From 1db509b04b869e0dafead79bf17ca96f43f7d56f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=EC=9D=B4=EC=A3=BC=EC=9D=BC?= <we1202@nate.com>
Date: Tue, 21 Jul 2026 10:26:34 +0900
Subject: [PATCH] =?UTF-8?q?fix:=20=EA=B4=80=EB=A6=AC=EC=9E=90=20=EC=84=B8?=
 =?UTF-8?q?=EC=85=98=20=EB=A7=8C=EB=A3=8C=20=EB=A6=AC=EB=8B=A4=EC=9D=B4?=
 =?UTF-8?q?=EB=A0=89=ED=8A=B8=20=EB=A3=A8=ED=94=84=20=EB=B0=A9=EC=A7=80?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../filter/JwtAuthenticationFilter.java       | 19 ++++++++++++++++---
 1 file changed, 16 insertions(+), 3 deletions(-)

diff --git a/src/main/java/com/wb/domainserver/security/filter/JwtAuthenticationFilter.java b/src/main/java/com/wb/domainserver/security/filter/JwtAuthenticationFilter.java
index 3c4072e6..69d84db3 100644
--- a/src/main/java/com/wb/domainserver/security/filter/JwtAuthenticationFilter.java
+++ b/src/main/java/com/wb/domainserver/security/filter/JwtAuthenticationFilter.java
@@ -56,8 +56,12 @@ public class JwtAuthenticationFilter extends OncePerRequestFilter {
 
             //사용자이면서 ACT가 없는데 tokenExpire는 있을 경우
             //로그인된 사용자지만 엑세스 토큰이 만료되어 다시 재발급 받아야 하는 대상
-            //expire값은 루프 요청 방지
-            if(!StringUtils.hasText(accessToken) && StringUtils.hasText(tokenExpireCookie) && !"p".equals(expireChk)){
+            //인증 진입점은 만료 쿠키가 남아 있어도 갱신 대상으로 보내지 않는다.
+            //쿠키 삭제가 지연되거나 이전 경로의 쿠키가 남아도 로그인 화면까지는 항상 도달해야 한다.
+            if(!isAuthenticationEndpoint(requestUri, realm)
+                    && !StringUtils.hasText(accessToken)
+                    && StringUtils.hasText(tokenExpireCookie)
+                    && !"p".equals(expireChk)){
                 response.sendRedirect("/"+realm+"/tokens/refresh?redirect_uri=%s&expire=%s".formatted(URLEncoder.encode(UrlExtractor.getOriginalURL(request), StandardCharset.UTF_8), "p"));
                 return;
 
@@ -65,7 +69,7 @@ public class JwtAuthenticationFilter extends OncePerRequestFilter {
 
 
             // accessToken이 있고 refresh Token 요청이 아닌경우
-            if (StringUtils.hasText(accessToken) && !requestUri.contains("/tokens/refresh")) {
+            if (StringUtils.hasText(accessToken) && !isAuthenticationEndpoint(requestUri, realm)) {
                 UserDetails userDetails = customUserDetailService.loadUserByUsername(accessToken);
                 if (userDetails != null) {
                     log.debug("user details: {}", userDetails);
@@ -91,6 +95,15 @@ public class JwtAuthenticationFilter extends OncePerRequestFilter {
 
     }
 
+    private boolean isAuthenticationEndpoint(String requestUri, String realm) {
+        String realmPath = "/" + realm;
+
+        return requestUri.equals(realmPath)
+                || requestUri.startsWith(realmPath + "/login")
+                || requestUri.equals(realmPath + "/logout")
+                || requestUri.startsWith(realmPath + "/tokens/refresh");
+    }
+
 
 
     private String extractToken(HttpServletRequest request) {