필터들이 실행된다
        // FilterSecurityInterceptor (permitAll 판단)도 이 안에서 실행됨
        chain.doFilter(holder.getRequest(), holder.getResponse());
    } finally {
        // ...
        SecurityContextHolder.clearContext();
    }
}

// org.springframework.security.web.context.HttpSessionSecurityContextRepository
public SecurityContext loadContext(HttpRequestResponseHolder requestResponseHolder) {
    HttpServletRequest request = requestResponseHolder.getRequest();
    HttpServletResponse response = requestResponseHolder.getResponse();

    // Spring Session이 개입하는 지점
    // 세션 쿠키가 있으면 Spring Session은 여기서 Redis를 조회한다
    HttpSession httpSession = request.getSession(false);

    SecurityContext context = readSecurityContextFromSession(httpSession);

    if (context == null) {
        context = generateNewContext();
    }

    // ...
    return context;
}

// org.springframework.security.web.context.HttpSessionSecurityContextRepository
private SecurityContext readSecurityContextFromSession(HttpSession httpSession) {
    if (httpSession == null) {
        return null;
    }

    // Spring Session 프록시 객체에 getAttribute를 호출하는 순간
    // Redis GET 명령이 실행된다
    Object contextFromSession = httpSession.getAttribute(springSecurityContextKey);

    // ...
}

[HTTP 요청: GET /api/event/123 (세션 쿠키 포함)]
  │
  ▼
SecurityContextPersistenceFilter.doFilter()
  │
  ├─ repo.loadContext(holder)
  │    │
  │    ├─ request.getSession(false)      ← Spring Session 개입 지점
  │    │
  │    └─ readSecurityContextFromSession()
  │         │
  │         └─ httpSession.getAttribute(springSecurityContextKey)
  │              │
  │              └─ Redis GET spring:session:sessions:...  ← Redis 호출 발생
  │
  └─ chain.doFilter()                    ← 세션은 이미 읽힌 후
       │
       └─ FilterSecurityInterceptor
            │
            └─ permitAll() 판단          ← 여기서 통과 허용

// STATELESS는 세션 생성을 막는다
// 하지만 loadContext() 내부의 request.getSession(false)는
// "생성 없이 기존 세션 조회"이므로 차단되지 않는다

// 이벤트 API 전용 설정 — 우선순위가 높아야 함
@Configuration
@Order(1)
public class EventApiSecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .requestMatchers()
                .antMatchers("/api/event/**")
            .and()
            .authorizeRequests()
                .anyRequest().permitAll()
            .and()
            // SecurityContextPersistenceFilter 비활성화
            // 이 경로에서는 세션 로딩 자체가 발생하지 않는다
            .securityContext().disable()
            .sessionManagement()
                .sessionCreationPolicy(SessionCreationPolicy.STATELESS);
    }
}

// 나머지 경로를 담당하는 기본 설정
@Configuration
@Order(2)
public class DefaultSecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .authorizeRequests()
                .anyRequest().authenticated()
            .and()
            .sessionManagement()
                .sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED);
    }
}

[HTTP 요청: GET /api/event/123 (세션 쿠키 포함)]
  │
  ▼
EventApiSecurityConfig 적용 (Order=1)
  │
  ├─ SecurityContextPersistenceFilter → 비활성화됨 (skip)
  │
  └─ chain.doFilter()
       │
       └─ FilterSecurityInterceptor
            │
            └─ permitAll() 판단 → 통과

Redis 조회 없음

// Spring Security 6.x 대응
@Bean
@Order(1)
public SecurityFilterChain eventApiFilterChain(HttpSecurity http) throws Exception {
    http
        .securityMatcher("/api/event/**")
        .authorizeHttpRequests(auth -> auth.anyRequest().permitAll())
        .securityContext(context -> context.disable())
        .sessionManagement(session ->
            session.sessionCreationPolicy(SessionCreationPolicy.STATELESS));
    return http.build();
}

@Bean
@Order(2)
public SecurityFilterChain defaultFilterChain(HttpSecurity http) throws Exception {
    http
        .authorizeHttpRequests(auth -> auth.anyRequest().authenticated());
    return http.build();
}