donghyeon.kang/document-haness
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

feat: 가상화 문서들 추가

Browse Source
This commit is contained in:
DongHyeonka
2026-09-10 08:54:05 +09:00
parent e9f6a93327
commit 43e1aadef0
695 changed files with 153404 additions and 12754 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/keycloak/final/assets/ap3-csrf-boundary/ap3-csrf-boundary.alt.md
+10 -10
View File
@@ -10,16 +10,16 @@ BFF CSRF endpoint가 raw XSRF cookie와 masked JSON token으로 분기하고, SP
## Elements and evidence
- **BFF · /bff/csrf** (service): CookieCsrfTokenRepository와 CsrfController를 통해 raw cookie와 masked JSON 응답을 만드는 endpoint. Evidence: L819–L844.
- **Browser cookie · raw** (credential): Cookie repository가 path /에 설정하며 SPA가 document.cookie로 읽는 raw CSRF token. Evidence: L827–L834, L844–L856.
- **JSON body · masked** (data): Request attribute용 token을 masked한 JSON 표현으로, SPA는 token 값이 아니라 headerName만 사용한다. Evidence: L836–L846.
- **SPA POST 조립** (component): Raw cookie 값을 X-XSRF-TOKEN header에 넣어 preference POST를 만드는 browser code. Evidence: L846–L856, L862–L870.
- **Spring CSRF filter** (security): Repository의 expected raw token과 submitted raw header를 controller 실행 전에 비교하는 방어선. Evidence: L854–L854, L873–L873, L897–L904.
- **BFF · /bff/csrf** (service): CookieCsrfTokenRepository와 CsrfController를 통해 raw cookie와 masked JSON 응답을 만드는 endpoint. Evidence: L855–L880.
- **Browser cookie · raw** (credential): Cookie repository가 path /에 설정하며 SPA가 document.cookie로 읽는 raw CSRF token. Evidence: L863–L870, L880–L892.
- **JSON body · masked** (data): Request attribute용 token을 masked한 JSON 표현으로, SPA는 token 값이 아니라 headerName만 사용한다. Evidence: L872–L882.
- **SPA POST 조립** (component): Raw cookie 값을 X-XSRF-TOKEN header에 넣어 preference POST를 만드는 browser code. Evidence: L882–L892, L898–L906.
- **Spring CSRF filter** (security): Repository의 expected raw token과 submitted raw header를 controller 실행 전에 비교하는 방어선. Evidence: L890–L890, L909–L909, L933–L940.
## Relationships
- **SPA POST 조립 → Spring CSRF filter:** Cookie raw = Header raw. Evidence: L848–L873.
- **BFF · /bff/csrf → JSON body · masked:** masked JSON. Evidence: L836–L844.
- **BFF · /bff/csrf → Browser cookie · raw:** Set-Cookie · raw. Evidence: L827–L834.
- **JSON body · masked → SPA POST 조립:** headerName only. Evidence: L846–L856.
- **Browser cookie · raw → SPA POST 조립:** document.cookie · raw. Evidence: L846–L856.
- **SPA POST 조립 → Spring CSRF filter:** raw 대조. Evidence: L884–L909.
- **BFF · /bff/csrf → JSON body · masked:** masked JSON. Evidence: L872–L880.
- **BFF · /bff/csrf → Browser cookie · raw:** Set-Cookie · raw. Evidence: L863–L870.
- **JSON body · masked → SPA POST 조립:** headerName. Evidence: L882–L892.
- **Browser cookie · raw → SPA POST 조립:** raw cookie. Evidence: L882–L892.