From 57465fc9a9707935f22bfe816a78340f4298beb4 Mon Sep 17 00:00:00 2001
From: hdg0116 <hdg0116@gmail.com>
Date: Fri, 28 Aug 2026 02:01:10 +0900
Subject: [PATCH 1/2] =?UTF-8?q?Fix:=20=EB=A1=9C=EA=B7=B8=EC=9D=B8=20?=
 =?UTF-8?q?=EC=9A=94=EC=B2=AD=20=EB=B3=B8=EB=AC=B8=20=EA=B2=80=EC=A6=9D=20?=
 =?UTF-8?q?=EC=B6=94=EA=B0=80=20(#23)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/app/api/auth/login/route.ts | 39 ++++++++++++++++++++++++++++++++-
 1 file changed, 38 insertions(+), 1 deletion(-)

diff --git a/src/app/api/auth/login/route.ts b/src/app/api/auth/login/route.ts
index af24c88..6815218 100644
--- a/src/app/api/auth/login/route.ts
+++ b/src/app/api/auth/login/route.ts
@@ -5,9 +5,46 @@ import {createServerApi} from '@/src/shared/api/server-client';
 
 import {createApiErrorResponse, setAuthCookies} from '../_lib/auth-route';
 
+const createBadRequestResponse = (message: string) => {
+  return NextResponse.json({message}, {status: 400});
+};
+
+const isLoginRequest = (
+  value: unknown
+): value is AdminApiTypes.PostLoginRequest => {
+  return (
+    typeof value === 'object' &&
+    value !== null &&
+    !Array.isArray(value) &&
+    typeof (value as Record<string, unknown>).id === 'string' &&
+    typeof (value as Record<string, unknown>).password === 'string'
+  );
+};
+
+const parseLoginRequest = async (request: Request) => {
+  let body: unknown;
+
+  try {
+    body = await request.json();
+  } catch {
+    return createBadRequestResponse('Malformed JSON request body.');
+  }
+
+  if (!isLoginRequest(body)) {
+    return createBadRequestResponse('id and password must be strings.');
+  }
+
+  return body;
+};
+
 export async function POST(request: Request) {
+  const body = await parseLoginRequest(request);
+
+  if (body instanceof Response) {
+    return body;
+  }
+
   try {
-    const body = (await request.json()) as AdminApiTypes.PostLoginRequest;
     const serverApi = await createServerApi({includeAccessToken: false});
     const {data} = await serverApi.post<AdminApiTypes.PostLoginResponse>(
       API_ENDPOINTS.auth.login,

From 14a78507ad821f053785059294968f106edd2ba0 Mon Sep 17 00:00:00 2001
From: hdg0116 <hdg0116@gmail.com>
Date: Fri, 28 Aug 2026 02:01:55 +0900
Subject: [PATCH 2/2] =?UTF-8?q?Fix:=20=EC=9D=B8=EC=A6=9D=20=EC=9A=94?=
 =?UTF-8?q?=EC=B2=AD=20=EB=A6=AC=EB=8B=A4=EC=9D=B4=EB=A0=89=ED=8A=B8=20?=
 =?UTF-8?q?=EC=B0=A8=EB=8B=A8=20(#23)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/app/api/auth/access-token/route.ts | 3 ++-
 src/app/api/auth/login/route.ts        | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/app/api/auth/access-token/route.ts b/src/app/api/auth/access-token/route.ts
index 0809f02..2aa0b50 100644
--- a/src/app/api/auth/access-token/route.ts
+++ b/src/app/api/auth/access-token/route.ts
@@ -28,7 +28,8 @@ export async function POST() {
 
     const serverApi = await createServerApi({accessToken: refreshToken});
     const {data} = await serverApi.get<AdminApiTypes.GetAccessTokenResponse>(
-      API_ENDPOINTS.auth.accessToken
+      API_ENDPOINTS.auth.accessToken,
+      {maxRedirects: 0}
     );
 
     await setAuthCookies(data);
diff --git a/src/app/api/auth/login/route.ts b/src/app/api/auth/login/route.ts
index 6815218..3bc4d03 100644
--- a/src/app/api/auth/login/route.ts
+++ b/src/app/api/auth/login/route.ts
@@ -48,7 +48,8 @@ export async function POST(request: Request) {
     const serverApi = await createServerApi({includeAccessToken: false});
     const {data} = await serverApi.post<AdminApiTypes.PostLoginResponse>(
       API_ENDPOINTS.auth.login,
-      body
+      body,
+      {maxRedirects: 0}
     );
 
     await setAuthCookies(data);