Spring Boot で Boot した後に作る Web アプリケーション基盤/spring-boot-application-infrastructure

>
<
JJUG CCC 2016 Spring. 2016/05/21
4QSJOH#PPUͰ#PPUͨ͠ޙʹ࡞Δ
8FCΞϓϦέʔγϣϯج൫
٢ా ๎໵ʢΤϜεϦʔגࣜձࣾʣ
1

View Slide

>
< 2
• ໊લ : ٢ా ๎໵ / @sinsengumi
• ৬ۀ : ιϑτ΢ΣΞΤϯδχΞ
• ओʹαʔόʔαΠυΛ୲౰
• ࠷ॳ͸ Web σβΠφʔΛ͍ͯ͠·ͨ͠
• SIer ͔ΒΤϜεϦʔגࣜձࣾ΁స৬
• ॴଐ : ΤϜεϦʔגࣜձࣾ
• 3೥໨
• Spring ྺ : 2 ೥͘Β͍
• JJUG ॳࢀՃʂ
ࣗݾ঺հ

View Slide

>
< 3
ձࣾ঺հʢΤϜεϦʔגࣜձࣾʣ
• ೔ຊͷҩࢣ 8 ׂɺੈքͰ 350 ສਓͷҩࢣ޲͚αʔϏεΛӡӦ͢Δ 
ҩྍܥϕϯνϟʔاۀ
• ϛογϣϯ : ΠϯλʔωοτͷྗͰҩྍΛมֵ͢Δ
• ւ֎ల։ɺ࣏ݧɾήϊϜͳͲ৽ࣄۀ΋ੵۃత
• JavaɺJVMʢScalaɾKotlinʣΛଟ਺ͷαʔϏεͰར༻
ΤϯδχΞ͸ৗʹืूதʂ
https://jobs.m3.com/engineer
Medicine − ҩྍ
Media − ϝσΟΞ
Metamorphosis − มֵ
ϋοΧιϯͷ༷ࢠ

View Slide

>
< 4
໨࣍
1. Spring Boot ʹ͍ͭͯ 
2. Boot ͨ͠ɺͦͷޙɾɾɾ
1. URL ઃܭ
2. ྫ֎
3. τϥϯβΫγϣϯ
4. όον
5. ϓϩύςΟ
6. ϩΪϯά
7. ηΩϡϦςΟ
8. ͦͷଞ 
3. ·ͱΊ

View Slide

>
<
00
About Spring Boot
4QSJOH#PPU
ʹ͍ͭͯ
5

View Slide

>
< 6
• Java EE (JAX-RS, CDI, JPA, JSF)
• Play Framework
• Struts2
• Seasar2
• Dropwizard, Ninja etc
• Spring (not Boot)
օ͞Μ͸ɺ৽نʹ Java ͰΞϓϦέʔγϣϯΛ࡞Ζ͏ͱࢥͬͨ࣌ɺ
ࠓʢ2016೥ݱࡏʣͳΒԿΛબͼ·͔͢ʁ
Spring Boot ʹ͍ͭͯʢ1ʣ
͏ʔΜɾɾɾɾ
ॏްա͗Δ͠ɺJava EE αʔόʔͷ४උ͕ɾɾ

Java ൛αϙʔτ੾ΒΕͦ͏Ͱා͍ɾɾɾ

ͳΜ͔੬ऑੑ͕ɾɾɾ

2016೥9݄ʹ EOL

ۀ຿ͰऔΓ૊Ήʹ͸·ͩ·ͩރΕͯͳͦ͞͏

Spring Boot ͕͋Δࠓɾɾɾ

View Slide

>
< 7
ͦ͜ͰɺSpring Boot ʂ
SPRING INITIALIZR Λ࢖͑͹ɺಈ͘ΞϓϦέʔγϣϯ͕͙͢Ͱ͖Δɻ
https://start.spring.io/
1. SPRING INITIALIZR ʹΞΫηε͠ɺ࢖͍͍ͨػೳΛબ୒͠ɺDLɻ
2. DL ͨ͠ Zip Λղౚ͢Δɻ
3. mvn spring-boot:run ͢Δɻ 
ʢ΋͘͠͸ IDE ͔Β main ϝιουΛୟ͘ʣ

View Slide

>
< 8
[demo] mvn spring-boot:run
[INFO] Scanning for projects...
[INFO]
[INFO] ------------------------------------------------------------------------
[INFO] Building demo 0.0.1-SNAPSHOT
[INFO] ------------------------------------------------------------------------
[INFO]
[INFO] >>> spring-boot-maven-plugin:1.3.3.RELEASE:run (default-cli) > test-compile @ demo >>>
[INFO]
[INFO] --- maven-resources-plugin:2.6:resources (default-resources) @ demo ---
[INFO] Using 'UTF-8' encoding to copy filtered resources.
[INFO] Copying 1 resource
[INFO] Copying 0 resource
[INFO]
[INFO] --- maven-compiler-plugin:3.1:compile (default-compile) @ demo ---
[INFO] Changes detected - recompiling the module!
[INFO] Compiling 1 source file to /Users/sinsengumi/Downloads/spring-init/demo/target/classes
[INFO]
[INFO] --- maven-resources-plugin:2.6:testResources (default-testResources) @ demo ---
[INFO] Using 'UTF-8' encoding to copy filtered resources.
[INFO] skip non existing resourceDirectory /Users/sinsengumi/Downloads/spring-init/demo/src/test/resources
[INFO]
[INFO] --- maven-compiler-plugin:3.1:testCompile (default-testCompile) @ demo ---
[INFO] Changes detected - recompiling the module!
[INFO] Compiling 1 source file to /Users/sinsengumi/Downloads/spring-init/demo/target/test-classes
[INFO]
[INFO] <<< spring-boot-maven-plugin:1.3.3.RELEASE:run (default-cli) < test-compile @ demo <<<
[INFO]
[INFO] --- spring-boot-maven-plugin:1.3.3.RELEASE:run (default-cli) @ demo ---
. ____ _ __ _ _
/\\ / ___'_ __ _ _(_)_ __ __ _ \ \ \ \
( ( )\___ | '_ | '_| | '_ \/ _` | \ \ \ \
\\/ ___)| |_)| | | | | || (_| | ) ) ) )
' |____| .__|_| |_|_| |_\__, | / / / /
=========|_|==============|___/=/_/_/_/
:: Spring Boot :: (v1.3.3.RELEASE)
͓͓ʔײಈ

View Slide

>
< 9
Boot ͸ૣ͍͕ɾɾɾʢ1ʣ
ʮΑʔ͠ɺ͡Ό͋ૣ଎࡞Γ࢝ΊͪΌ͏ͧʔʯ
਺෼ޙɾɾɾɾ
ʮ͑ʔͱɺྫ֎ॲཧ͸Ͳ͏͢Δͷ͕͍͍Μͩʁʯ
ʮτϥϯβΫγϣϯ͔͚͍ͨΜ͚ͩͲɾɾɾʯ

View Slide

>
< 10

View Slide

>
< 11

View Slide

>
< 12
Boot ͸͔֬ʹૣ͍ʂ
͕ɺ͔ͦ͜Β͸΋͸΍ Spring ͷੈքɻࢼ͞ΕΔ Spring ྗɾɾɾʂ
ʢ୔ࢁͷϥΠϒϥϦɺ૊Έ߹ΘͤɺSpring ͷ஌ࣝʣ
ͦ͜ͰɺຊηογϣϯͰ͸ɺ
Spring Boot Λ༻͍ͨී௨ͷ Web ΞϓϦέʔγϣϯΛ࡞੒͢Δࡍʹɺ
࠷ॳʹ΍Δ΂͖ΞϓϦέʔγϣϯج൫ͷߏஙΛ Spring ͰͲ͏͢Δͷ͔ʁ
Λத৺ʹ͓࿩͠͠·͢ɻ
ΰʔϧ͸
ʰػೳ։ൃ Readyʱͳঢ়ଶΛ࡞Δ͜ͱ

View Slide

>
< 13
େํ਑
• Spring ͷํ਑ʹै͏ʢRail ʹ৐Δతͳʣ 
@Controller, @Service, @Repository Λ࢖ͬͨجຊతͳϨΠϠʔߏ੒
• ίʔυΛͳΔ΂͘ॻ͔ͳ͍ 
ॻ͔ͳ͍ͨΊʹϑϨʔϜϫʔΫΛ࢖͍ͬͯΔ
• ۀ຿ػೳΛ࡞Δ࣌ʹɺ͸·Βͳ͍ɺ೰·ͳ͍Α͏ͳઃܭ

View Slide

>
<
01
URL Layout
63-ઃܭ
14

View Slide

>
< 15
• Ͳ͏͍͏ URL ମܥ͕͋Δ͔ʁ 
ݴ͍׵͑ΔͱɺʮαʔϏε෼ׂʯΛݕ౼͢Δͱ͍͏͜ͱ 
• ओʹɺϢʔβը໘ɺ؅ཧը໘ɺAPIʢ֎޲͖ɺ಺޲͖ʣ౳Λ 
ಉҰΞϓϦ্ʹࡌͤΔ͔ʁɺผΞϓϦʹ͢Δ͔ʁͱ͍͏࿩ɻ 
microservices తʹ͸෼ׂͨ͠΄͏͕ྑ͍͕ɺ 
Πϯϑϥίετͷ૿େ΍ɺΞϓϦɾϏδωεͷن໛ʹ΋ΑΔ͸ͣɻ
͍͖ͳΓ Spring ͱ͸ؔ܎ͳ͍࿩Ͱ͕͢ɺ
Web ΞϓϦΛ࡞Δ্Ͱ؊৺ͳͱ͜ΖͳͷͰ·ͣ͸͡Ίʹݕ౼͠·͢ɻ
ػೳ։ൃΛ͢Δલʹ URL ઃܭʹ͍ͭͯߟ͍͑ͨ͜ͱʢ1ʣ

View Slide

>
< 16
• Ϣʔβը໘ [ / ]
• ؅ཧը໘ [ /admin ]
• API ֎޲͖ [ /api ]
• API ಺޲͖ [ /api/internal ]
ຊηογϣϯͰ͸
ಉҰΞϓϦ಺ʹ͜ΕΒΛڞଘͤ͞Δ͜ͱΛલఏͱͯ͠࿩Λ͠·͢ɻ
ػೳ։ൃΛ͢Δલʹ URL ઃܭʹ͍ͭͯߟ͍͑ͨ͜ͱʢ2ʣ

View Slide

>
< 17
URL ઃܭΛίʔυͰදݱ͓ͯ͘͠ʢ1ʣ
Ϣʔβը໘ɺ؅ཧը໘ɺAPIʢ֎޲͖ɺ಺޲͖ʣΛ enum Ͱఆٛ͢Δɻ
@AllArgsConstructor
@Getter
public enum Site {
API_INTERNAL("APIʢ಺޲͖ʣ", "/api/internal", false),
API_EXTERNAL("APIʢ֎޲͖ʣ", "/api", false),
SCREEN_ADMIN("؅ཧը໘", "/admin", true),
SCREEN_USER("Ϣʔβը໘", "", true);
private String label;
private String baseUrl;
private boolean protectCsrf;
// ྻڍࢠͷॱ൪Λม͑Δͱɺޡ൑ఆ͢ΔͷͰ஫ҙɻ
public static Site of(String url) {
if (url == null) {
return SCREEN_USER;
}
for (Site location : values()) {
if (url.startsWith(location.baseUrl)) {
return location;
}
}
return SCREEN_USER;
}
}
enum Ͱ URL ମܥΛఆٛ͢Δ
URL ͔ΒͲ͜ʹΞΫηε͍ͯ͠Δ͔
Λ൑ఆ͢ΔϝιουΛ༻ҙ͓ͯ͘͠

View Slide

>
< 18
URL ઃܭΛίʔυͰදݱ͓ͯ͘͠ʢ2ʣ
ίʔυͱͯ͠දݱ͢Δ͜ͱͰɺ͍ΖΜͳ৔໘Ͱ࢖͑ΔͷͰɺΦεεϝͰ͢ɻ
ʢﬁlter, interceptor ͷఆٛΛ͢ΔࡍɺύεΛϋʔυίʔυ͠ͳ͍ͰࡁΉͳͲɻ
ৄ͘͠͸ޙड़ʣ
΋ͪΖΜɺController Ϋϥεͷ package ΋ Site ຖʹ෼͚·͢ɻ
src/main/java/com/example
!"" Application.java
!"" controller
# !"" Site.java
# !"" api
# # !"" external
# # # $"" HelloController.java
# # $"" internal
# # $"" HelloController.java
# $"" screen
# !"" admin
# # $"" HelloController.java
# $"" user
# $"" HelloController.java

View Slide

>
<
02
Exception
ྫ֎
19

View Slide

>
< 20
ػೳ։ൃΛ͢Δલʹྫ֎ʹ͍ͭͯߟ͍͑ͨ͜ͱʢ1ʣ
• ྫ֎͕ى͖ͨ࣌ʹԿΛ͢Δ͔ʁʢϩΪϯάɺ௨஌ etcʣ
• ྫ֎͕ى͖ͨ࣌ʹͲ͜΁ߦ͔͘ʁʢը໘ͷ৔߹ɺAPI ͷ৔߹ʣ
• εςʔλείʔυ΋ͪΌΜͱઃఆ͍ͨ͠
• ݕࠪྫ֎ɺඇݕࠪྫ֎ͷ࢖༻ํ਑
• ͢΂ͯͷྫ֎Λิ଍͍ͨ͠ʢTomcat ͷΤϥʔը໘ग़Δͱ͔μα͍ʣ
• ࢖͍ͬͯΔϑϨʔϜϫʔΫͰ͸ɺͲ͏ॲཧ͢΂͖͔ఆ͍ٛͯ͠Δ͔ʁ  
ʢSpring తʹ͸ʁʣ

View Slide

>
< 21
ػೳ։ൃΛ͢Δલʹྫ֎ʹ͍ͭͯߟ͍͑ͨ͜ͱʢ2ʣ
౷Ұͨ͠ྫ֎ॲཧΛ͍ͨ͠
FW ૚ʹඇݕࠪྫ֎Λ Throw ͢Δ͚ͩ

View Slide

>
< 22
Ͱ͸ Spring Boot (MVC) Ͱ͸Ͳ͏͢Δ͔ʁʢ1ʣ
• Filter
• ˏController ͷ Interceptor
• ݸผͷ @Controller ʹ @ExceptionHandler
• @ResponseStatus Λ෇༩ͨ͠ྫ֎Λ Throw
• @ControllerAdvice Ͱ @ExceptionHandler
• Spring Boot ͷ ErrorController
΍Γํ͕ͨ͘͞Μ͋Γ·͢ɻ

View Slide

>
< 23
• status code ͕ηοτ͞Ε͍ͯͳ͍
• ͢΂ͯͷྫ֎Λิ଍Ͱ͖ͳ͍ʢϓϨθϯςʔγϣϯ૚ɺ404 Τϥʔ౳ʣ
άϩʔόϧͳྫ֎ॲཧͷํ๏ͱͯ͠ɺ
άάΔͱΑ͘ग़ͯ͘Δ @ControllerAdvice ͸͍͔ͭ͘໰୊͕͋Δɻ
@Slf4j
@ControllerAdvice(“com.example.controller.admin")
public class GlobalControllerAdvice {
@ExceptionHandler(Exception.class)
public String handleException(Exception e, HttpServletResponse response, Model model) {
// status code ͸ઃఆ͞Εͯͳ͍ͷͰɺ͜͜Ͱઃఆ͢Δɻ
// ͲΜͳ status code Λઃఆ͢Δ͔͸ Exception ͔Β൑ఆ͢Δඞཁ͕͋Δ͕ɺಠࣗྫ֎ͷ৔߹͸͍͍͕ɺ
// Spring ͕౤͛ͯ͘Δྫ֎ʢMissingServletRequestParameterException ͱ͔ʣ͸ɾɾɾɾ
response.setStatus(HttpStatus.INTERNAL_SERVER_ERROR.value());
log.error("Error!!", e);
model.addAttribute("stackTrace", ExceptionUtils.getStackTrace(e));
return "admin/error";
}
}

View Slide

>
< 24
1. ExceptionHandlerExceptionResolver
2. ResponseStatusExceptionResolver
3. DefaultHandlerExceptionResolver
Spring Boot Ͱ͸ɺErrorController Ͱ΍Δͷ͕Φεεϝɻ
ErrorController ͸͜ΕΒ͕ద༻͞Εͨޙʹݺ͹ΕΔɺ
web.xml ͷ error-page ૬౰ͷॲཧɻ
ʢ͜Ε͸ Spring MVC Ͱ͸ͳ͘ɺ૊ΈࠐΈͷ ServletContainer ͕ॲཧ͍ͯ͠Δʣ
σϑΥϧτͰ͸ɺʮWhitelabel Error PageʯΛදࣔ͢Δ
BasicErrorController ͱ͍͏΋ͷ͕࣮૷͞Ε͍ͯΔɻ
͜ΕΛಠࣗͷ ErrorController ʹஔ͖׵͑Δɻ
Spring MVC Ͱ͸ɺҎԼͷ HandlerExceptionResolver ͕ॱʹݺ͹ΕΔɻ
@ExceptionHandler Λॲཧ͢Δ
@ResponseStatus Λॲཧ͢Δ
FWʢSpringMVCʣͰى͖ͨྫ֎ Λॲཧ͢Δ

View Slide

>
< 25
ϒϥ΢βʢAccept: text/htmlʣͰΞΫηε͢Δͱɺը໘Λฦ͢ɻ
[~] curl http://localhost:8080/admin/hello
{
"timestamp" : 1462114091743,
"status" : 400,
"error" : "Bad Request",
"exception" : "org.springframework.web.bind.MissingServletRequestParameterException",
"message" : "Required String parameter 'name' is not present",
"path" : "/admin/hello"
}
ϒϥ΢βҎ֎ͰΞΫηε͢ΔͱɺJSON Λฦ͢ɻ

View Slide

>
< 26
1. ΧελϜ ErrorController ͷ࣮૷ʢΤϥʔॲཧΛҰखʹҾ͖ड͚Δʣ
2. ֤ Site ຖͷΤϥʔॲཧͷ࣮૷ʢը໘ͳΒΤϥʔը໘ɺAPI ͳΒ JSONʣ
3. ಠࣗྫ֎ʹ͸ @ResponseStatus Λ͚ͭΔ
͢΂ͯͷΤϥʔΛิ଍ͭͭ͠ɺ͍͍ײ͡ʹΤϥʔΛॲཧ͢Δɻ
application.properties
# server.error.path Λઃఆ͢ΔʢσϑΥϧτ͸ /errorʣ
server.error.path=/globalError
# 404 ͷ࣌΋ྫ֎Λൃੜͤ͞Δ
spring.mvc.throw-exception-if-no-handler-found=true
४උͱͯ͠ɺɺ

View Slide

>
<
@Slf4j
@Controller
public class GlobalErrorController implements ErrorController {
public static final String ERROR_EXCEPTION = "com.example.demo.error.exception";
@Value("${server.error.path:${error.path:/error}}")
private String errorPath;
@Autowired
private ErrorAttributes errorAttributes;
@Override
public String getErrorPath() {
return errorPath;
}
@RequestMapping(value = "${server.error.path:${error.path:/error}}")
public String error(HttpServletRequest req) {
Throwable error = errorAttributes.getError(new ServletRequestAttributes(req));
String requestURI = (String) req.getAttribute("javax.servlet.forward.request_uri");
Site site = Site.of(requestURI);
req.setAttribute(ERROR_EXCEPTION, error);
log.warn("Caught an error. site = {}, requestURI = {}", site, requestURI);
return "forward:" + site.getBaseUrl() + "/error";
}
}
ΧελϜ ErrorController ͷ࣮૷
27
ErrorController ΠϯλϑΣʔεͷ࣮૷
@RequestMapping ʹΤϥʔ࣌ͷ
࣮ॲཧΛهड़͢Δ
Ͳ͜ͰΤϥʔ͕ग़͔ͨΛ൑ఆ͢Δ
Τϥʔ৘ใΛه࿥͠ɺ

֤ Site ͷΤϥʔॲཧʹ forward ͢Δ

View Slide

>
< 28
@Slf4j
@RestController
public class ErrorController {
@RequestMapping(value = "/api/internal/error")
public ErrorResponse error(HttpServletRequest request) {
Throwable e = (Throwable) request.getAttribute(GlobalErrorController.ERROR_EXCEPTION);
String errorCode = RandomStringUtils.randomAlphabetic(15);
log.error(e.getMessage(), e);
return ErrorResponse.build(errorCode, e);
}
}
API ͷΤϥʔॲཧ
@Slf4j
@Controller
public class ErrorController {
@RequestMapping("/admin/error")
public String error(HttpServletRequest request, Model model) {
Throwable e = (Throwable) request.getAttribute(GlobalErrorController.ERROR_EXCEPTION);
String errorCode = RandomStringUtils.randomAlphabetic(15);
log.error(e.getMessage(), e);
model.addAttribute("errorCode", errorCode);
model.addAttribute("stackTrace", ExceptionUtils.getStackTrace(e));
return "screen/admin/error";
}
}
؅ཧը໘ͷΤϥʔॲཧ
ϩάΛు͍ͨΓɺ௨஌Λͨ͠Γ
ϩάΛు͍ͨΓɺ௨஌Λͨ͠Γ
API ͳͷͰɺΤϥʔϨεϙϯεΛฦ͢
ը໘ͳͷͰɺΤϥʔը໘Λฦ͢

View Slide

>
< 29
// γεςϜΤϥʔ
@ResponseStatus(HttpStatus.INTERNAL_SERVER_ERROR)
public class ApplicationException extends RuntimeException {
public ApplicationException(String message) {
super(message);
}
}
// ೝՄΤϥʔ
@ResponseStatus(HttpStatus.FORBIDDEN)
public class AuthorizationException extends RuntimeException {
public AuthorizationException(String message) {
super(message);
}
}
// NotFound Τϥʔ
@ResponseStatus(HttpStatus.NOT_FOUND)
public class ItemNotFoundException extends RuntimeException {
public ItemNotFoundException(String message) {
super(message);
}
}
@ResponseStatus Λ෇͚ͨྫ֎ΛϏδωεϩδοΫ͔Β Throw ͢Δ

View Slide

>
< 30
࣮ྫʢAPI ͷ৔߹ʣʢ1ʣ
@RestController
public class HelloController {
@RequestMapping("/api/internal/hello")
public String hello(@RequestParam("name") String name) {
if (name.equals("yoshida")) {
throw new AuthorizationException("AuthorizationException error.");
}
return "Hello. " + name + "͞Μ";
}
}
@ResponseStatus(HttpStatus.FORBIDDEN) ͷ͍ͭͨ
ྫ֎Λ Throw ͢Δ
name ͕ແ͍ͱ͖͸ Spring ͔Β
MissingServletRequestParameterException ͕ Throw ͞ΕΔ

View Slide

>
< 31
࣮ྫʢAPI ͷ৔߹ʣʢ2ʣ
[~] curl -v http://localhost:8080/api/internal/hello?name=yoshida
...
< HTTP/1.1 403 Forbidden
...
{
"code" : "XNBzNfxhiJedzcj",
"message" : "AuthorizationException error.",
"errorClass" : "com.example.exception.AuthorizationException"
}
[~] curl -v http://localhost:8080/api/internal/hello
...
< HTTP/1.1 400 Bad Request
...
{
"code" : "oQhiQAZUmIUMplO",
"message" : "Required String parameter 'name' is not present",
"errorClass" : "org.springframework.web.bind.MissingServletRequestParameterException"
}
400 ͕ઃఆ͞Ε͍ͯΔ

View Slide

>
< 32
࣮ྫʢը໘ͷ৔߹ʣʢ1ʣ
@Controller
public class HelloController {
@RequestMapping("/admin/hello")
public String hello(@RequestParam("name") String name, Model model) {
if (name.equals("yoshida")) {
throw new AuthorizationException("AuthorizationException error.");
}
model.addAttribute("name", name);
return "screen/admin/hello";
}
}
@ResponseStatus(HttpStatus.FORBIDDEN) ͷ͍ͭͨ
ྫ֎Λ Throw ͢Δ
name ͕ແ͍ͱ͖͸ Spring ͔Β
MissingServletRequestParameterException ͕ Throw ͞ΕΔ

View Slide

>
< 33

View Slide

>
< 34

View Slide

>
< 35
·ͱΊ ɿ ྫ֎
@ResponseStatus Λ෇͚ͨඇݕࠪྫ֎Λ Throw ͢Δ͚ͩ
͜ΕͰɺྫ֎͸
ͱ͍͏ɺػೳ։ൃ Ready ͳঢ়ଶʹͳͬͨʂ

View Slide

>
<
03
Transaction
τϥϯβΫγϣϯ
36

View Slide

>
< 37
ػೳ։ൃΛ͢ΔલʹτϥϯβΫγϣϯʹ͍ͭͯߟ͍͑ͨ͜ͱ
ʢOR Ϛούʔ͸ɺ͓޷Έͷ΋ͷΛ࢖͍·͠ΐ͏ɻ
ͪͳΈʹɺฐࣾͰ͸ MyBatis, Doma2 ͕Α͘࢖ΘΕΔʣ
• τϥϯβΫγϣϯڥքΛͲ͜ʹ͢Δ͔ʁʢController ૚ or Service ૚ʣ
• Controller ૚ʹ͢Δͱɺ 
్தͰҰ౓ commit ͍ͨ͠৔߹ͳͲྫ֎ରԠ͕ΊΜͲ͍͘͞
• τϥϯβΫγϣϯ͸୹͚Ε͹୹͍΄͏͕Α͍ 
• ϏδωεϩδοΫʹτϥϯβΫγϣϯॲཧͷίʔυΛೖΕͨ͘ͳ͍
• connection.commit, connection.rollback ͱ͔ɾɾɾ
• ౷ҰతͳτϥϯβΫγϣϯॲཧΛ͍ͨ͠

View Slide

>
< 38
Ͱ͸ Spring Boot (Tx) Ͱ͸Ͳ͏͢Δ͔ʁʢ1ʣ
@Service ͷϝιουʢ΋͘͠͸Ϋϥεʣʹ @Transactional Λ෇͚Δɻ
@Service
public class UserService {
@Autowired
private UserRepository repository;
@Transactional
public int create(User user) {
return repository.create(user);
}
@Transactional
public int update(User user) {
return repository.update(user);
}
public User findById(int id) {
return repository.findById(id);
}
}
@Transactional ͷϝιου͕ݺ͹ΕͨΒɺ
τϥϯβΫγϣϯ͕։࢝͞ΕΔɻ
ϝιουΛൈ͚Ε͹ commit,
ඇݕࠪྫ֎͕ൃੜͨ͠৔߹͸ rollback ɻ
ࡉ͔͍ઃఆ͸
@Transactional ͷଐੑͰઃఆՄೳ

View Slide

>
< 39
͔͠͠ɺຖճ @Transactional Λॻ͍͍ͯ͘ͷ͸ͩΔ͍ɻ
ݸผʹ෇͚Δɾ෇͚ͳ͍ͷ൑அΛͨ͘͠ͳ͍ɻ
෇͚Δ΂͖ϝιουʹ෇͍͍ͯͳ͍΄͏͕໰୊ɻ
※ ͜ͷ෦෼͸͋Δఔ౓ׂΓ੾Γ
τϥϯβΫγϣϯॲཧͷ։࢝ɾऴྃίετΛे෼ʹ௿͍ͷͰɺ
select only Ͱ΋τϥϯβΫγϣϯॲཧΛ։࢝ͯ͠໰୊ͳ͍ͱ͍͏൑அɻ
͢΂ͯͷ Service ϝιουʹ
@Transactional Λ͚ͭΔ

View Slide

>
< 40
AOP Λ࢖ͬͯɺ
@Service ͷ͢΂ͯͷϝιουʹɺ@Transactional Λ෇༩͢Δɻ
@SpringBootApplication
@ImportResource("classpath:transaction-context.xml")
public class Application {
public static void main(String[] args) {
SpringApplication.run(Application.class, args);
}
}
※ Java Config Ͱ͸࣮ݱͰ͖ͳ͍Έ͍ͨɻ
http://stackoverflow.com/questions/14068525/javaconfig-replacing-
aopadvisor-and-txadvice
http://qiita.com/ksby/items/2ea40c5455c31870bd7c

View Slide

>
<

transaction-context.xml
41
com.example.service ഑Լͷ @Service ͕෇͍͍ͯΔ৔ॴ
͢΂ͯͷϝιουʹ෇༩͢Δͷ͕໰୊͕͋Δ৔߹͸ɺ
໋໊ن໿ʢcreate*, update* ʹͷΈ෇༩ʣͰɺ෇༩ର৅ΛܾΊΔͷ΋͋Γɻ

View Slide

>
< 42
·ͱΊ ɿ τϥϯβΫγϣϯ
Service ૚͕τϥϯβΫγϣϯڥքʢࣗಈʣ
͜ΕͰɺτϥϯβΫγϣϯ͸

View Slide

>
<
04
Batch
όον
43

View Slide

>
< 44
ػೳ։ൃΛ͢Δલʹόονʹ͍ͭͯߟ͍͑ͨ͜ͱʢ1ʣ
Web ΞϓϦͱ͸͍͑ɺಛఆͷ࣌ؒʹԿ͔Λ͍ͨ͠ͱ͏ཁ݅͸Α͋͘Δɻ
• ձһͷ஀ੜ೔ʹ͓஀ੜ೔ϙΠϯτΛਐఄ͢Δ
• ೔࣍Ͱɺ౷ܭ৘ใΛϝʔϧͰ୲౰ऀʹૹΓ͍ͨ
• ΩϡʔΛॲཧ͢ΔʢCSV ΞοϓϩʔυͰେྔొ࿥ͳͲʣ
• ΞΫηεͷগͳ͍ਂ໷ʹΩϟογϡΛΫϦΞ͍ͨ͠

View Slide

>
< 45
ػೳ։ൃΛ͢Δલʹόονʹ͍ͭͯߟ͍͑ͨ͜ͱʢ2ʣ
δϣϒεέδϡʔϥΛݕ౼͢Δɻ
• JP1 ౳ͷ঎༻੡඼࢖͏
• ͓ۚͳ͍͠ɾɾɾ
• Rundeck ͱ͔ Azkaban ͋ͨΓͷ OSS Λ࢖͏
• ߏங͕ΊΜͲͦ͘͞͏ɾɾɾ
• cron
• όονͷ؅ཧ͕೉͍͠
• ݁ہ͸ Web ΞϓϦͷΤϯυϙΠϯτʹΞΫηε͢Δ͚ͩͰ͠ΐʁ
• AWS ͷ Lambda Scheduled Event Ͱࠓ෩ͷδϣϒ؅ཧͩͥʔ
• ݁ہ͸ Web ΞϓϦͷʢུ
΋ͬͱ؆୯ʹόονΛॻ͖͍ͨ

View Slide

>
< 46
Ͱ͸ Spring Boot Ͱ͸Ͳ͏͢Δ͔ʁʢ1ʣ
Spring ͳΒ TaskScheduler ͕࢖͑Δɻ
@EnableScheduling
public class Application {
}
}
@Slf4j
@Component
public class SampleTask {
@Scheduled(cron = "*/1 * * * * *")
public void echo() {
log.info("Do batch.. {}", new Date());
}
}
@Scheduled Ͱࢦఆ࣌ࠁʹॲཧΛ࣮ߦͰ͖Δɻ
ࢦఆ࣌ࠁͷଞʹ΋׬ྃ࣌఺͔Βࢦఆ࣌ࠁޙʹىಈͱ͍ͬͨॻ͖ํ΋Ͱ͖Δɻ

View Slide

>
< 47
2016-04-24 15:18:20 INFO [pool-1-thread-1] SampleTask - Do batch.. Sun Apr 24 15:18:20 JST 2016
2016-04-24 15:18:21 INFO [pool-1-thread-1] SampleTask - Do batch.. Sun Apr 24 15:18:21 JST 2016
؆୯ʂʂ
ͱ͸ݴ͑ɺ࣮ۀ຿Ͱ࢖͏ͨΊʹɺ΋͏ͪΐͬͱ޻෉͠·͠ΐ͏ɻ
• ෳ਺εϨουͰಈ͘Α͏ʹ͢Δ
• ಛఆͷαʔόͷΈͰಈ͘Α͏ʹ͢Δ
• όονͷ։࢝ɾऴྃ࣌ʹϩάΛग़͢ʢ࣮ߦ࣌ؒͱ͔ʣ
• αʔόఀࢭ࣌ʹ଴ͭ

View Slide

>
< 48
@EnableScheduling
public class Application implements SchedulingConfigurer {
}
@Override
public void configureTasks(ScheduledTaskRegistrar taskRegistrar) {
taskRegistrar.setScheduler(taskScheduler());
}
@Bean(destroyMethod = "shutdown")
public Executor taskScheduler() {
ThreadPoolTaskScheduler threadPool = new ThreadPoolTaskScheduler();
threadPool.setPoolSize(5);
// shutdown ࣌ʹ Task ͷ׬ྃΛ଴ͭʢ࠷େ10෼ؒʣ
threadPool.setWaitForTasksToCompleteOnShutdown(true);
threadPool.setAwaitTerminationSeconds(60 * 10);
return threadPool;
}
}
conﬁgureTasks ͷதͰɺExecutorService
Λ࣮૷ͨ͠ΫϥεΛηοτ͢Δ
Thread ͷ਺Λ૿΍͢
αʔόఀࢭ࣌ʹ଴ͭΑ͏ʹ͢Δ
Scheduling ͷΧελϚΠζ͸ɺ
SchedulingConﬁgurer ΠϯλϑΣʔεΛ࣮૷͢Δ͜ͱͰ࣮ݱՄೳɻ

View Slide

>
< 49
@Slf4j
@Aspect
@Component
public class TaskInterceptor {
@Value(“${batch.exec.host}”) String batchExecHost;
@Around("execution(* com.example.task..*.*(..)) && @annotation(org.springframework.scheduling.annotation.Scheduled)")
public Object around(ProceedingJoinPoint pjp) throws Throwable {
String methodName = pjp.getSignature().getName();
String currentThread = Thread.currentThread().getName();
// ࣮ߦνΣοΫ
if (!allowedBatchExec()) {
log.info("Skip batch ({}): {}", currentThread, methodName);
return null;
}
log.info("Begin batch ({}): {}", currentThread, methodName);
Stopwatch stopWatch = Stopwatch.createStarted();
try {
return pjp.proceed();
} catch (Exception e) {
log.error("batch error: {}", methodName, e);
return null;
} finally {
log.info("End batch ({}): {}, elapsed = {} (ms)", currentThread, methodName,
stopWatch.elapsed(TimeUnit.MILLISECONDS));
}
}
private boolean allowedBatchExec() {
if (getHostName().equals(batchExecHost)) {
return true;
}
return false;
}
}
AOP Ͱόονͷ࣮ߦ੍ޚΛ࣮ݱ͢Δ
ಛఆͷϗετͰ͔͠ಈ͔ͳ͍Α͏ʹ͢Δ
։࢝ɾऴྃɾܭଌϩάΛग़͢

View Slide

>
< 50
·ͱΊ ɿ όον
όονॲཧ͕େྔʹ͋Δɺ
όονॲཧ͕Ϗδωε্ɺ݁ߏॏཁɺ౳ͷཁ͕݅͋Δ৔߹͸ɺ
Spring ͳΒ Spring Batch ΍ Quartz Λݕ౼͢Δͷ΋͋Γɻ
ಛఆʹύοέʔδ഑Լʹ @Scheduled Λ͚ͭͨϝιουΛ࣮૷͢Δ
͜ΕͰɺόονॲཧ͸

View Slide

>
<
05
Property
ϓϩύςΟ
51

View Slide

>
< 52
ػೳ։ൃΛ͢ΔલʹϓϩύςΟʹ͍ͭͯߟ͍͑ͨ͜ͱ
• ຊ൪؀ڥ΍։ൃ؀ڥͳͲͰઃఆϑΝΠϧΛ෼͚͍ͨ
• DB ͷ઀ଓઌΛม͍͑ͨ
• ։ൃ࣌͸ messageSource ͷ cache ͸ແ͠ʹ͍ͨ͠౳ͳͲ
• ֎෦ʢOS؀ڥม਺౳ʣ͔ΒઃఆΛ্ॻ͖Ͱ͖ΔΑ͏ʹ͍ͨ͠
• application.properties ͸όʔδϣϯ؅ཧର৅ʹ͍ͯ͠Δ͕ɺ 
DB ͷύεϫʔυ౳ͷػີ৘ใ͸ଞͷਓ͔ΒݟΒΕͳ͍Α͏ʹ͍ͨ͠ɻ
• Twelve-Factor App ͷཁૉͱͯ͠΋ॏཁ

View Slide

>
< 53
ຊ൪؀ڥ΍։ൃ؀ڥͳͲͰઃఆϑΝΠϧΛ෼͚͍ͨ
Spring Boot Ͱ͸ɺProﬁle ͕࢖͑Δɻ
mvn spring-boot:run -Drun.jvmArguments="-Dspring.profiles.active=development"
# application.properties, application-development.properties ͕ಡΈࠐ·ΕΔ
mvn spring-boot:run -Drun.jvmArguments="-Dspring.profiles.active=test"
# application.properties, application-test.properties ͕ಡΈࠐ·ΕΔ
jar ͷ৔߹͸ɺ
java -jar -Dspring.profiles.active=production hoge.jar

View Slide

>
< 54
֎෦ʢOS؀ڥม਺౳ʣ͔ΒઃఆΛ্ॻ͖Ͱ͖ΔΑ͏ʹ͍ͨ͠ʢ1ʣ
Spring Boot Ͱ͸ɺϓϩύςΟ͸ҎԼͷॱংͰಡΈࠐ·ΕΔʢ্ͷํ͕༏ઌʣ
1. Command line arguments.
2. Properties from SPRING_APPLICATION_JSON (inline JSON embedded in an environment
variable or system property)
3. ServletConfig init parameters.
4. ServletContext init parameters.
5. JNDI attributes from java:comp/env.
6. Java System properties (System.getProperties()).
7. OS environment variables.
8. A RandomValuePropertySource that only has properties in random.*.
9. Profile-specific application properties outside of your packaged jar (application-
{profile}.properties and YAML variants)
10.Profile-specific application properties packaged inside your jar (application-
{profile}.properties and YAML variants)
11.Application properties outside of your packaged jar (application.properties and YAML
variants).
12.Application properties packaged inside your jar (application.properties and YAML variants).
[email protected] annotations on your @Configuration classes.
14.Default properties (specified using SpringApplication.setDefaultProperties).

View Slide

>
< 55
֎෦ʢOS؀ڥม਺౳ʣ͔ΒઃఆΛ্ॻ͖Ͱ͖ΔΑ͏ʹ͍ͨ͠ʢ2ʣ
application-production.properties spring.datasource.password="dummy"
SPRING_DATASOURCE_PASSWORD="hogehoge"
OS ؀ڥม਺
Spring Boot Ͱ͸ɺRelaxed binding ͷػೳ͕͋ΔͷͰɺ্هͷม਺͸ಉ͡ɻ
Property Note
person.firstName Standard camel case syntax.
person.first-name Dashed notation, recommended for use in .properties and .yml files.
PERSON_FIRST_NAME
Upper case format. Recommended when using a system environment
variables.
http://docs.spring.io/spring-boot/docs/current/reference/htmlsingle/#boot-
features-external-config-relaxed-binding

View Slide

>
< 56
·ͱΊ ɿ ϓϩύςΟ
֤؀ڥผͷϓϩύςΟ͸ɺ֤؀ڥ༻ͷϑΝΠϧʹهड़͢Δ
͜ΕͰɺϓϩύςΟʹؔͯ͠͸
ػີ৘ใ͸ OS ؀ڥม਺Ͱ্ॻ͖

View Slide

>
<
06
Logging
ϩΪϯά
57

View Slide

>
< 58
ػೳ։ൃΛ͢ΔલʹϩΪϯάʹ͍ͭͯߟ͍͑ͨ͜ͱ
• log4j ͸͍͍Ճݮʹ΍Ί͍ͨ
• ग़ྗจࣈྻͷߏஙͱ͔ΊΜͲ͍͘͞
• isDebugEnabled ΋ΊΜͲ͍͘͞
• log4j ͸طʹ EOL
• ϩάΠϯ͍ͯ͠Δ userIdɺrequestId ౳͸ࣗಈͰ෇͘Α͏ʹ͍ͨ͠
• ͜ΕΒΛϩάʹग़͓ͯ͘͠ͱɺো֐࣌ͷݪҼڀ໌ʹศརɻ 
ಛʹ requestId ʹؔͯ͠͸ microservices తʹ։ൃ͍ͯ͠Δ৔߹ɺ 
αʔϏεؒͷϩάͷඥ෇͚ͱͯ͠ಛʹॏཁɻ
• ͨͩɺࣗ෼Ͱຖճॻ͘ͷ͸ͩΔ͍ɻ

View Slide

>
< 59
log4j ͸͍͍Ճݮʹ΍Ί͍ͨ
Spring Boot ͳΒ SLF4J + logback ͕σϑΥϧτ౥ࡌɻ
application.properties(.yml) Ͱ΋ઃఆมߋ͕Մೳ͕ͩɺ಺༰͸ݶΒΕΔɻ
logback-spring.xmlʢlogback.xml Ͱ͸ͳ͘ʣΛ༻ҙ͠·͠ΐ͏ɻ
logback-spring.xml ͱ͍͏ϑΝΠϧΛ༻ҙ͓ͯ͘͠ͱɺ
Logback extensionsʢಠࣗλάʣ͕࢖͑ΔͷͰศརɻ

defaultValue="localhost"/>

${fluentHost}
...

View Slide

>
< 60
ϩάΠϯ͍ͯ͠Δ userIdɺrequestId ౳͸ࣗಈͰ෇͘Α͏ʹ͍ͨ͠
MDC = Mapped Diagnostic ContextʢϚοϓԽ͞Εͨ਍அίϯςΩετʣ
Thread Local ͳ Map Λϩάͷ௥Ճ৘ใͱͯ͠ར༻Ͱ͖Δײ͡ɻ
Map ʹઃఆ͞Εͨ΋ͷ͸ɺࣗಈͰΫϦΞ͞Εͳ͍ͷͰɺ
ͪΌΜͱࣗ෼ͰΫϦΞ͢Δඞཁ͕͋Δɻ
Web ΞϓϦέʔγϣϯͷ৔߹͸ɺServlet Filter Ͱ࣮૷͞ΕΔ͜ͱ͕ଟ͍ɻ
͜͏͍͏࣌͸ MDC

View Slide

>
< 61
public class MDCLoggingFilter implements Filter {
private static final String KEY_REQUEST_ID = "REQUEST_ID";
private static final String KEY_LOGIN_USER_ID = "LOGIN_USER_ID";
@Override
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException,
ServletException {
putMDC(request);
try {
chain.doFilter(request, response);
} finally {
clearMDC();
}
}
private void putMDC(ServletRequest request) {
if (request instanceof HttpServletRequest) {
HttpServletRequest httpRequest = (HttpServletRequest) request;
String requestId = httpRequest.getHeader("X-Request-Id");
if (requestId != null) {
MDC.put(KEY_REQUEST_ID, requestId);
}
String loginUserId = "t-yoshida"; // session ౳͔ΒϢʔβ৘ใΛऔಘ
if (loginUserId != null) {
MDC.put(KEY_LOGIN_USER_ID, loginUserId);
}
}
}
private void clearMDC() {
MDC.remove(KEY_REQUEST_ID);
MDC.remove(KEY_LOGIN_USER_ID);
}
// লུ
}
MDC ʹ put ͢Δ
MDC ͔Β remove ͢Δ

View Slide

>
< 62

%d{ISO8601} %-5p [%t] %c{2} $%L$ - [%X{REQUEST_ID:-undefined}][%X{LOGIN_USER_ID:-
undefined}] %m%n

2016-05-02 21:45:12,490 INFO [http-nio-8080-exec-4] c.e.c.s.a.LogController (14) -
[ab939dfca5d57843ea4c695cab6f721d][t-yoshida] Log1
2016-05-02 21:45:12,491 INFO [http-nio-8080-exec-4] c.e.c.s.a.LogController (15) -
[ab939dfca5d57843ea4c695cab6f721d][t-yoshida] Log2
@Configuration
public class WebConfig extends WebMvcConfigurerAdapter {
@Bean
public FilterRegistrationBean mdcLoggingFilter() {
FilterRegistrationBean bean = new FilterRegistrationBean();
bean.setFilter(new MDCLoggingFilter());
bean.setOrder(1);
return bean;
}
}
Filter Λొ࿥͢Δ
MDC ͷ஋Λදࣔ͢Δ

View Slide

>
< 63
·ͱΊ ɿ ϩΪϯά
SLF4J + logback ͕࢖͑ͯɺuserId ౳͸ࣗ෼Ͱॻ͔ͳͯ͘Α͍
͜ΕͰɺϩΪϯάʹؔͯ͠͸

View Slide

>
<
07
Security
ηΩϡϦςΟ
64

View Slide

>
< 65
ػೳ։ൃΛ͢ΔલʹηΩϡϦςΟʹ͍ͭͯߟ͍͑ͨ͜ͱ
• XSS
• ςϯϓϨʔτΤϯδϯͰࣗಈͰΤεέʔϓ͞Ε͍ͯΔ͔ʁ
• SQL Injection
• OR ϚούʔͰద੾ʹ Injection ରࡦ͕ͳ͞Ε͍ͯΔ͔ʁ
• LIKE ԋࢉࢠ΍ ORDER BY ۟΁ͷόΠϯυม਺ͷڍಈ
• CSRF
• ࣗ෼Ͱ࡞Γࠐ·ͣɺ؆୯ʹରࡦ͕Ͱ͖Δ͔ʁ
• Http Security HeadersʢList of useful HTTP headers – OWASPʣ
• ؆୯ʹઃఆͰ͖ΔͷͰɺ΍͓͖͍ͬͯͨɻ
• ϥΠϒϥϦʢjarʣͷΞοϓσʔτ
• pom.xml ͷ jar ͕શવߋ৽͞Εͳ͍ͱ͔ɾɾɾ
ʢ˞ ೝূɾೝՄʹ͍ͭͯ͸આ໌͠·ͤΜʣ

View Slide

>
< 66
XSS
Spring Boot ͳΒ Thymeleaf ͕Ұ൪͓͢͢Ίɻ
Thymeleaf ʹΑΔςΩετͷग़ྗ͸σϑΥϧτͰΤεέʔϓ͞ΕΔɻ

escapedString

unescapedString
ͪΌΜͱ҆શଆ͕σϑΥϧτʹͳ͍ͬͯΔɻ

View Slide

>
< 67
SQL Injection
ͪΌΜͱͨ͠ OR ϚούʔΛબͼ·͠ΐ͏ɻ
ʢPrepared Statement ͰϓϨʔεϗϧμΛͪΌΜͱ࢖͏ʣ
ͱ͸ݴ͑ɺLIKE ԋࢉࢠ΍ ORDER BY ۟౳ͷΤεέʔϓ͸ɺ
։ൃऀʹ೚͞Ε͍ͯΔ৔߹͕͋ΔͷͰɺ
ೖྗจࣈྻΛ͖ͪΜͱόϦσʔγϣϯ͢Δɻ
• ϗϫΠτϦετͰݕূ͢Δ
• ϗϫΠτϦετ͕࢖͑ͳ͍৔߹͸ɺϦςϥϧΛਖ਼͘͠Τεέʔϓ͢Δ

View Slide

>
< 68
CSRF
Spring Security Λ࢖͑͹ɺϑΥʔϜ΁ͷτʔΫϯຒΊࠐΈ͔Βɺ
αʔόʔαΠυͰͷνΣοΫ·ͰΛࣗಈͰ΍ͬͯ͘ΕΔɻ
ͨͩ͠ɺSpring Security ͸݁ߏ͓͔͍ͤͬͳ΋ͷ΋༗ޮʹͳͬͯ͠·͏ͷͰɺ
ͦ͜Β΁Μ͸ͪΌΜͱແޮԽ͠ͳ͍ͱ͍͚ͳ͍ɻBasic ೝূͱ͔ɻ

org.springframework.boot
spring-boot-starter-security

security.basic.enabled=false

View Slide

>
< 69
ࡉ͔͍ઃఆ͸ɺapplication.properties ͔ɺ
WebSecurityConﬁgurerAdapter Λܧঝͨ͠ΫϥεͰઃఆՄೳɻ
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity http) throws Exception {
// CSRF อޢΛແޮԽ͢Δ URL
String[] ignoreCsrfPatterns = Stream.of(Site.values())
.filter(l -> !l.isProtectCsrf()).map(l -> l.getBaseUrl() + "/**").toArray(String[]::new);
http.csrf()
.ignoringAntMatchers(ignoreCsrfPatterns).and() // CSRF อޢΛແޮԽ͢Δ URL Λࢦఆ͢Δ
.exceptionHandling().accessDeniedHandler(accessDeniedHandler); // CSRF ʹҾ͔͔ͬͬͬͨ৔߹ͷྫ֎ϋϯυϦϯά
}
@Value("${server.error.path:${error.path:/error}}")
private String errorPath;
private AccessDeniedHandler accessDeniedHandler = new AccessDeniedHandler() {
@Override
public void handle(HttpServletRequest request, HttpServletResponse response, AccessDeniedException
accessDeniedException) throws IOException, ServletException {
if (!response.isCommitted()) {
request.setAttribute(RequestDispatcher.ERROR_EXCEPTION, accessDeniedException);
response.setStatus(HttpStatus.FORBIDDEN.value());
request.getRequestDispatcher(errorPath).forward(request, response);
}
}
};
}
API ͸ CSRF อޢΛແޮԽ͢Δ
CSRF ʹҾ͔ͬͬͨ৔߹ɺGlobalErrorController ʹ
forward ͢ΔΑ͏ʹઃఆɻ

View Slide

>
< 70
ࣗಈͰઃఆ͞ΕΔ※

ʢth:action Λ࢖͍ͬͯΔ৔߹ʣ

View Slide

>
< 71
Status Code ͸ 403

View Slide

>
< 72
Http Security HeadersʢList of useful HTTP headers – OWASPʣ
Spring Security Λ༗ޮʹ͢Ε͹ɺSecurity Header ͸ࣗಈͰ෇༩͞ΕΔɻ
ࡉ͔͍ઃఆ͸ɺapplication.properties ͔ɺWebSecurityConﬁgurerAdapter Λ
ܧঝͨ͠ΫϥεͰઃఆՄೳɻ
spring.mvc.static-path-pattern=/public/**
security.ignored=/public/**
security.headers.cache=true # Enable cache control HTTP headers.
security.headers.content-type=true # Enable "X-Content-Type-Options" header.
security.headers.frame=true # Enable "X-Frame-Options" header.
security.headers.hsts= # HTTP Strict Transport Security (HSTS) mode (none, domain, all).
security.headers.xss=true # Enable cross site scripting (XSS) protection.
security.ignored= # Comma-separated list of paths to exclude from the default secured paths.
σϑΥϧτ஋
Static Resource ͸আ֎
https://www.owasp.org/index.php/List_of_useful_HTTP_headers

View Slide

>
< 73
Security Header ͕

ग़ྗ͞Ε͍ͯΔ

View Slide

>
< 74
ϥΠϒϥϦʢjarʣͷΞοϓσʔτ
Spring Boot ͷ৔߹ɺspring-boot-starter-parent ͷ਌ POM ͕ɺ
੔߹ੑͷऔΕͨˍΘΓͱ࠷৽ͷ jar Λ࢖ͬͯ͘ΕΔͷͰɺ
جຊతʹ͸ Boot ͷόʔδϣϯΛ্͛Δ͚ͩʢࣗ෼Ͱ Λࢦఆ͠ͳ͍ʣ
ͨͩ͠ɺݸผͷ jar Ͱ Security Fix ͳͲ͕ग़ͯɺ
Boot ͷϦϦʔε͕ؒʹ߹͍ͬͯͳ͍৔߹͸ɺݸผʹόʔδϣϯΛࢦఆ͢Δɻ

2.8.1

਌ POM Ͱ property ͕࢖ΘΕ͍ͯΔͷͰɺ

ͦΕΛ্ॻ͖͢Δ͚ͩͰΑ͍ɻ
https://github.com/spring-projects/spring-boot/blob/master/spring-boot-
dependencies/pom.xml

View Slide

>
< 75
ࣗ෼ͰೖΕͨ jar ͷ৔߹͸ɺVersions Maven Plugin Λ࢖͏ͷ͕ศརɻ
http://www.mojohaus.org/versions-maven-plugin/

org.codehaus.mojo
versions-maven-plugin
2.1

όʔδϣϯΞοϓ͕Մೳͳ dependency, plugin ͷදࣔ΍ߋ৽ʢةݥʂʣ
Λߦ͏͜ͱ͕Ͱ͖Δɻ
ଞʹ΋ project ͷ λάͷߋ৽ͳͲ΋Ͱ͖Δɻ

View Slide

>
< 76
[SpringDemo] mvn versions:display-dependency-updates
[INFO] Scanning for projects...
[INFO]
[INFO] ------------------------------------------------------------------------
[INFO] Building SpringDemo 0.0.1-SNAPSHOT
[INFO] ------------------------------------------------------------------------
[INFO]
[INFO] --- versions-maven-plugin:2.1:display-dependency-updates (default-cli) @ SpringDemo ---
[INFO] The following dependencies in Dependency Management have newer versions:
[INFO] antlr:antlr ........................................ 2.7.7 -> 20030911
[INFO] ch.qos.logback:logback-access ......................... 1.1.5 -> 1.1.7
[INFO] ch.qos.logback:logback-classic ........................ 1.1.5 -> 1.1.7
[INFO] com.atomikos:transactions-jdbc ........................ 3.9.3 -> 4.0.2
[INFO] com.atomikos:transactions-jms ......................... 3.9.3 -> 4.0.2
[INFO] com.atomikos:transactions-jta ......................... 3.9.3 -> 4.0.2
...
[INFO]
[INFO] The following dependencies in Dependencies have newer versions:
[INFO] org.mybatis.spring.boot:mybatis-spring-boot-starter ... 1.0.2 -> 1.1.1
[INFO] org.projectlombok:lombok ............................ 1.16.6 -> 1.16.8
[INFO]
[INFO] ------------------------------------------------------------------------
[INFO] BUILD SUCCESS
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 1.462 s
[INFO] Finished at: 2016-05-04T11:37:18+09:00
[INFO] Final Memory: 9M/205M
[INFO] ------------------------------------------------------------------------
਌ POM Ͱࢦఆ͞ΕͯΔ jar ͷόʔδϣϯ৘ใ
όʔδϣϯΞοϓ͕Մೳͳ dependency
Λදࣔ͢Δ mvn ίϚϯυ
ࣗ෼ͰೖΕͨ jar ͷόʔδϣϯ৘ใ

ߋ৽͠·͠ΐ͏

View Slide

>
< 77
·ͱΊ ɿ ηΩϡϦςΟ
XSS ͸ΞϯΤεέʔϓͯ͠ग़ྗ͍͚ͨ࣌ͩ͠஫ҙ͢Δ
͜ΕͰɺηΩϡϦςΟʹؔͯ͠͸
SQL Injection ͸όΠϯυม਺Λ࢖Θͳ͍͚࣌ͩ஫ҙ͢Δ
CSRF ͸ࣗಈͰରࡦ͞ΕΔΑ͏ʹͳͬͨʢth:action ๨Εͣʹʣ
Boot ͷ version Λҙࣝͭͭ͠ɺఆظతʹόʔδϣϯΞοϓΛ֬ೝ
Http Security Headers ͸ࣗಈͰग़ྗ

View Slide

>
<
08
Others
ͦͷଞ
78

View Slide

>
< 79
DevTools
։ൃ࣌ʹେମઃఆ͢ΔͰ͋Ζ͏ɺ
ςϯϓϨʔτΩϟογϡͷແޮԽɺϗοτϦϩʔυͷઃఆ౳͕ҰൃͰՄೳɻ
ʢSpring Loaded ͱ͸ผ෺ʣ

org.springframework.boot
spring-boot-devtools
true

http://docs.spring.io/spring-boot/docs/current-SNAPSHOT/reference/htmlsingle/
#using-boot-devtools
͜ͷઃఆ͚ͩͰ spring.thymeleaf.cache=false ͱ͔ɺ
spring.freemarker.cache=false ౳Λɺݸผʹॻ͔ͳͯ͘΋Α͘ͳΔɻ
΋ͪΖΜຊ൪؀ڥͰ༗ޮʹͳΒͳ͍Α͏ʹߟྀ͞Ε͍ͯΔɻ

View Slide

>
< 80
lombok
Spring ؔ܎ͳ͍͚Ͳɺ͍͢͝ศརͳͷͰɺੋඇಋೖ͠·͠ΐ͏ɻ
ͨͩ͠ɺexperimental ͳػೳʹ͍ͭͯ͸ɺ͝ར༻͸ܭըతʹɻ

org.projectlombok
lombok
1.16.8
provided

View Slide

>
< 81
ΞϓϦέʔγϣϯͷݟ͑ΔԽ
Spring ΞϓϦέʔγϣϯͰɺ৭ʑͳ΋ͷΛݟ͑ΔԽ͓ͯ͘͠ͱɺ
ΞϓϦέʔγϣϯͷཧղ͕ਂ·ͬͨΓɺࡉ͔ͳϛεΛؾ͚ͮΔɻ
Spring ࣗମͷཧղ΋ḿΔɻ
• Routing
• Context
• Batch
• Build Info
ʢͦΕɺactuator ͰͰ͖ΔΑʣ

View Slide

>
< 82
ΞϓϦέʔγϣϯͷݟ͑ΔԽʢRoutingʣ
https://github.com/sinsengumi/spring-boot-application-infrastructure/blob/
master/src/main/java/com/example/controller/screen/admin/system/
RouterController.java

View Slide

>
< 83
ΞϓϦέʔγϣϯͷݟ͑ΔԽʢContextʣ
ContextController.java

View Slide

>
< 84
ΞϓϦέʔγϣϯͷݟ͑ΔԽʢBatchʣ
BatchController.java

View Slide

>
< 85
ΞϓϦέʔγϣϯͷݟ͑ΔԽʢBuild Infoʣ
BuildController.java

View Slide

>
<
99
Conclusion
·ͱΊ
86

View Slide

>
< 87
·ͱΊ
• ػೳΛ࡞ΓࠐΉલʹɺج൫ઃܭΛͪΌΜͱ͓ͯ͜͠͏
• ૊Έ߹Θ͕ͤେมͱ͔ݴ͚ͬͨͲɺSpring Boot ͸ૉ੖Β͍͠ϓϩμΫτ 
ࠓɺJava ͰΞϓϦ࡞ΔͳΒɺީิͱͯ͠͸࠷༗ྗͳ͸ͣ
• ࠓ೔࿩ͤͳ͔ͬͨ͜ͱʢೝূɾೝՄɺΩϟογϡɺςετʣ
• ࠓ೔ͷαϯϓϧίʔυ͸ 
https://github.com/sinsengumi/spring-boot-application-infrastructure

View Slide

>
< 88
͝ਗ਼ௌ͋Γ͕ͱ͏͍͟͝·ͨ͠ɻ

View Slide

Spring Boot で Boot した後に作る Web アプリケーション基盤/spring-boot-application-infrastructure

Spring Boot で Boot した後に作る Web アプリケーション基盤/spring-boot-application-infrastructure

sinsengumi

More Decks by sinsengumi

Other Decks in Programming

Featured

Transcript