[Bug] #87 - RefreshToken 갱신 시 Redis 저장 토큰과 비교 후 새로운 Token 저장

src/main/java/dgu/sw/domain/user/controller/UserController.java

@@ -13,10 +13,7 @@
 import jakarta.servlet.http.HttpServletResponse;
 import jakarta.validation.Valid;
 import lombok.RequiredArgsConstructor;
-import org.springframework.web.bind.annotation.PostMapping;
-import org.springframework.web.bind.annotation.RequestBody;
-import org.springframework.web.bind.annotation.RequestMapping;
-import org.springframework.web.bind.annotation.RestController;
+import org.springframework.web.bind.annotation.*;
 
 @RestController
 @RequiredArgsConstructor
@@ -47,8 +44,8 @@ public ApiResponse<String> signOut(HttpServletRequest request, HttpServletRespon
 
     @PostMapping("/refresh")
     @Operation(summary = "토큰 갱신 API", description = "Refresh Token을 이용하여 Access Token을 갱신합니다.")
-    public ApiResponse<SignInResponse> refresh(@RequestBody String refreshToken) {
-        return ApiResponse.onSuccess(userService.refreshAccessToken(refreshToken));
+    public ApiResponse<SignInResponse> refresh(@RequestHeader("refreshToken") String refreshToken, HttpServletResponse response) {
+        return ApiResponse.onSuccess(userService.refreshAccessToken(refreshToken, response));
     }
 
     @PostMapping("/check-email")

src/main/java/dgu/sw/domain/user/service/UserService.java

@@ -14,7 +14,7 @@ public interface UserService {
 
     void signOut(HttpServletRequest request, HttpServletResponse response);
 
-    SignInResponse refreshAccessToken(String refreshToken);
+    SignInResponse refreshAccessToken(String refreshToken, HttpServletResponse response);
 
     void checkEmailDuplicate(String email);
 

src/main/java/dgu/sw/domain/user/service/UserServiceImpl.java

@@ -104,18 +104,29 @@ public void signOut(HttpServletRequest request, HttpServletResponse response) {
      * AccessToken 갱신
      */
     @Override
-    public SignInResponse refreshAccessToken(String refreshToken) {
-        if (!jwtUtil.validateToken(refreshToken)) {
+    public SignInResponse refreshAccessToken(String refreshToken, HttpServletResponse response) {
+        Long extractedUserId = jwtUtil.extractUserId(refreshToken);
+        if (extractedUserId == null) {
             throw new UserException(ErrorStatus.INVALID_REFRESH_TOKEN);
         }
 
-        String userId = String.valueOf(jwtUtil.extractUserId(refreshToken));
-        String newAccessToken = jwtTokenProvider.generateAccessToken(userRepository.findByEmail(userId)
-                .orElseThrow(() -> new UserException(ErrorStatus.USER_NOT_FOUND)));
+        String userId = String.valueOf(extractedUserId);
 
-        String newRefreshToken = jwtTokenProvider.generateRefreshToken(userRepository.findByEmail(userId)
-                .orElseThrow(() -> new UserException(ErrorStatus.USER_NOT_FOUND)));
+        // Redis에 저장된 RefreshToken과 비교
+        String storedRefreshToken = redisUtil.getRefreshToken(userId)
+                .orElseThrow(() -> new UserException(ErrorStatus.REFRESH_TOKEN_NOT_FOUND));
 
+        if (!storedRefreshToken.equals(refreshToken)) {
+            throw new UserException(ErrorStatus.INVALID_REFRESH_TOKEN);
+        }
+
+        User user = userRepository.findById(Long.parseLong(userId))
+                .orElseThrow(() -> new UserException(ErrorStatus.USER_NOT_FOUND));
+
+        String newAccessToken = jwtTokenProvider.generateAccessToken(user);
+        String newRefreshToken = jwtTokenProvider.generateRefreshToken(user);
+
+        redisUtil.deleteRefreshToken(userId);
         redisUtil.saveRefreshToken(userId, newRefreshToken);
 
         return UserConverter.toSignInResponseDTO(newAccessToken, newRefreshToken);

src/main/java/dgu/sw/global/config/redis/RedisUtil.java

@@ -5,6 +5,7 @@
 import org.springframework.stereotype.Component;
 
 import java.security.SecureRandom;
+import java.util.Optional;
 import java.util.concurrent.TimeUnit;
 
 @Component
@@ -27,6 +28,11 @@ private String generateKey(String userId) {
         return userId;
     }
 
+    // RefreshToken 가져오기 (Optional로 감싸서 Null 체크)
+    public Optional<String> getRefreshToken(String userId) {
+        return Optional.ofNullable(redisTemplate.opsForValue().get(userId));
+    }
+
     public void deleteRefreshToken(String userId) {
         redisTemplate.delete(userId);
     }