[improve/#440] OAuth 성공 리다이렉트에서 access token 제거 (#447)

Dimo-2562 · web-flow · commit 59aacadc3c62 · 2026-06-21T06:43:01.000+09:00
* improve: OAuth 성공 리다이렉트에서 access 토큰 노출 제거

* improve: 리다이렉트 url 대신 이름을 로그인 성공 리다이렉트 url로 개선

* improve: CI/CD 파이프라인에도 관련 사항을 반영

* test: email에 query 관련 파라미터가 들어가도 별도로 생성되지 않도록 함을 테스트로 보장

* improve: 더이상 OAuth 로그인 성공 시 access token은 생성하지 않도록 변경

* refactor: 클래스 이름을 refresh 토큰에 맞게 명확하게 변경
diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
@@ -64,13 +64,13 @@ jobs:
       KAKAO_REST_API_KEY: ${{ secrets.KAKAO_REST_API_KEY }}
       KAKAO_CLIENT_SECRET: ${{ secrets.KAKAO_CLIENT_SECRET }}
       APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
-      APPLE_KEY_ID: ${{ secrets.APPLE_KEY_ID }}
-      APPLE_CLIENT_ID: ${{ secrets.APPLE_CLIENT_ID }}
-      JWT_SECRET: ${{ secrets.JWT_SECRET }}
-      JWT_REDIRECT_URI: ${{ secrets.JWT_REDIRECT_URI }}
-      JWT_REDIRECT_URI_DEV: ${{ secrets.JWT_REDIRECT_URI_DEV }}
-      JWT_LOGIN_FAILURE_REDIRECT_URI: ${{ secrets.JWT_LOGIN_FAILURE_REDIRECT_URI }}
-      JWT_LOGIN_FAILURE_REDIRECT_URI_DEV: ${{ secrets.JWT_LOGIN_FAILURE_REDIRECT_URI_DEV }}
+      APPLE_KEY_ID: ${{ secrets.APPLE_KEY_ID }}
+      APPLE_CLIENT_ID: ${{ secrets.APPLE_CLIENT_ID }}
+      JWT_SECRET: ${{ secrets.JWT_SECRET }}
+      JWT_LOGIN_SUCCESS_REDIRECT_URI: ${{ secrets.JWT_LOGIN_SUCCESS_REDIRECT_URI }}
+      JWT_LOGIN_SUCCESS_REDIRECT_URI_DEV: ${{ secrets.JWT_LOGIN_SUCCESS_REDIRECT_URI_DEV }}
+      JWT_LOGIN_FAILURE_REDIRECT_URI: ${{ secrets.JWT_LOGIN_FAILURE_REDIRECT_URI }}
+      JWT_LOGIN_FAILURE_REDIRECT_URI_DEV: ${{ secrets.JWT_LOGIN_FAILURE_REDIRECT_URI_DEV }}
       SERVER_DOMAIN: ${{ secrets.SERVER_DOMAIN }}
       CLOUDFLARE_THIRD_PARTY_THUMBNAIL_OPTIMIZATION_ENABLED: ${{ secrets.CLOUDFLARE_THIRD_PARTY_THUMBNAIL_OPTIMIZATION_ENABLED }}
       CLOUDFLARE_THIRD_PARTY_THUMBNAIL_OPTIMIZATION_ENABLED_DEV: ${{ secrets.CLOUDFLARE_THIRD_PARTY_THUMBNAIL_OPTIMIZATION_ENABLED }}
@@ -115,12 +115,12 @@ jobs:
           command_timeout: 10m
           envs: >-
             DOCKER_IMAGE,BRANCH,SPRING_PROFILES_ACTIVE,DB_URL,DB_PASSWORD,REDIS_PASSWORD,
-            DISCORD_WEBHOOK_URL,ANTHROPIC_API_KEY,OPENAI_API_KEY,
-            KAKAO_REST_API_KEY,KAKAO_CLIENT_SECRET,
-            APPLE_TEAM_ID,APPLE_KEY_ID,APPLE_CLIENT_ID,
-            JWT_SECRET,JWT_REDIRECT_URI,JWT_REDIRECT_URI_DEV,JWT_LOGIN_FAILURE_REDIRECT_URI,JWT_LOGIN_FAILURE_REDIRECT_URI_DEV,SERVER_DOMAIN,
-            CLOUDFLARE_THIRD_PARTY_THUMBNAIL_OPTIMIZATION_ENABLED,CLOUDFLARE_THIRD_PARTY_THUMBNAIL_OPTIMIZATION_DELIVERY_BASE_URL,
-            CLOUDFLARE_THIRD_PARTY_THUMBNAIL_OPTIMIZATION_ENABLED_DEV,CLOUDFLARE_THIRD_PARTY_THUMBNAIL_OPTIMIZATION_DELIVERY_BASE_URL_DEV
+            DISCORD_WEBHOOK_URL,ANTHROPIC_API_KEY,OPENAI_API_KEY,
+            KAKAO_REST_API_KEY,KAKAO_CLIENT_SECRET,
+            APPLE_TEAM_ID,APPLE_KEY_ID,APPLE_CLIENT_ID,
+            JWT_SECRET,JWT_LOGIN_SUCCESS_REDIRECT_URI,JWT_LOGIN_SUCCESS_REDIRECT_URI_DEV,JWT_LOGIN_FAILURE_REDIRECT_URI,JWT_LOGIN_FAILURE_REDIRECT_URI_DEV,SERVER_DOMAIN,
+            CLOUDFLARE_THIRD_PARTY_THUMBNAIL_OPTIMIZATION_ENABLED,CLOUDFLARE_THIRD_PARTY_THUMBNAIL_OPTIMIZATION_DELIVERY_BASE_URL,
+            CLOUDFLARE_THIRD_PARTY_THUMBNAIL_OPTIMIZATION_ENABLED_DEV,CLOUDFLARE_THIRD_PARTY_THUMBNAIL_OPTIMIZATION_DELIVERY_BASE_URL_DEV
           script: |
             cd ~/deploy
             chmod +x scripts/deploy.sh
diff --git a/docker/docker-compose.blue.yml b/docker/docker-compose.blue.yml
@@ -18,9 +18,9 @@ services:
       - APPLE_TEAM_ID=${APPLE_TEAM_ID}
       - APPLE_KEY_ID=${APPLE_KEY_ID}
       - APPLE_CLIENT_ID=${APPLE_CLIENT_ID}
-      - APPLE_PRIVATE_KEY_PATH=/app/keys/AuthKey_${APPLE_KEY_ID}.p8
-      - JWT_SECRET=${JWT_SECRET}
-      - JWT_REDIRECT_URI=${JWT_REDIRECT_URI}
+      - APPLE_PRIVATE_KEY_PATH=/app/keys/AuthKey_${APPLE_KEY_ID}.p8
+      - JWT_SECRET=${JWT_SECRET}
+      - JWT_LOGIN_SUCCESS_REDIRECT_URI=${JWT_LOGIN_SUCCESS_REDIRECT_URI}
       - JWT_LOGIN_FAILURE_REDIRECT_URI=${JWT_LOGIN_FAILURE_REDIRECT_URI}
       - SERVER_DOMAIN=${SERVER_DOMAIN}
       - CLOUDFLARE_THIRD_PARTY_THUMBNAIL_OPTIMIZATION_ENABLED=${CLOUDFLARE_THIRD_PARTY_THUMBNAIL_OPTIMIZATION_ENABLED}
diff --git a/docker/docker-compose.dev.yml b/docker/docker-compose.dev.yml
@@ -20,7 +20,7 @@ services:
       - APPLE_CLIENT_ID=${APPLE_CLIENT_ID}
       - APPLE_PRIVATE_KEY_PATH=/app/keys/AuthKey_${APPLE_KEY_ID}.p8
       - JWT_SECRET=${JWT_SECRET}
-      - JWT_REDIRECT_URI=${JWT_REDIRECT_URI_DEV}
+      - JWT_LOGIN_SUCCESS_REDIRECT_URI=${JWT_LOGIN_SUCCESS_REDIRECT_URI_DEV}
       - JWT_LOGIN_FAILURE_REDIRECT_URI=${JWT_LOGIN_FAILURE_REDIRECT_URI_DEV}
       - SERVER_DOMAIN=${SERVER_DOMAIN}
       - CLOUDFLARE_THIRD_PARTY_THUMBNAIL_OPTIMIZATION_ENABLED=${CLOUDFLARE_THIRD_PARTY_THUMBNAIL_OPTIMIZATION_ENABLED_DEV}
diff --git a/docker/docker-compose.green.yml b/docker/docker-compose.green.yml
@@ -18,9 +18,9 @@ services:
       - APPLE_TEAM_ID=${APPLE_TEAM_ID}
       - APPLE_KEY_ID=${APPLE_KEY_ID}
       - APPLE_CLIENT_ID=${APPLE_CLIENT_ID}
-      - APPLE_PRIVATE_KEY_PATH=/app/keys/AuthKey_${APPLE_KEY_ID}.p8
-      - JWT_SECRET=${JWT_SECRET}
-      - JWT_REDIRECT_URI=${JWT_REDIRECT_URI}
+      - APPLE_PRIVATE_KEY_PATH=/app/keys/AuthKey_${APPLE_KEY_ID}.p8
+      - JWT_SECRET=${JWT_SECRET}
+      - JWT_LOGIN_SUCCESS_REDIRECT_URI=${JWT_LOGIN_SUCCESS_REDIRECT_URI}
       - JWT_LOGIN_FAILURE_REDIRECT_URI=${JWT_LOGIN_FAILURE_REDIRECT_URI}
       - SERVER_DOMAIN=${SERVER_DOMAIN}
       - CLOUDFLARE_THIRD_PARTY_THUMBNAIL_OPTIMIZATION_ENABLED=${CLOUDFLARE_THIRD_PARTY_THUMBNAIL_OPTIMIZATION_ENABLED}
diff --git a/src/main/java/com/techfork/auth/security/handler/login/OAuth2AuthenticationSuccessHandler.java b/src/main/java/com/techfork/auth/security/handler/login/OAuth2AuthenticationSuccessHandler.java
@@ -17,7 +17,7 @@
 @RequiredArgsConstructor
 public class OAuth2AuthenticationSuccessHandler extends SimpleUrlAuthenticationSuccessHandler {
 
-    private final OAuth2LoginTokenIssuer tokenIssuer;
+    private final OAuth2LoginRefreshTokenIssuer refreshTokenIssuer;
     private final OAuth2LoginRefreshTokenWriter refreshTokenWriter;
     private final OAuth2LoginRedirectUrlFactory redirectUrlFactory;
 
@@ -26,13 +26,13 @@ public void onAuthenticationSuccess(HttpServletRequest request, HttpServletRespo
                                         Authentication authentication) throws IOException, ServletException {
         UserPrincipal userPrincipal = (UserPrincipal) authentication.getPrincipal();
 
-        OAuth2LoginTokens tokens = tokenIssuer.issue(userPrincipal);
-        refreshTokenWriter.write(userPrincipal.getId(), tokens, response);
+        OAuth2LoginRefreshToken issuedRefreshToken = refreshTokenIssuer.issue(userPrincipal);
+        refreshTokenWriter.write(userPrincipal.getId(), issuedRefreshToken, response);
 
         log.info("OAuth2 login success - userId: {}, role: {}, status: {}, email: {}",
                 userPrincipal.getId(), userPrincipal.getRole(), userPrincipal.getStatus(), userPrincipal.getEmail());
 
-        String targetUrl = redirectUrlFactory.createSuccessRedirectUrl(userPrincipal, tokens.accessToken());
+        String targetUrl = redirectUrlFactory.createSuccessRedirectUrl(userPrincipal);
 
         getRedirectStrategy().sendRedirect(request, response, targetUrl);
     }
diff --git a/src/main/java/com/techfork/auth/security/handler/login/OAuth2LoginRedirectUrlFactory.java b/src/main/java/com/techfork/auth/security/handler/login/OAuth2LoginRedirectUrlFactory.java
@@ -6,9 +6,6 @@
 import lombok.RequiredArgsConstructor;
 import org.springframework.stereotype.Component;
 import org.springframework.web.util.UriComponentsBuilder;
-import org.springframework.web.util.UriUtils;
-
-import java.nio.charset.StandardCharsets;
 
 @Component
 @RequiredArgsConstructor
@@ -18,12 +15,17 @@ class OAuth2LoginRedirectUrlFactory {
 
     private final JwtProperties jwtProperties;
 
-    public String createSuccessRedirectUrl(UserPrincipal userPrincipal, String accessToken) {
+    public String createSuccessRedirectUrl(UserPrincipal userPrincipal) {
         boolean isRegistered = userPrincipal.getStatus() == UserStatus.ACTIVE;
-        String email = userPrincipal.getEmail() != null ?
-                UriUtils.encode(userPrincipal.getEmail(), StandardCharsets.UTF_8) : "";
+        String email = userPrincipal.getEmail() != null ? userPrincipal.getEmail() : "";
 
-        return String.format(jwtProperties.getRedirectUri(), isRegistered, accessToken, email);
+        return UriComponentsBuilder.fromUriString(jwtProperties.getLoginSuccessRedirectUri())
+                .replaceQuery(null)
+                .queryParam("registered", isRegistered)
+                .queryParam("email", email)
+                .build()
+                .encode()
+                .toUriString();
     }
 
     public String createFailureRedirectUrl() {
diff --git a/src/main/java/com/techfork/auth/security/handler/login/OAuth2LoginRefreshToken.java b/src/main/java/com/techfork/auth/security/handler/login/OAuth2LoginRefreshToken.java
@@ -1,7 +1,6 @@
 package com.techfork.auth.security.handler.login;
 
-record OAuth2LoginTokens(
-        String accessToken,
+record OAuth2LoginRefreshToken(
         String refreshToken,
         long refreshTokenExpiration
 ) {
diff --git a/src/main/java/com/techfork/auth/security/handler/login/OAuth2LoginRefreshTokenIssuer.java b/src/main/java/com/techfork/auth/security/handler/login/OAuth2LoginRefreshTokenIssuer.java
@@ -1,6 +1,5 @@
 package com.techfork.auth.security.handler.login;
 
-import com.techfork.auth.security.jwt.JwtDTO;
 import com.techfork.auth.security.jwt.JwtProperties;
 import com.techfork.auth.security.jwt.JwtUtil;
 import com.techfork.auth.security.oauth.UserPrincipal;
@@ -9,16 +8,15 @@
 
 @Component
 @RequiredArgsConstructor
-class OAuth2LoginTokenIssuer {
+class OAuth2LoginRefreshTokenIssuer {
 
     private final JwtUtil jwtUtil;
     private final JwtProperties jwtProperties;
 
-    public OAuth2LoginTokens issue(UserPrincipal userPrincipal) {
-        JwtDTO tokens = jwtUtil.generateTokens(userPrincipal.getId(), userPrincipal.getRole());
-        return new OAuth2LoginTokens(
-                tokens.accessToken(),
-                tokens.refreshToken(),
+    public OAuth2LoginRefreshToken issue(UserPrincipal userPrincipal) {
+        String refreshToken = jwtUtil.generateRefreshToken(userPrincipal.getId(), userPrincipal.getRole());
+        return new OAuth2LoginRefreshToken(
+                refreshToken,
                 jwtProperties.getRefreshTokenExpiration()
         );
     }
diff --git a/src/main/java/com/techfork/auth/security/handler/login/OAuth2LoginRefreshTokenWriter.java b/src/main/java/com/techfork/auth/security/handler/login/OAuth2LoginRefreshTokenWriter.java
@@ -13,8 +13,16 @@ class OAuth2LoginRefreshTokenWriter {
     private final RefreshTokenStore refreshTokenStore;
     private final RefreshTokenCookieWriter refreshTokenCookieWriter;
 
-    public void write(Long userId, OAuth2LoginTokens tokens, HttpServletResponse response) {
-        refreshTokenStore.saveRefreshToken(userId, tokens.refreshToken(), tokens.refreshTokenExpiration());
-        refreshTokenCookieWriter.write(response, tokens.refreshToken(), tokens.refreshTokenExpiration());
+    public void write(Long userId, OAuth2LoginRefreshToken issuedRefreshToken, HttpServletResponse response) {
+        refreshTokenStore.saveRefreshToken(
+                userId,
+                issuedRefreshToken.refreshToken(),
+                issuedRefreshToken.refreshTokenExpiration()
+        );
+        refreshTokenCookieWriter.write(
+                response,
+                issuedRefreshToken.refreshToken(),
+                issuedRefreshToken.refreshTokenExpiration()
+        );
     }
 }
diff --git a/src/main/java/com/techfork/auth/security/jwt/JwtProperties.java b/src/main/java/com/techfork/auth/security/jwt/JwtProperties.java
@@ -13,6 +13,6 @@ public class JwtProperties {
     private String secret;
     private long accessTokenExpiration;
     private long refreshTokenExpiration;
-    private String redirectUri;
+    private String loginSuccessRedirectUri;
     private String loginFailureRedirectUri;
-}
+}
diff --git a/src/main/java/com/techfork/auth/security/jwt/JwtUtil.java b/src/main/java/com/techfork/auth/security/jwt/JwtUtil.java
@@ -29,6 +29,10 @@ public JwtDTO generateTokens(Long userId, Role role) {
         );
     }
 
+    public String generateRefreshToken(Long userId, Role role) {
+        return generateToken(userId, role, jwtProperties.getRefreshTokenExpiration(), TOKEN_TYPE_REFRESH);
+    }
+
     public String generateLongLivedAccessToken(Long userId, Role role) {
         // 30일 = 30일 * 24시간 * 60분 * 60초 * 1000밀리초
         long longLivedTokenExpiration = 30L * 24 * 60 * 60 * 1000;
diff --git a/src/main/resources/application.yml b/src/main/resources/application.yml
@@ -86,7 +86,7 @@ jwt:
   secret: ${JWT_SECRET}
   access-token-expiration: 180000  # 15분 -> 3분(테스트 임시)(밀리초) 
   refresh-token-expiration: 1209600000  # 14일 (밀리초)
-  redirect-uri: ${JWT_REDIRECT_URI:http://localhost:5173/auth/callback?registered=%s&token=%s&email=%s}
+  login-success-redirect-uri: ${JWT_LOGIN_SUCCESS_REDIRECT_URI:http://localhost:5173/auth/callback}
   login-failure-redirect-uri: ${JWT_LOGIN_FAILURE_REDIRECT_URI:http://localhost:5173/login?error=true}
 
 apple:
diff --git a/src/test/java/com/techfork/auth/security/handler/login/OAuth2AuthenticationSuccessHandlerTest.java b/src/test/java/com/techfork/auth/security/handler/login/OAuth2AuthenticationSuccessHandlerTest.java
@@ -21,13 +21,12 @@
 class OAuth2AuthenticationSuccessHandlerTest {
 
     private static final Long USER_ID = 1L;
-    private static final String ACCESS_TOKEN = "access-token";
     private static final String REFRESH_TOKEN = "refresh-token";
     private static final long REFRESH_TOKEN_EXPIRATION_MILLIS = 900_000L;
     private static final String TARGET_URL = "http://localhost:5173/auth/callback";
 
     @Mock
-    private OAuth2LoginTokenIssuer tokenIssuer;
+    private OAuth2LoginRefreshTokenIssuer refreshTokenIssuer;
 
     @Mock
     private OAuth2LoginRefreshTokenWriter refreshTokenWriter;
@@ -42,65 +41,65 @@ class OAuth2AuthenticationSuccessHandlerTest {
 
     @BeforeEach
     void setUp() {
-        successHandler = new OAuth2AuthenticationSuccessHandler(tokenIssuer, refreshTokenWriter, redirectUrlFactory);
+        successHandler = new OAuth2AuthenticationSuccessHandler(refreshTokenIssuer, refreshTokenWriter, redirectUrlFactory);
     }
 
     @Test
-    @DisplayName("OAuth2 로그인 성공 - ACTIVE 사용자는 토큰 발급/refresh 저장 후 factory가 생성한 URL로 리다이렉트한다")
+    @DisplayName("OAuth2 로그인 성공 - ACTIVE 사용자는 refresh token 발급/저장 후 factory가 생성한 URL로 리다이렉트한다")
     void onAuthenticationSuccess_ActiveUser_RedirectsToFactoryUrlWithTokens() throws Exception {
         UserPrincipal principal = principal(UserStatus.ACTIVE, "dev user@example.com");
-        OAuth2LoginTokens tokens = tokens();
+        OAuth2LoginRefreshToken issuedRefreshToken = issuedRefreshToken();
         MockHttpServletResponse response = new MockHttpServletResponse();
         given(authentication.getPrincipal()).willReturn(principal);
-        given(tokenIssuer.issue(principal)).willReturn(tokens);
-        given(redirectUrlFactory.createSuccessRedirectUrl(principal, ACCESS_TOKEN)).willReturn(TARGET_URL);
+        given(refreshTokenIssuer.issue(principal)).willReturn(issuedRefreshToken);
+        given(redirectUrlFactory.createSuccessRedirectUrl(principal)).willReturn(TARGET_URL);
 
         successHandler.onAuthenticationSuccess(new MockHttpServletRequest(), response, authentication);
 
-        verify(tokenIssuer).issue(principal);
-        verify(refreshTokenWriter).write(USER_ID, tokens, response);
-        verify(redirectUrlFactory).createSuccessRedirectUrl(principal, ACCESS_TOKEN);
+        verify(refreshTokenIssuer).issue(principal);
+        verify(refreshTokenWriter).write(USER_ID, issuedRefreshToken, response);
+        verify(redirectUrlFactory).createSuccessRedirectUrl(principal);
         assertThat(response.getRedirectedUrl()).isEqualTo(TARGET_URL);
     }
 
     @Test
-    @DisplayName("OAuth2 로그인 성공 - PENDING 사용자도 토큰 발급/refresh 저장 후 factory가 생성한 URL로 리다이렉트한다")
+    @DisplayName("OAuth2 로그인 성공 - PENDING 사용자도 refresh token 발급/저장 후 factory가 생성한 URL로 리다이렉트한다")
     void onAuthenticationSuccess_PendingUser_RedirectsToFactoryUrl() throws Exception {
         UserPrincipal principal = principal(UserStatus.PENDING, "pending@example.com");
-        OAuth2LoginTokens tokens = tokens();
+        OAuth2LoginRefreshToken issuedRefreshToken = issuedRefreshToken();
         MockHttpServletResponse response = new MockHttpServletResponse();
         given(authentication.getPrincipal()).willReturn(principal);
-        given(tokenIssuer.issue(principal)).willReturn(tokens);
-        given(redirectUrlFactory.createSuccessRedirectUrl(principal, ACCESS_TOKEN)).willReturn(TARGET_URL);
+        given(refreshTokenIssuer.issue(principal)).willReturn(issuedRefreshToken);
+        given(redirectUrlFactory.createSuccessRedirectUrl(principal)).willReturn(TARGET_URL);
 
         successHandler.onAuthenticationSuccess(new MockHttpServletRequest(), response, authentication);
 
-        verify(tokenIssuer).issue(principal);
-        verify(refreshTokenWriter).write(USER_ID, tokens, response);
-        verify(redirectUrlFactory).createSuccessRedirectUrl(principal, ACCESS_TOKEN);
+        verify(refreshTokenIssuer).issue(principal);
+        verify(refreshTokenWriter).write(USER_ID, issuedRefreshToken, response);
+        verify(redirectUrlFactory).createSuccessRedirectUrl(principal);
         assertThat(response.getRedirectedUrl()).isEqualTo(TARGET_URL);
     }
 
     @Test
-    @DisplayName("OAuth2 로그인 성공 - 이메일이 없어도 토큰 발급/refresh 저장과 redirect URL 생성을 위임한다")
+    @DisplayName("OAuth2 로그인 성공 - 이메일이 없어도 refresh token 발급/저장과 redirect URL 생성을 위임한다")
     void onAuthenticationSuccess_NullEmail_DelegatesTokenIssuingRefreshWritingAndRedirectUrlCreation() throws Exception {
         UserPrincipal principal = principal(UserStatus.ACTIVE, null);
-        OAuth2LoginTokens tokens = tokens();
+        OAuth2LoginRefreshToken issuedRefreshToken = issuedRefreshToken();
         MockHttpServletResponse response = new MockHttpServletResponse();
         given(authentication.getPrincipal()).willReturn(principal);
-        given(tokenIssuer.issue(principal)).willReturn(tokens);
-        given(redirectUrlFactory.createSuccessRedirectUrl(principal, ACCESS_TOKEN)).willReturn(TARGET_URL);
+        given(refreshTokenIssuer.issue(principal)).willReturn(issuedRefreshToken);
+        given(redirectUrlFactory.createSuccessRedirectUrl(principal)).willReturn(TARGET_URL);
 
         successHandler.onAuthenticationSuccess(new MockHttpServletRequest(), response, authentication);
 
-        verify(tokenIssuer).issue(principal);
-        verify(refreshTokenWriter).write(USER_ID, tokens, response);
-        verify(redirectUrlFactory).createSuccessRedirectUrl(principal, ACCESS_TOKEN);
+        verify(refreshTokenIssuer).issue(principal);
+        verify(refreshTokenWriter).write(USER_ID, issuedRefreshToken, response);
+        verify(redirectUrlFactory).createSuccessRedirectUrl(principal);
         assertThat(response.getRedirectedUrl()).isEqualTo(TARGET_URL);
     }
 
-    private OAuth2LoginTokens tokens() {
-        return new OAuth2LoginTokens(ACCESS_TOKEN, REFRESH_TOKEN, REFRESH_TOKEN_EXPIRATION_MILLIS);
+    private OAuth2LoginRefreshToken issuedRefreshToken() {
+        return new OAuth2LoginRefreshToken(REFRESH_TOKEN, REFRESH_TOKEN_EXPIRATION_MILLIS);
     }
 
     private UserPrincipal principal(UserStatus status, String email) {
diff --git a/src/test/java/com/techfork/auth/security/handler/login/OAuth2LoginRedirectUrlFactoryTest.java b/src/test/java/com/techfork/auth/security/handler/login/OAuth2LoginRedirectUrlFactoryTest.java
diff --git a/src/test/java/com/techfork/auth/security/handler/login/OAuth2LoginRefreshTokenIssuerTest.java b/src/test/java/com/techfork/auth/security/handler/login/OAuth2LoginRefreshTokenIssuerTest.java
diff --git a/src/test/java/com/techfork/auth/security/handler/login/OAuth2LoginRefreshTokenWriterTest.java b/src/test/java/com/techfork/auth/security/handler/login/OAuth2LoginRefreshTokenWriterTest.java
diff --git a/src/test/java/com/techfork/auth/security/jwt/JwtUtilTest.java b/src/test/java/com/techfork/auth/security/jwt/JwtUtilTest.java
diff --git a/src/test/resources/application-integrationtest.yml b/src/test/resources/application-integrationtest.yml
diff --git a/src/test/resources/application-test.yml b/src/test/resources/application-test.yml
