서블릿 필터

package board.web;

import java.io.IOException;
import java.util.UUID;
import java.util.regex.Pattern;

import jakarta.servlet.FilterChain;
import jakarta.servlet.ServletException;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;

import org.slf4j.MDC;
import org.springframework.stereotype.Component;
import org.springframework.web.filter.OncePerRequestFilter;

@Component
public final class RequestTraceFilter extends OncePerRequestFilter {
    public static final String REQUEST_ID_HEADER = "X-Request-Id";
    public static final String REQUEST_ID_ATTRIBUTE = "requestId";
    private static final String MDC_KEY = "requestId";
    private static final String STABLE_REQUEST_ID_ATTRIBUTE =
            RequestTraceFilter.class.getName() + ".stableRequestId";
    private static final Pattern SAFE =
            Pattern.compile("[A-Za-z0-9-]{8,64}");

    @Override
    protected boolean shouldNotFilterErrorDispatch() {
        return false;
    }

    @Override
    protected void doFilterInternal(
            HttpServletRequest request,
            HttpServletResponse response,
            FilterChain chain
    ) throws ServletException, IOException {
        String requestId = stableRequestId(request);
        Object previousAttribute = request.getAttribute(
                REQUEST_ID_ATTRIBUTE);
        String previousMdc = MDC.get(MDC_KEY);

        request.setAttribute(REQUEST_ID_ATTRIBUTE, requestId);
        MDC.put(MDC_KEY, requestId);
        try {
            response.setHeader(REQUEST_ID_HEADER, requestId);
            chain.doFilter(request, response);
        } finally {
            if (previousAttribute == null) {
                request.removeAttribute(REQUEST_ID_ATTRIBUTE);
            } else {
                request.setAttribute(
                        REQUEST_ID_ATTRIBUTE, previousAttribute);
            }
            if (previousMdc == null) {
                MDC.remove(MDC_KEY);
            } else {
                MDC.put(MDC_KEY, previousMdc);
            }
        }
    }

    private String stableRequestId(HttpServletRequest request) {
        Object stable = request.getAttribute(
                STABLE_REQUEST_ID_ATTRIBUTE);
        if (stable instanceof String requestId
                && SAFE.matcher(requestId).matches()) {
            return requestId;
        }
        String requestId = accepted(
                request.getHeader(REQUEST_ID_HEADER));
        request.setAttribute(
                STABLE_REQUEST_ID_ATTRIBUTE, requestId);
        return requestId;
    }

    private String accepted(String candidate) {
        if (candidate != null && SAFE.matcher(candidate).matches()) {
            return candidate;
        }
        return UUID.randomUUID().toString();
    }
}

package board.web.auth;

import java.io.IOException;

import jakarta.servlet.FilterChain;
import jakarta.servlet.ServletException;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;

import org.springframework.http.MediaType;
import org.springframework.web.filter.OncePerRequestFilter;

public final class LoginRequiredFilter extends OncePerRequestFilter {
    private final SessionMemberReader sessions;

    public LoginRequiredFilter(SessionMemberReader sessions) {
        this.sessions = sessions;
    }

    @Override
    protected boolean shouldNotFilter(HttpServletRequest request) {
        String path = request.getRequestURI();
        return !path.startsWith("/api/private/");
    }

    @Override
    protected void doFilterInternal(
            HttpServletRequest request,
            HttpServletResponse response,
            FilterChain chain
    ) throws IOException, ServletException {
        var member = sessions.read(request);
        if (member.isEmpty()) {
            response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
            response.setContentType(MediaType.APPLICATION_PROBLEM_JSON_VALUE);
            response.getWriter().write("""
                    {"title":"Authentication required","status":401,
                     "code":"authentication-required"}
                    """);
            return;
        }
        request.setAttribute(
                SessionMemberReader.AUTHENTICATED_MEMBER_ATTRIBUTE,
                member.get());
        chain.doFilter(request, response);
    }
}

package board.web;

import static org.assertj.core.api.Assertions.assertThat;
import static org.assertj.core.api.Assertions.assertThatThrownBy;

import java.util.ArrayList;

import jakarta.servlet.DispatcherType;
import jakarta.servlet.FilterChain;
import jakarta.servlet.RequestDispatcher;
import jakarta.servlet.ServletException;

import org.junit.jupiter.api.Test;
import org.slf4j.MDC;
import org.springframework.mock.web.MockHttpServletRequest;
import org.springframework.mock.web.MockHttpServletResponse;

class RequestTraceFilterTest {
    @Test
    void downstream_예외가_나도_request와_MDC를_원상복구한다() {
        var filter = new RequestTraceFilter();
        var request = new MockHttpServletRequest("GET", "/posts");
        request.addHeader(
                RequestTraceFilter.REQUEST_ID_HEADER,
                "client-1234");
        request.setAttribute(
                RequestTraceFilter.REQUEST_ID_ATTRIBUTE,
                "outer-attribute");
        var response = new MockHttpServletResponse();
        FilterChain chain = (servletRequest, servletResponse) -> {
            assertThat(servletRequest.getAttribute(
                    RequestTraceFilter.REQUEST_ID_ATTRIBUTE))
                    .isEqualTo("client-1234");
            assertThat(MDC.get("requestId"))
                    .isEqualTo("client-1234");
            throw new ServletException("downstream failed");
        };

        String beforeTest = MDC.get("requestId");
        MDC.put("requestId", "outer-mdc");
        try {
            assertThatThrownBy(
                    () -> filter.doFilter(request, response, chain))
                    .isInstanceOf(ServletException.class)
                    .hasMessage("downstream failed");
            assertThat(request.getAttribute(
                    RequestTraceFilter.REQUEST_ID_ATTRIBUTE))
                    .isEqualTo("outer-attribute");
            assertThat(MDC.get("requestId")).isEqualTo("outer-mdc");
            assertThat(response.getHeader(
                    RequestTraceFilter.REQUEST_ID_HEADER))
                    .isEqualTo("client-1234");
        } finally {
            if (beforeTest == null) {
                MDC.remove("requestId");
            } else {
                MDC.put("requestId", beforeTest);
            }
        }
    }

    @Test
    void 기존_context가_없으면_filter_종료_뒤_모두_제거한다()
            throws Exception {
        var filter = new RequestTraceFilter();
        var request = new MockHttpServletRequest("GET", "/posts");
        request.addHeader(
                RequestTraceFilter.REQUEST_ID_HEADER,
                "client-5678");
        var response = new MockHttpServletResponse();
        FilterChain chain = (servletRequest, servletResponse) -> {
            assertThat(servletRequest.getAttribute(
                    RequestTraceFilter.REQUEST_ID_ATTRIBUTE))
                    .isEqualTo("client-5678");
            assertThat(MDC.get("requestId"))
                    .isEqualTo("client-5678");
        };

        String beforeTest = MDC.get("requestId");
        MDC.remove("requestId");
        try {
            filter.doFilter(request, response, chain);

            assertThat(request.getAttribute(
                    RequestTraceFilter.REQUEST_ID_ATTRIBUTE)).isNull();
            assertThat(MDC.get("requestId")).isNull();
        } finally {
            if (beforeTest != null) {
                MDC.put("requestId", beforeTest);
            }
        }
    }

    @Test
    void 같은_request의_ERROR_dispatch는_ID를_재사용하고_각각_복원한다()
            throws Exception {
        var filter = new RequestTraceFilter();
        var request = new MockHttpServletRequest("GET", "/posts/41");
        request.addHeader(
                RequestTraceFilter.REQUEST_ID_HEADER,
                "client-9012");
        request.setAttribute(
                RequestTraceFilter.REQUEST_ID_ATTRIBUTE,
                "outer-attribute");
        var response = new MockHttpServletResponse();
        var observed = new ArrayList<String>();
        FilterChain chain = (servletRequest, servletResponse) -> {
            observed.add((String) servletRequest.getAttribute(
                    RequestTraceFilter.REQUEST_ID_ATTRIBUTE));
            assertThat(MDC.get("requestId"))
                    .isEqualTo("client-9012");
        };

        String beforeTest = MDC.get("requestId");
        MDC.put("requestId", "outer-mdc");
        try {
            filter.doFilter(request, response, chain);
            assertThat(request.getAttribute(
                    RequestTraceFilter.REQUEST_ID_ATTRIBUTE))
                    .isEqualTo("outer-attribute");
            assertThat(MDC.get("requestId")).isEqualTo("outer-mdc");

            request.setDispatcherType(DispatcherType.ERROR);
            request.setAttribute(
                    RequestDispatcher.ERROR_REQUEST_URI,
                    "/posts/41");
            filter.doFilter(request, response, chain);

            assertThat(observed)
                    .containsExactly("client-9012", "client-9012");
            assertThat(request.getAttribute(
                    RequestTraceFilter.REQUEST_ID_ATTRIBUTE))
                    .isEqualTo("outer-attribute");
            assertThat(MDC.get("requestId")).isEqualTo("outer-mdc");
        } finally {
            if (beforeTest == null) {
                MDC.remove("requestId");
            } else {
                MDC.put("requestId", beforeTest);
            }
        }
    }
}

request attribute inside chain = client-1234
MDC inside chain = client-1234
downstream exception = propagated
response header = client-1234
request attribute after filter = outer-attribute
MDC after filter = outer-mdc
empty context after second run = null
REQUEST dispatch id = client-9012
ERROR dispatch id = client-9012
public context after each dispatch = restored