fix: accessToken을 응답 본문(response body)으로 전달하고 Authorization 헤더에서 읽도록 수정

Author: Jy000n

src/main/java/com/Timo/Timo/global/auth/handler/OAuthSuccessHandler.java

@@ -3,13 +3,15 @@
 import com.Timo.Timo.global.auth.dto.CustomUserDetails;
 import com.Timo.Timo.global.auth.service.RefreshTokenService;
 import com.Timo.Timo.global.jwt.provider.JwtTokenProvider;
+import com.fasterxml.jackson.databind.ObjectMapper;
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
 import java.io.IOException;
 import java.time.Duration;
+import java.util.Map;
 import lombok.RequiredArgsConstructor;
 import org.springframework.beans.factory.annotation.Value;
-import org.springframework.http.HttpHeaders;
+import org.springframework.http.MediaType;
 import org.springframework.http.ResponseCookie;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.web.authentication.SimpleUrlAuthenticationSuccessHandler;
@@ -21,6 +23,7 @@ public class OAuthSuccessHandler extends SimpleUrlAuthenticationSuccessHandler {
 
   private final JwtTokenProvider jwtTokenProvider;
   private final RefreshTokenService refreshTokenService;
+  private final ObjectMapper objectMapper;
 
   @Value("${app.oauth2.redirect-uri}")
   private String redirectUri;
@@ -43,24 +46,18 @@ public void onAuthenticationSuccess(
 
     refreshTokenService.save(email, refreshToken);
 
-    ResponseCookie accessCookie = ResponseCookie.from("accessToken", accessToken)
-        .httpOnly(true)
-        .secure(cookieSecure)
-        .path("/")
-        .maxAge(Duration.ofSeconds(jwtTokenProvider.getAccessTokenExpiry()))
-        .sameSite("Strict")
-        .build();
-    response.addHeader(HttpHeaders.SET_COOKIE, accessCookie.toString());
-
     ResponseCookie refreshCookie = ResponseCookie.from("refreshToken", refreshToken)
         .httpOnly(true)
         .secure(cookieSecure)
         .path("/")
         .maxAge(Duration.ofSeconds(jwtTokenProvider.getRefreshTokenExpiry()))
         .sameSite("Strict")
         .build();
-    response.addHeader(HttpHeaders.SET_COOKIE, refreshCookie.toString());
 
-    getRedirectStrategy().sendRedirect(request, response, redirectUri);
+    response.setContentType(MediaType.APPLICATION_JSON_VALUE);
+    response.setCharacterEncoding("UTF-8");
+    response.getWriter().write(
+        objectMapper.writeValueAsString(Map.of("accessToken", accessToken))
+    );
   }
 }

src/main/java/com/Timo/Timo/global/jwt/filter/JwtAuthenticationFilter.java

@@ -5,17 +5,16 @@
 import com.Timo.Timo.global.jwt.provider.JwtTokenProvider;
 import jakarta.servlet.FilterChain;
 import jakarta.servlet.ServletException;
-import jakarta.servlet.http.Cookie;
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
 import java.io.IOException;
-import java.util.Arrays;
 import java.util.Map;
 import lombok.RequiredArgsConstructor;
 import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
 import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.security.web.authentication.WebAuthenticationDetailsSource;
 import org.springframework.stereotype.Component;
+import org.springframework.util.StringUtils;
 import org.springframework.web.filter.OncePerRequestFilter;
 
 @Component
@@ -51,12 +50,11 @@ protected void doFilterInternal(
   }
 
   private String resolveToken(HttpServletRequest request) {
-    if (request.getCookies() == null) return null;
 
-    return Arrays.stream(request.getCookies())
-        .filter(cookie -> "accessToken".equals(cookie.getName()))
-        .map(Cookie::getValue)
-        .findFirst()
-        .orElse(null);
+    String bearer = request.getHeader("Authorization");
+    if (StringUtils.hasText(bearer) && bearer.startsWith("Bearer ")) {
+      return bearer.substring(7);
+    }
+    return null;
   }
 }