fix: ouath2 리다이렉팅 주소 반환하게 변경 by dev-ant · Pull Request #18 · devnogi/devnogi-auth-server

dev-ant · 2026-01-29T15:03:50Z

📋 상세 설명

📊 체크리스트

PR 제목이 형식에 맞나요 e.g. feat: PR을 등록한다
코드가 테스트 되었나요
문서는 업데이트 되었나요
불필요한 코드를 제거했나요
이슈와 라벨이 등록되었나요

📆 마감일

Close #{issue number}

…into fix-api-deploy # Conflicts: # .github/workflows/deploy.yml

…er into fix/oauth2-redirecting

Copilot

Pull request overview

This PR modifies the OAuth2 authentication flow to redirect to a frontend callback URL instead of returning JSON responses directly. The changes also include various configuration updates, code cleanup, and infrastructure modifications.

Changes:

OAuth2 success handler now redirects to frontend with URL-encoded data instead of returning JSON responses
JWT token validity configuration changed from milliseconds to seconds (with critical bug)
Added email field to UserInfoResponse and mail configuration to application.yml
Updated deployment workflow from AWS ECR to GitHub Container Registry (GHCR) with on-premise deployment

Reviewed changes

Copilot reviewed 23 out of 24 changed files in this pull request and generated 16 comments.

Show a summary per file

File	Description
src/main/java/until/the/eternity/das/oauth/handler/OAuth2SuccessHandler.java	Refactored to redirect to frontend callback URL with encoded data/error in query parameters
src/main/resources/application-sample.yml	Added mail config, changed JWT validity to seconds, made DB host configurable, added S3 endpoint config
src/main/java/until/the/eternity/das/auth/presentation/AuthController.java	Added JWT token generation and cookie setting after social signup completion
src/main/java/until/the/eternity/das/oauth/service/SocialAuthService.java	Added jwtForSocialSignUp method, made profile image optional
src/main/java/until/the/eternity/das/user/dto/response/UserInfoResponse.java	Added email field to response
src/main/java/until/the/eternity/das/common/util/CookieUtil.java	Hardcoded cookie domain to .memonogi.com
src/main/java/until/the/eternity/das/common/application/S3Service.java	Improved image deletion with URI parsing
src/main/resources/db/migration/V20250721224045__insert_default_data.sql	Changed schema name from 'devnogi' to 'auth'
.github/workflows/deploy-prod.yml	New deployment workflow using GHCR and on-premise server
docker-compose-auth-prod.yml	New production docker-compose configuration
Dockerfile	Changed exposed port from 8080 to 8091
src/main/java/until/the/eternity/das/DasApplication.java	Added timezone configuration and async support
Multiple files	Removed various TODO comments and code cleanup

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-02-02T03:26:05Z

src/main/resources/application-sample.yml

+  access-token-validity: ${JWT_ACCESS_TOKEN_VALIDITY:3600} # seconds (1 hour)
+  refresh-token-validity: ${JWT_REFRESH_TOKEN_VALIDITY:86400} # seconds (1 day)


The JWT token validity configuration has been changed from milliseconds to seconds (3600 instead of 3600000 for access token, 86400 instead of 86400000 for refresh token), but the JwtUtil.createToken method still expects milliseconds.

In JwtUtil.java line 79, the code uses new Date(now.getTime() + expiration) where getTime() returns milliseconds since epoch, and it directly adds the expiration value. This means the tokens will now expire in 3600 milliseconds (3.6 seconds) instead of 1 hour, and 86400 milliseconds (86.4 seconds) instead of 1 day.

This will cause tokens to expire almost immediately, breaking authentication functionality. Either revert the configuration values back to milliseconds, or update JwtUtil.createToken to multiply the expiration value by 1000 to convert seconds to milliseconds.

Suggested change

access-token-validity: ${JWT_ACCESS_TOKEN_VALIDITY:3600} # seconds (1 hour)

refresh-token-validity: ${JWT_REFRESH_TOKEN_VALIDITY:86400} # seconds (1 day)

access-token-validity: ${JWT_ACCESS_TOKEN_VALIDITY:3600000} # 1 hour (milliseconds)

refresh-token-validity: ${JWT_REFRESH_TOKEN_VALIDITY:86400000} # 1 day (milliseconds)

Copilot · 2026-02-02T03:26:05Z

src/main/java/until/the/eternity/das/common/util/CookieUtil.java

      .secure(true)
      .sameSite("None")
      .path("/")
+      .domain(".memonogi.com")


The domain is now hardcoded to '.memonogi.com' in the cookie configuration. This will prevent the application from working in non-production environments (local development, staging) unless those environments also use the memonogi.com domain.

Consider making the cookie domain configurable via application properties (e.g., ${app.cookie.domain:.memonogi.com}) to support different environments. For local development, the domain should typically be omitted or set to localhost.

Copilot · 2026-02-02T03:26:06Z

src/main/java/until/the/eternity/das/common/util/CookieUtil.java

      .secure(true)
      .sameSite("None")
      .path("/")
+      .domain(".memonogi.com")


The domain is now hardcoded to '.memonogi.com' in the cookie configuration. This will prevent the application from working in non-production environments (local development, staging) unless those environments also use the memonogi.com domain.

Consider making the cookie domain configurable via application properties (e.g., ${app.cookie.domain:.memonogi.com}) to support different environments. For local development, the domain should typically be omitted or set to localhost.

Copilot · 2026-02-02T03:26:06Z

src/main/resources/application-sample.yml

+    host: smtp.gmail.com
+    port: 587
+    username: ${MAIL_USERNAME:devnogi.auth@gmail.com}
+    password: ${MAIL_PASSWORD:ipghhpopgxncgzgg}


A default email password is exposed in the configuration file ('ipghhpopgxncgzgg'). Even though this is a sample configuration file, including actual credentials (even if they're app-specific passwords) is a security risk.

The default value should be a placeholder like 'your-app-password-here' or completely omitted, requiring users to set it via environment variables. If this is a real credential, it should be rotated immediately and never committed to version control.

Suggested change

password: ${MAIL_PASSWORD:ipghhpopgxncgzgg}

password: ${MAIL_PASSWORD:your-app-password-here}

Copilot · 2026-02-02T03:26:06Z

Dockerfile

 VOLUME /app/config

-EXPOSE 8080
+EXPOSE 8091


The EXPOSE port has been changed from 8080 to 8091. Ensure this change is intentional and that all related configurations are updated consistently:

The SERVER_PORT environment variable in deployment configurations

Load balancer or reverse proxy configurations

Documentation

Any hardcoded references to port 8080

The docker-compose-auth-prod.yml file references ${SERVER_PORT} which should be set to 8091 in the environment configuration.

Suggested change

EXPOSE 8091

EXPOSE 8080

Copilot · 2026-02-02T03:26:08Z

src/main/java/until/the/eternity/das/oauth/handler/OAuth2SuccessHandler.java

  private final ObjectMapper objectMapper;
  private final TokenService tokenService;

+  @Value("${app.oauth.redirect-uri:https://www.memonogi.com/social-callback}")


The OAuth redirect URI is hardcoded as a default value ('https://www.memonogi.com/social-callback'). While it has a default value, it should be configurable via environment-specific properties to support different environments (development, staging, production).

Consider removing the default value and requiring it to be set via environment variables, or at minimum, document that this must be overridden for non-production environments. The current setup could lead to OAuth callbacks being sent to production URLs from development/staging environments.

Suggested change

@Value("${app.oauth.redirect-uri:https://www.memonogi.com/social-callback}")

@Value("${app.oauth.redirect-uri}")

Copilot · 2026-02-02T03:26:08Z

src/main/java/until/the/eternity/das/oauth/handler/OAuth2SuccessHandler.java

    user.updateLastLoginAt();
    userRepository.save(user);


The user.updateLastLoginAt() call followed by userRepository.save(user) is not wrapped in a @transactional annotation. If the redirect fails after saving, or if there are concurrent requests, this could lead to inconsistent state.

Consider wrapping this logic in a @transactional method or moving it to a service layer method that handles transactions properly. Additionally, the save operation should happen before the redirect to ensure data consistency even if the redirect fails.

Copilot · 2026-02-02T03:26:08Z

src/main/resources/application-sample.yml

  datasource:
    driver-class-name: com.mysql.cj.jdbc.Driver
-    url: jdbc:mysql://localhost:${DB_PORT}/${DB_SCHEMA}
+    url: jdbc:mysql://${DB_HOST}:${DB_PORT}/${DB_SCHEMA}


The database URL has been changed from 'localhost' to '${DB_HOST}', making it configurable. This is a good improvement for flexibility. However, ensure that:

The default value or documentation specifies that DB_HOST should be 'localhost' for local development

All deployment configurations (docker-compose files, environment files) set DB_HOST appropriately

This breaking change is communicated to developers who may have existing local setups

Consider adding a default value like ${DB_HOST:localhost} to maintain backward compatibility.

Suggested change

url: jdbc:mysql://${DB_HOST}:${DB_PORT}/${DB_SCHEMA}

url: jdbc:mysql://${DB_HOST:localhost}:${DB_PORT}/${DB_SCHEMA}

Copilot · 2026-02-02T03:26:09Z

src/main/java/until/the/eternity/das/common/util/CookieUtil.java

      .secure(true)
      .sameSite("None")
      .path("/")
+      .domain(".memonogi.com")


The domain is now hardcoded to '.memonogi.com' in the cookie configuration. This will prevent the application from working in non-production environments (local development, staging) unless those environments also use the memonogi.com domain.

Consider making the cookie domain configurable via application properties (e.g., ${app.cookie.domain:.memonogi.com}) to support different environments. For local development, the domain should typically be omitted or set to localhost.

Copilot · 2026-02-02T03:26:09Z

src/main/java/until/the/eternity/das/auth/presentation/AuthController.java

    SignUpResponse result = socialAuthService.completeSocialSignup(request);
+
+    LoginResultResponse loginResultResponse = socialAuthService.jwtForSocialSignUp(result.id());
+
+    cookieUtil.createAccessTokenCookie(response, loginResultResponse.accessToken());
+    cookieUtil.createRefreshTokenCookie(response, loginResultResponse.refreshToken());


After completing social signup, the code calls two separate @transactional methods: completeSocialSignup() and jwtForSocialSignUp(). If jwtForSocialSignUp() fails (e.g., due to token generation error), the user will be created but won't receive JWT tokens, leading to an incomplete registration state.

Consider combining these operations into a single transactional method, or implement compensating logic to handle failures in the token generation step. Additionally, consider whether it's appropriate to update lastLoginAt immediately after signup - typically this should only be updated on subsequent logins, not on initial registration.

guite95 and others added 17 commits January 19, 2026 18:30

fix: 소셜로그인 관련 로직 수정

d8ccb23

fix: 서버 시간 KST로 설정

8858533

fix: MinIO사용 삭제 로직으로 변경

3e3bcdc

fix: application파일 수정

51ca383

feat: 운영서버 CI/CD 파이프라인

4516025

fix: 불필요한 주석 삭제

27bcc37

Merge branch 'dev' of https://github.com/devnogi/devnogi-auth-server …

450d6d0

…into fix-api-deploy # Conflicts: # .github/workflows/deploy.yml

fix: ouath2 리다이렉팅 주소 반환하게 변경

de1d6af

fix: merge conflict

76279a4

fix: 배포 관련 로직 수정

f9c98fe

fix: OAuth2SuccessHandler 수정

d3e7ed0

Merge branch 'fix-api-deploy' of github.com:devnogi/devnogi-auth-serv…

5cf4f42

…er into fix/oauth2-redirecting

feat: gitignore 업데이터

bebde5d

infra: 배포 테스트용 prod cd 임시 수정

e5b5f91

fix: redirect-url base value 수정

e5b7198

fix: redirect url base value 오타 수정

24e70f0

fix: jwt cookie에 도메인 지정

0c21f4a

dev-ant requested review from Copilot and guite95 and removed request for guite95 February 2, 2026 03:21

Copilot started reviewing on behalf of dev-ant February 2, 2026 03:21 View session

Copilot AI reviewed Feb 2, 2026

View reviewed changes

feat: JWT 로그아웃 엔드포인트 추가 (리프레시 토큰 무효화 및 쿠키 삭제)

16e01b9

dev-ant merged commit adbac21 into dev Feb 7, 2026
2 checks passed

dev-ant deleted the fix/oauth2-redirecting branch February 7, 2026 01:45

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: ouath2 리다이렉팅 주소 반환하게 변경#18

fix: ouath2 리다이렉팅 주소 반환하게 변경#18
dev-ant merged 18 commits intodevfrom
fix/oauth2-redirecting

dev-ant commented Jan 29, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Feb 2, 2026

Uh oh!

Copilot AI Feb 2, 2026

Uh oh!

Copilot AI Feb 2, 2026

Uh oh!

Copilot AI Feb 2, 2026

Uh oh!

Copilot AI Feb 2, 2026

Uh oh!

Copilot AI Feb 2, 2026

Uh oh!

Copilot AI Feb 2, 2026

Uh oh!

Copilot AI Feb 2, 2026

Uh oh!

Copilot AI Feb 2, 2026

Uh oh!

Copilot AI Feb 2, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		access-token-validity: ${JWT_ACCESS_TOKEN_VALIDITY:3600} # seconds (1 hour)
		refresh-token-validity: ${JWT_REFRESH_TOKEN_VALIDITY:86400} # seconds (1 day)

	password: ${MAIL_PASSWORD:ipghhpopgxncgzgg}
	password: ${MAIL_PASSWORD:your-app-password-here}

	@Value("${app.oauth.redirect-uri:https://www.memonogi.com/social-callback}")
	@Value("${app.oauth.redirect-uri}")

	url: jdbc:mysql://${DB_HOST}:${DB_PORT}/${DB_SCHEMA}
	url: jdbc:mysql://${DB_HOST:localhost}:${DB_PORT}/${DB_SCHEMA}

Conversation

dev-ant commented Jan 29, 2026

📋 상세 설명

📊 체크리스트

📆 마감일

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Feb 2, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 2, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 2, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 2, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 2, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 2, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 2, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 2, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 2, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 2, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants