11package com .inhabas .api .auth .domain .oauth2 .cookie ;
22
3+ import java .io .ByteArrayInputStream ;
4+ import java .io .ByteArrayOutputStream ;
5+ import java .io .IOException ;
6+ import java .io .ObjectInputStream ;
7+ import java .io .ObjectOutputStream ;
38import java .time .Duration ;
49import java .util .Base64 ;
5- import java .util .Objects ;
610import java .util .Optional ;
711
812import jakarta .servlet .http .Cookie ;
1115
1216import org .springframework .http .ResponseCookie ;
1317import org .springframework .security .oauth2 .core .endpoint .OAuth2AuthorizationRequest ;
14- import org .springframework .util .SerializationUtils ;
15-
16- import io .micrometer .core .instrument .util .StringUtils ;
1718
1819public interface CookieUtils {
1920
@@ -130,8 +131,14 @@ static void setCookie(
130131 * @return 브라우저 쿠키에 담기 위해 OAuth2AuthorizationRequest 를 string 으로 변환.
131132 */
132133 static String serialize (OAuth2AuthorizationRequest request ) {
133-
134- return Base64 .getUrlEncoder ().encodeToString (SerializationUtils .serialize (request ));
134+ try (ByteArrayOutputStream bos = new ByteArrayOutputStream ();
135+ ObjectOutputStream oos = new ObjectOutputStream (bos )) {
136+ oos .writeObject (request );
137+ oos .flush ();
138+ return Base64 .getUrlEncoder ().encodeToString (bos .toByteArray ());
139+ } catch (IOException e ) {
140+ throw new IllegalStateException ("Failed to serialize OAuth2AuthorizationRequest" , e );
141+ }
135142 }
136143
137144 /**
@@ -141,18 +148,19 @@ static String serialize(OAuth2AuthorizationRequest request) {
141148 */
142149 static <T > T deserialize (Cookie cookie , Class <T > clz ) {
143150
144- if (isDeleted (cookie )) return null ;
145- else {
146- try {
147- return clz .cast (
148- SerializationUtils .deserialize (Base64 .getUrlDecoder ().decode (cookie .getValue ())));
149- } catch (RuntimeException ex ) { // Base64 decoding error or deserialization error
150- return null ;
151+ if (cookie == null || isBlank (cookie .getValue ())) return null ;
152+ try {
153+ byte [] data = Base64 .getUrlDecoder ().decode (cookie .getValue ());
154+ try (ObjectInputStream ois = new ObjectInputStream (new ByteArrayInputStream (data ))) {
155+ Object obj = ois .readObject ();
156+ return clz .cast (obj );
151157 }
158+ } catch (IOException | ClassNotFoundException | IllegalArgumentException ex ) {
159+ return null ;
152160 }
153161 }
154162
155- private static boolean isDeleted ( Cookie cookie ) {
156- return StringUtils . isBlank ( cookie . getValue ()) || Objects . isNull ( cookie . getValue () );
163+ private static boolean isBlank ( String s ) {
164+ return s == null || s . trim (). isEmpty ( );
157165 }
158166}
0 commit comments