diff --git a/src/app/api/auth/access-token/route.ts b/src/app/api/auth/access-token/route.ts
index 0809f02..2aa0b50 100644
--- a/src/app/api/auth/access-token/route.ts
+++ b/src/app/api/auth/access-token/route.ts
@@ -28,7 +28,8 @@ export async function POST() {
 
     const serverApi = await createServerApi({accessToken: refreshToken});
     const {data} = await serverApi.get<AdminApiTypes.GetAccessTokenResponse>(
-      API_ENDPOINTS.auth.accessToken
+      API_ENDPOINTS.auth.accessToken,
+      {maxRedirects: 0}
     );
 
     await setAuthCookies(data);
diff --git a/src/app/api/auth/login/route.ts b/src/app/api/auth/login/route.ts
index af24c88..3bc4d03 100644
--- a/src/app/api/auth/login/route.ts
+++ b/src/app/api/auth/login/route.ts
@@ -5,13 +5,51 @@ import {createServerApi} from '@/src/shared/api/server-client';
 
 import {createApiErrorResponse, setAuthCookies} from '../_lib/auth-route';
 
+const createBadRequestResponse = (message: string) => {
+  return NextResponse.json({message}, {status: 400});
+};
+
+const isLoginRequest = (
+  value: unknown
+): value is AdminApiTypes.PostLoginRequest => {
+  return (
+    typeof value === 'object' &&
+    value !== null &&
+    !Array.isArray(value) &&
+    typeof (value as Record<string, unknown>).id === 'string' &&
+    typeof (value as Record<string, unknown>).password === 'string'
+  );
+};
+
+const parseLoginRequest = async (request: Request) => {
+  let body: unknown;
+
+  try {
+    body = await request.json();
+  } catch {
+    return createBadRequestResponse('Malformed JSON request body.');
+  }
+
+  if (!isLoginRequest(body)) {
+    return createBadRequestResponse('id and password must be strings.');
+  }
+
+  return body;
+};
+
 export async function POST(request: Request) {
+  const body = await parseLoginRequest(request);
+
+  if (body instanceof Response) {
+    return body;
+  }
+
   try {
-    const body = (await request.json()) as AdminApiTypes.PostLoginRequest;
     const serverApi = await createServerApi({includeAccessToken: false});
     const {data} = await serverApi.post<AdminApiTypes.PostLoginResponse>(
       API_ENDPOINTS.auth.login,
-      body
+      body,
+      {maxRedirects: 0}
     );
 
     await setAuthCookies(data);