fix(fe): harden session security - #3668
Draft
minngyuseong wants to merge 2 commits into
Draft
Conversation
minngyuseong
changed the title
Contributor
There was a problem hiding this comment.
Pull request overview
프론트엔드의 NextAuth 세션 노출 범위를 줄이고(특히 refresh token 비노출), 미들웨어에서의 액세스 토큰 재발급 흐름을 더 안전하고 견고하게 만드는 PR입니다. 재발급 로직을 모듈로 분리하고, 만료/실패 시 처리 및 정적 리소스 경로에서의 미들웨어 실행을 제한하는 방향으로 보안/운영 안정성을 강화합니다.
Changes:
- NextAuth Session에
refreshToken,refreshTokenExpires를 제거하고 JWT 내부에만 유지하도록 타입/세션 구성 변경 - middleware에서 재발급 실패 처리(쿠키 삭제/로그인 이동) 및 정적 파일 요청 제외 matcher 추가
- 동일 인스턴스 내 동시 재발급 요청을
reissueAccessToken에서 coalesce하고 회귀 테스트 추가
Reviewed changes
Copilot reviewed 5 out of 6 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| apps/frontend/types/next-auth.d.ts | Session에 노출되는 token 타입을 AccessToken으로 제한 |
| apps/frontend/mocks/handlers.ts | mock session payload에서 refresh 관련 필드 제거 |
| apps/frontend/middleware.ts | 재발급 로직 분리/정리, 실패 처리 강화, matcher로 정적 요청 제외 |
| apps/frontend/libs/auth/reissueAccessToken.ts | 재발급 요청 coalescing 모듈 추가 |
| apps/frontend/libs/auth/reissueAccessToken.spec.ts | 동시 재발급 coalescing 회귀 테스트 추가 |
| apps/frontend/libs/auth/authOptions.ts | session callback에서 refresh 관련 값 비노출로 변경 |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+56
to
+72
| const handleReissueFailure = (req: NextRequest) => { | ||
| const { pathname } = req.nextUrl | ||
| const isAuthRequest = pathname.startsWith('/next-auth/api/auth/') | ||
|
|
||
| if (pathname === '/login' || isAuthRequest) { | ||
| return clearSession( | ||
| req, | ||
| NextResponse.next({ | ||
| request: { | ||
| headers: new Headers(req.headers) | ||
| } | ||
| }) | ||
| ) | ||
| } | ||
|
|
||
| return clearSession(req, NextResponse.redirect(createLoginUrl(req))) | ||
| } |
Comment on lines
+15
to
+30
| const requestReissue = async ( | ||
| refreshToken: string | ||
| ): Promise<ReissuedTokens> => { | ||
| const response = await fetch(`${baseUrl}/auth/reissue`, { | ||
| headers: { | ||
| cookie: `refresh_token=${refreshToken}` | ||
| }, | ||
| cache: 'no-store' | ||
| }) | ||
|
|
||
| if (!response.ok) { | ||
| throw new Error('Failed to reissue token') | ||
| } | ||
|
|
||
| return getJWTFromResponse(response) | ||
| } |
minngyuseong
marked this pull request as draft
July 29, 2026 10:03
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
프론트엔드 세션 보안과 토큰 재발급 과정을 개선합니다. 혹시 코드 궁금한 거 있으면 질문 부담없이 해주세요
refreshToken과refreshTokenExpires제거closes TAS-2817
Before submitting the PR, please make sure you do the following
fixes #123).