쿠키 로그인 취약점

rootProject.name = "servlet-request-contracts"

plugins {
    java
}

group = "board"
version = "1.0.0"

java {
    toolchain {
        languageVersion = JavaLanguageVersion.of(25)
    }
}

repositories {
    mavenCentral()
}

dependencies {
    implementation(enforcedPlatform(
        "org.springframework.boot:spring-boot-dependencies:4.1.1"))
    implementation("org.springframework.boot:spring-boot-starter-webmvc")
    implementation("org.springframework.boot:spring-boot-starter-validation")
    implementation("org.springframework:spring-tx")

    testImplementation(enforcedPlatform(
        "org.springframework.boot:spring-boot-dependencies:4.1.1"))
    testImplementation("org.springframework.boot:spring-boot-starter-webmvc-test")
    testRuntimeOnly("org.junit.platform:junit-platform-launcher")

    constraints {
        testImplementation("org.junit.jupiter:junit-jupiter") {
            version { strictly("6.0.3") }
        }
    }
}

tasks.withType<JavaCompile>().configureEach {
    options.encoding = "UTF-8"
    options.release = 25
    options.compilerArgs.add("-parameters")
}

tasks.test {
    useJUnitPlatform()
}

package board;

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;

@SpringBootApplication
public class BoardApplication {
    public static void main(String[] args) {
        SpringApplication.run(BoardApplication.class, args);
    }
}

package board.web.auth;

import jakarta.servlet.http.Cookie;
import jakarta.servlet.http.HttpServletRequest;

public final class InsecureMemberCookie {
    public long currentMemberId(HttpServletRequest request) {
        Cookie[] cookies = request.getCookies();
        if (cookies == null) {
            throw new UnauthenticatedException();
        }
        for (Cookie cookie : cookies) {
            if (cookie.getName().equals("memberId")) {
                return Long.parseLong(cookie.getValue());
            }
        }
        throw new UnauthenticatedException();
    }

    public static final class UnauthenticatedException
            extends RuntimeException {
    }
}

package board.web.auth;

import static org.assertj.core.api.Assertions.assertThat;

import jakarta.servlet.http.Cookie;

import org.junit.jupiter.api.Test;
import org.springframework.mock.web.MockHttpServletRequest;

class InsecureCookieAttackTest {
    @Test
    void 공격자가_memberId_cookie를_바꾸면_다른_회원으로_해석된다() {
        var request = new MockHttpServletRequest();
        request.setCookies(new Cookie("memberId", "1"));
        var reader = new InsecureMemberCookie();

        long interpretedMember = reader.currentMemberId(request);

        assertThat(interpretedMember).isEqualTo(1L);
    }
}

password verification = not executed
attacker supplied Cookie: memberId=1
server interpreted member = 1
authorization boundary = bypassed

package board.web.auth;

import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpSession;

import java.util.Optional;

import org.springframework.stereotype.Controller;
import org.springframework.validation.BindingResult;
import org.springframework.web.bind.annotation.ModelAttribute;
import org.springframework.web.bind.annotation.PostMapping;

import board.web.auth.SessionMemberReader.AuthenticatedMember;

@Controller
public final class LoginController {
    private final CredentialVerifier credentials;

    public LoginController(CredentialVerifier credentials) {
        this.credentials = credentials;
    }

    @PostMapping("/login")
    String login(
            @ModelAttribute("form") LoginForm form,
            BindingResult result,
            HttpServletRequest request
    ) {
        if (result.hasErrors()) {
            return "login/form";
        }
        var member = credentials.verify(
                form.email(), form.password());
        if (member.isEmpty()) {
            result.reject("login.failed", "로그인 정보를 확인하세요.");
            return "login/form";
        }

        HttpSession previous = request.getSession(false);
        if (previous != null) {
            previous.invalidate();
        }
        HttpSession session = request.getSession(true);
        session.setAttribute(
                SessionMemberReader.AUTHENTICATED_MEMBER_ATTRIBUTE,
                member.get());
        return "redirect:/posts";
    }

    public record LoginForm(String email, String password) {
    }

    public interface CredentialVerifier {
        Optional<AuthenticatedMember> verify(
                String email, String password);
    }
}