로그인 후 리다이렉트를 검증된 상대경로로 고정, NextAuth 계산 URL은 로그로 기록

app/(auth)/login/actions.ts

@@ -4,6 +4,7 @@ import { AuthError } from "next-auth";
 import { redirect } from "next/navigation";
 
 import { signIn } from "@/auth";
+import { logger } from "@/lib/logger";
 
 function sanitizeCallbackUrl(raw: string): string {
   try {
@@ -21,11 +22,17 @@ export async function loginAction(formData: FormData) {
   );
 
   try {
-    await signIn("credentials", {
+    const nextAuthRedirectUrl = await signIn("credentials", {
       adminName: formData.get("adminName"),
       password: formData.get("password"),
+      redirect: false,
       redirectTo: callbackUrl,
     });
+
+    logger.info("auth", "login redirect", {
+      nextAuthRedirectUrl: String(nextAuthRedirectUrl),
+      callbackUrl,
+    });
   } catch (error) {
     if (error instanceof AuthError) {
       redirect(
@@ -35,4 +42,6 @@ export async function loginAction(formData: FormData) {
 
     throw error;
   }
+
+  redirect(callbackUrl);
 }