@@ -0,0 +1,76 @@
+package nextstep.security.filter;
+
+import jakarta.servlet.FilterChain;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.ServletRequest;
+import jakarta.servlet.ServletResponse;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import nextstep.security.context.SecurityContext;
+import nextstep.security.context.SecurityContextImpl;
+import nextstep.security.context.SecurityContextRepository;
+import nextstep.security.authentication.Authentication;
+import nextstep.security.authentication.AuthenticationManager;
+import nextstep.security.authentication.exception.AuthenticationException;
+import nextstep.security.user.UsernamePasswordAuthenticationToken;
+import org.springframework.http.HttpMethod;
+import org.springframework.web.filter.GenericFilterBean;
+
+import java.io.IOException;
+import java.util.Arrays;
+import java.util.Map;
+import java.util.Objects;
+
+public class UserNamePasswordAuthFilter extends GenericFilterBean {
+
+    private final AuthenticationManager authenticationManager;
+    private final SecurityContextRepository securityContextRepository;
+
+    private static final String[] USER_NAME_PASSWORD_AUTH_PATH = new String[]{"/login"};
+
+    public UserNamePasswordAuthFilter(AuthenticationManager authenticationManager, SecurityContextRepository securityContextRepository) {
+        this.authenticationManager = Objects.requireNonNull(authenticationManager);
+        this.securityContextRepository = Objects.requireNonNull(securityContextRepository);
+    }
+
+    @Override
+    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
+        if (servletRequest instanceof HttpServletRequest request) {
+            boolean isNotPostMethod = !HttpMethod.POST.name().equalsIgnoreCase(request.getMethod());
+            boolean isNotMatchedURI = Arrays.stream(USER_NAME_PASSWORD_AUTH_PATH).noneMatch(it -> it.equalsIgnoreCase(request.getRequestURI()));
+            if (isNotMatchedURI || isNotPostMethod) {
+                filterChain.doFilter(servletRequest, servletResponse);
+                return;
+            }
+
+            try {
+                HttpServletRequest httpRequest = (HttpServletRequest) servletRequest;
+                Authentication authentication = getAuthenticationByUserNamePassword(httpRequest);
+
+                SecurityContext securityContext = new SecurityContextImpl(authentication);
+                securityContextRepository.saveContext(securityContext, httpRequest, (HttpServletResponse) servletResponse);
+
+            } catch (AuthenticationException e) {
+                ((HttpServletResponse) servletResponse).sendError(HttpServletResponse.SC_UNAUTHORIZED, e.getMessage());
+                return;
+            }
+        }
+
+        ((HttpServletResponse) servletResponse).setStatus(HttpServletResponse.SC_OK);
+    }
+
+    private Authentication getAuthenticationByUserNamePassword(HttpServletRequest httpRequest) {
+        Map<String, String[]> parameterMap = httpRequest.getParameterMap();
+        String username = parameterMap.get("username")[0];
+        String password = parameterMap.get("password")[0];
+
+        UsernamePasswordAuthenticationToken authentication = UsernamePasswordAuthenticationToken.unAuthorizedToken(username, password);
+
+        Authentication authenticate = authenticationManager.authenticate(authentication);
+        if (!authenticate.isAuthenticated()) {
+            throw new AuthenticationException();
+        }
+
+        return authenticate;
+    }
+}

리뷰: 미션을 빠르게 잘 수행해주셔서 추가적으로 고민해볼 수 있는 부분을 드립니다!

실제 시큐리티 코드에서 UsernamePasswordAuthenticationFilter의 경우 AbstractAuthenticationProcessingFilter를 상속받고 있습니다. **시큐리티의 인증 관련 필터를 잘 파악해보기 위한 목적**으로 UserNamePasswordAuthFilter와 AbstractAuthenticationProcessingFilter를 구분해보고 리팩터링 해보면 어떨까요?

함께 고민해보면 좋을 내용으로 실제 시큐리티 코드에서는 BasicAuthenticationFilter는 AbstractAuthenticationProcessingFilter를 상속받고 있지 않고 있습니다. 이유에 대해서 고민해보시고 세준님이 구현한다면 이 부분을 합쳐서 구현해볼 것 인지, 아니면 기존처럼 따로 구현해볼 것 인지를 고민해보시고 그 이유도 함께 작성해봐주시면 조금 더 폭넓은 학습을 하는데 도움이 될 것 같습니다 :)