donghyeon.kang/document-haness
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

docs(keycloak-session-store): remake all 28 diagrams through the techviz pipeline

Browse Source 
The originating repository's SVGs were drawn by hand and every one of them
put a title, a subtitle and an explanation band inside the canvas. This
repository forbids both, so they could not be carried over — the whole set
was rebuilt through the skill's pipeline instead.

Each diagram went through prepare, references, prompt, a VizSpec 1.1 citing
document line ranges, lint, and render. All 28 pass lint and produce the
same eight formats the existing keycloak project has. Sentences moved out of
the canvas into <desc> and the paragraph beside each figure; the drawings
carry names only.

Two lint rules did real work rather than formatting work:

  edge-through-node                  caught arrows crossing an unrelated
                                     node and implying an adjacency that
                                     does not exist — four diagrams had to
                                     be restructured, not just relaid out
  evidence-outside-prepared-context  caught a diagram citing another
                                     section; its anchor moved from B-0 to
                                     B-1 so all three sections it draws on
                                     are inside the prepared context

lab-topology also had to change profile: its context offers a different
candidate set, and query-fanout with shard roles is what the section
actually shows — one entry point spreading to two Keycloak nodes.

The document now carries all 28 inline, one per claim that needed one, and
the section recording what was still missing is updated: the diagram gap is
closed, Studio records remain.

verify-pipeline.py passes. audit-records.py reports no issues.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
DongHyeonka
2026-09-05 11:03:10 +09:00
co-authored by Claude Opus 5
parent b2963105a8
commit 75bed382c8
286 changed files with 65385 additions and 710 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/keycloak-session-store/final/assets/b4-header-trust-boundary/b4-header-trust-boundary.alt.md
+22
View File
@@ -0,0 +1,22 @@
# 지우지 않으면 통과한다
## Alternative text
밖에서 들어온 위조 헤더가 프록시를 그대로 통과해 앱에 닿는 구성. 프록시가 그 이름을 설정할 때만 덮어쓴다.
## Long description
nginx 는 자기가 proxy_set_header 로 설정한 헤더만 덮어쓴다. 설정하지 않은 이름은 클라이언트가 보낸 값이 그대로 지나간다. 그래서 X-Auth-Request-Roles 같은 헤더를 앱이 믿으려면 프록시가 그 이름을 먼저 빈 값으로 지워야 한다. 그리고 IdP 에서 클레임을 바꿔도 반영되지 않는다. 12회 요청 6초 동안 옛 값이 갔고 세션을 지워 재인증한 뒤에야 새 값이 왔다. 세션은 로그인 시점의 스냅샷이다.
## Elements and evidence
- **밖에서 보낸 위조 헤더** (actor): 앱이 믿는 이름을 그대로 쓴다. Evidence: L393–L400.
- **nginx** (gateway): 설정하지 않은 이름은 덮어쓰지 않는다. Evidence: L393–L400.
- **oauth2-proxy** (gateway): 인증 결과를 헤더로 넣는다. Evidence: L393–L400.
- **앱** (service): 헤더를 믿고 인가한다. Evidence: L401–L408.
## Relationships
- **밖에서 보낸 위조 헤더 → nginx:** 위조 헤더. Evidence: L393–L400.
- **nginx → oauth2-proxy:** 지우지 않으면 그대로 지난다. Evidence: L393–L400.
- **oauth2-proxy → 앱:** 인가 헤더. Evidence: L393–L408.
docs/keycloak-session-store/final/assets/b4-header-trust-boundary/b4-header-trust-boundary.d2
+18
View File
@@ -0,0 +1,18 @@
# 지우지 않으면 통과한다
# Question: Edge 가 넣어주는 인가 헤더를 앱이 믿어도 되는가
direction: down
n0: "밖에서 보낸 위조 헤더" {
shape: person
}
n1: "nginx" {
shape: diamond
}
n2: "oauth2-proxy" {
shape: diamond
}
n3: "앱" {
shape: rectangle
}
n0 -> n1: "위조 헤더"
n1 -> n2: "지우지 않으면 그대로 지난다"
n2 -> n3: "인가 헤더"
docs/keycloak-session-store/final/assets/b4-header-trust-boundary/b4-header-trust-boundary.dot
+12
View File
@@ -0,0 +1,12 @@
digraph techviz {
graph [rankdir=TB, splines=ortho, nodesep=0.55, ranksep=0.85];
node [fontname=Helvetica, fontsize=11, margin="0.18,0.12", style="rounded,filled", fillcolor=white, color="#2d4357", penwidth=1.5];
edge [fontname=Helvetica, fontsize=10, color="#364b5f", penwidth=1.4, arrowsize=0.75];
n0 [label="밖에서 보낸 위조 헤더", shape=box, style="rounded,dashed,filled"];
n1 [label="nginx", shape=diamond, style="rounded,filled"];
n2 [label="oauth2-proxy", shape=diamond, style="rounded,filled"];
n3 [label="앱", shape=box, style="rounded,filled"];
n0 -> n1 [label="위조 헤더", style=solid];
n1 -> n2 [label="지우지 않으면 그대로 지난다", style=solid];
n2 -> n3 [label="인가 헤더", style=solid];
}
docs/keycloak-session-store/final/assets/b4-header-trust-boundary/b4-header-trust-boundary.drawio
+38
View File
@@ -0,0 +1,38 @@
<?xml version="1.0" encoding="UTF-8"?>
<mxfile host="app.diagrams.net" modified="2026-07-23T00:00:00.000Z" agent="techviz-harness" version="24.7.17" type="device">
<diagram id="b4-header-trust-boundary" name="지우지 않으면 통과한다">
<mxGraphModel dx="680" dy="690" grid="1" gridSize="10" guides="1" tooltips="1" connect="1" arrows="1" fold="1" page="1" pageScale="1" pageWidth="827" pageHeight="1169" math="0" shadow="0">
<root>
<mxCell id="0"/>
<mxCell id="1" parent="0"/>
<mxCell id="n_attacker" value="밖에서 보낸 위조 헤더&lt;br/&gt;X-Auth-Request-Roles" tooltip="앱이 믿는 이름을 그대로 쓴다. | Evidence: L393-L400" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;dashed=1;fillColor=#f5f7fa;strokeColor=#d97706;fillColor=#fffdf5;" vertex="1" parent="1">
<mxGeometry x="124.5" y="60.0" width="170.0" height="84.0" as="geometry"/>
</mxCell>
<mxCell id="n_nginx" value="nginx&lt;br/&gt;proxy_set_header ... &quot;&quot; 로 먼저 지워야 한다" tooltip="설정하지 않은 이름은 덮어쓰지 않는다. | Evidence: L393-L400" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;rhombus;perimeter=rhombusPerimeter;fillColor=#fff7e8;strokeColor=#d97706;fillColor=#fffdf5;" vertex="1" parent="1">
<mxGeometry x="70.0" y="240.0" width="279.0" height="71.0" as="geometry"/>
</mxCell>
<mxCell id="n_proxy" value="oauth2-proxy&lt;br/&gt;--set-xauthrequest" tooltip="인증 결과를 헤더로 넣는다. | Evidence: L393-L400" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;rhombus;perimeter=rhombusPerimeter;fillColor=#fff7e8;" vertex="1" parent="1">
<mxGeometry x="129.5" y="407.0" width="160.0" height="71.0" as="geometry"/>
</mxCell>
<mxCell id="n_app" value="앱&lt;br/&gt;세션은 로그인 시점의 스냅샷" tooltip="헤더를 믿고 인가한다. | Evidence: L401-L408" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;strokeColor=#2563eb;strokeWidth=2;" vertex="1" parent="1">
<mxGeometry x="134.5" y="574.0" width="150.0" height="71.0" as="geometry"/>
</mxCell>
<mxCell id="e_a-n" value="위조 헤더" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeWidth=2;endArrow=block;endFill=1;" edge="1" parent="1" source="n_attacker" target="n_nginx">
<mxGeometry relative="1" as="geometry">
<mxPoint x="233.5" y="192.0" as="offset"/>
</mxGeometry>
</mxCell>
<mxCell id="e_n-p" value="지우지 않으면 그대로 지난다" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeWidth=2;endArrow=block;endFill=1;" edge="1" parent="1" source="n_nginx" target="n_proxy">
<mxGeometry relative="1" as="geometry">
<mxPoint x="233.5" y="359.0" as="offset"/>
</mxGeometry>
</mxCell>
<mxCell id="e_p-a" value="인가 헤더" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeWidth=2;endArrow=block;endFill=1;" edge="1" parent="1" source="n_proxy" target="n_app">
<mxGeometry relative="1" as="geometry">
<mxPoint x="233.5" y="526.0" as="offset"/>
</mxGeometry>
</mxCell>
</root>
</mxGraphModel>
</diagram>
</mxfile>
docs/keycloak-session-store/final/assets/b4-header-trust-boundary/b4-header-trust-boundary.excalidraw
+586
View File
@@ -0,0 +1,586 @@
{
"type": "excalidraw",
"version": 2,
"source": "techviz-harness",
"elements": [
{
"id": "edge-a-n",
"type": "arrow",
"x": 209.5,
"y": 144.0,
"width": 0.0,
"height": 96.0,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": null,
"roundness": null,
"seed": 1392959887,
"version": 1,
"versionNonce": 960034335,
"isDeleted": false,
"boundElements": [],
"updated": 0,
"link": null,
"locked": false,
"points": [
[
0.0,
0.0
],
[
0.0,
48.0
],
[
0.0,
48.0
],
[
0.0,
96.0
]
],
"lastCommittedPoint": null,
"startBinding": {
"elementId": "node-attacker",
"focus": 0,
"gap": 4
},
"endBinding": {
"elementId": "node-nginx",
"focus": 0,
"gap": 4
},
"startArrowhead": null,
"endArrowhead": "arrow",
"elbowed": true
},
{
"id": "edge-label-a-n",
"type": "text",
"x": 188.5,
"y": 180.0,
"width": 90,
"height": 24,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 1,
"strokeStyle": "solid",
"roughness": 0,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": null,
"roundness": {
"type": 3
},
"seed": 683347805,
"version": 1,
"versionNonce": 1056915663,
"isDeleted": false,
"boundElements": [],
"updated": 0,
"link": null,
"locked": false,
"fontSize": 13,
"fontFamily": 5,
"text": "위조 헤더",
"textAlign": "center",
"verticalAlign": "middle",
"containerId": null,
"originalText": "위조 헤더",
"autoResize": true,
"lineHeight": 1.25
},
{
"id": "edge-n-p",
"type": "arrow",
"x": 209.5,
"y": 311.0,
"width": 0.0,
"height": 96.0,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": null,
"roundness": null,
"seed": 1877236961,
"version": 1,
"versionNonce": 266888902,
"isDeleted": false,
"boundElements": [],
"updated": 0,
"link": null,
"locked": false,
"points": [
[
0.0,
0.0
],
[
0.0,
48.0
],
[
0.0,
48.0
],
[
0.0,
96.0
]
],
"lastCommittedPoint": null,
"startBinding": {
"elementId": "node-nginx",
"focus": 0,
"gap": 4
},
"endBinding": {
"elementId": "node-proxy",
"focus": 0,
"gap": 4
},
"startArrowhead": null,
"endArrowhead": "arrow",
"elbowed": true
},
{
"id": "edge-label-n-p",
"type": "text",
"x": 173.5,
"y": 347.0,
"width": 120,
"height": 24,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 1,
"strokeStyle": "solid",
"roughness": 0,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": null,
"roundness": {
"type": 3
},
"seed": 1431696520,
"version": 1,
"versionNonce": 51503328,
"isDeleted": false,
"boundElements": [],
"updated": 0,
"link": null,
"locked": false,
"fontSize": 13,
"fontFamily": 5,
"text": "지우지 않으면 그대로 지난다",
"textAlign": "center",
"verticalAlign": "middle",
"containerId": null,
"originalText": "지우지 않으면 그대로 지난다",
"autoResize": true,
"lineHeight": 1.25
},
{
"id": "edge-p-a",
"type": "arrow",
"x": 209.5,
"y": 478.0,
"width": 0.0,
"height": 96.0,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": null,
"roundness": null,
"seed": 579930019,
"version": 1,
"versionNonce": 141204879,
"isDeleted": false,
"boundElements": [],
"updated": 0,
"link": null,
"locked": false,
"points": [
[
0.0,
0.0
],
[
0.0,
48.0
],
[
0.0,
48.0
],
[
0.0,
96.0
]
],
"lastCommittedPoint": null,
"startBinding": {
"elementId": "node-proxy",
"focus": 0,
"gap": 4
},
"endBinding": {
"elementId": "node-app",
"focus": 0,
"gap": 4
},
"startArrowhead": null,
"endArrowhead": "arrow",
"elbowed": true
},
{
"id": "edge-label-p-a",
"type": "text",
"x": 188.5,
"y": 514.0,
"width": 90,
"height": 24,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 1,
"strokeStyle": "solid",
"roughness": 0,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": null,
"roundness": {
"type": 3
},
"seed": 1931736220,
"version": 1,
"versionNonce": 15055194,
"isDeleted": false,
"boundElements": [],
"updated": 0,
"link": null,
"locked": false,
"fontSize": 13,
"fontFamily": 5,
"text": "인가 헤더",
"textAlign": "center",
"verticalAlign": "middle",
"containerId": null,
"originalText": "인가 헤더",
"autoResize": true,
"lineHeight": 1.25
},
{
"id": "node-attacker",
"type": "rectangle",
"x": 124.5,
"y": 60.0,
"width": 170.0,
"height": 84.0,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "#ffffff",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "dashed",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": null,
"roundness": {
"type": 3
},
"seed": 145023296,
"version": 1,
"versionNonce": 365379687,
"isDeleted": false,
"boundElements": [],
"updated": 0,
"link": null,
"locked": false
},
{
"id": "node-label-attacker",
"type": "text",
"x": 134.5,
"y": 70.0,
"width": 150.0,
"height": 64.0,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 1,
"strokeStyle": "solid",
"roughness": 0,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": null,
"roundness": {
"type": 3
},
"seed": 539786699,
"version": 1,
"versionNonce": 180744341,
"isDeleted": false,
"boundElements": [],
"updated": 0,
"link": null,
"locked": false,
"fontSize": 15,
"fontFamily": 5,
"text": "밖에서 보낸 위조 헤더\nX-Auth-Request-Roles",
"textAlign": "center",
"verticalAlign": "middle",
"containerId": null,
"originalText": "밖에서 보낸 위조 헤더\nX-Auth-Request-Roles",
"autoResize": true,
"lineHeight": 1.25
},
{
"id": "node-nginx",
"type": "rectangle",
"x": 70.0,
"y": 240.0,
"width": 279.0,
"height": 71.0,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "#fff4e6",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": null,
"roundness": {
"type": 3
},
"seed": 721013300,
"version": 1,
"versionNonce": 1520646945,
"isDeleted": false,
"boundElements": [],
"updated": 0,
"link": null,
"locked": false
},
{
"id": "node-label-nginx",
"type": "text",
"x": 80.0,
"y": 250.0,
"width": 259.0,
"height": 51.0,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 1,
"strokeStyle": "solid",
"roughness": 0,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": null,
"roundness": {
"type": 3
},
"seed": 117243520,
"version": 1,
"versionNonce": 936748041,
"isDeleted": false,
"boundElements": [],
"updated": 0,
"link": null,
"locked": false,
"fontSize": 15,
"fontFamily": 5,
"text": "nginx\nproxy_set_header ... \"\" 로 먼저 지워야 한다",
"textAlign": "center",
"verticalAlign": "middle",
"containerId": null,
"originalText": "nginx\nproxy_set_header ... \"\" 로 먼저 지워야 한다",
"autoResize": true,
"lineHeight": 1.25
},
{
"id": "node-proxy",
"type": "rectangle",
"x": 129.5,
"y": 407.0,
"width": 160.0,
"height": 71.0,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "#fff4e6",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": null,
"roundness": {
"type": 3
},
"seed": 254112210,
"version": 1,
"versionNonce": 42167050,
"isDeleted": false,
"boundElements": [],
"updated": 0,
"link": null,
"locked": false
},
{
"id": "node-label-proxy",
"type": "text",
"x": 139.5,
"y": 417.0,
"width": 140.0,
"height": 51.0,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 1,
"strokeStyle": "solid",
"roughness": 0,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": null,
"roundness": {
"type": 3
},
"seed": 418528669,
"version": 1,
"versionNonce": 1299542283,
"isDeleted": false,
"boundElements": [],
"updated": 0,
"link": null,
"locked": false,
"fontSize": 15,
"fontFamily": 5,
"text": "oauth2-proxy\n--set-xauthrequest",
"textAlign": "center",
"verticalAlign": "middle",
"containerId": null,
"originalText": "oauth2-proxy\n--set-xauthrequest",
"autoResize": true,
"lineHeight": 1.25
},
{
"id": "node-app",
"type": "rectangle",
"x": 134.5,
"y": 574.0,
"width": 150.0,
"height": 71.0,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "#ffffff",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": null,
"roundness": {
"type": 3
},
"seed": 594277328,
"version": 1,
"versionNonce": 293358427,
"isDeleted": false,
"boundElements": [],
"updated": 0,
"link": null,
"locked": false
},
{
"id": "node-label-app",
"type": "text",
"x": 144.5,
"y": 584.0,
"width": 130.0,
"height": 51.0,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 1,
"strokeStyle": "solid",
"roughness": 0,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": null,
"roundness": {
"type": 3
},
"seed": 1055843055,
"version": 1,
"versionNonce": 1025494149,
"isDeleted": false,
"boundElements": [],
"updated": 0,
"link": null,
"locked": false,
"fontSize": 15,
"fontFamily": 5,
"text": "앱\n세션은 로그인 시점의 스냅샷",
"textAlign": "center",
"verticalAlign": "middle",
"containerId": null,
"originalText": "앱\n세션은 로그인 시점의 스냅샷",
"autoResize": true,
"lineHeight": 1.25
}
],
"appState": {
"gridSize": 10,
"viewBackgroundColor": "#ffffff",
"currentItemFontFamily": 5
},
"files": {}
}
docs/keycloak-session-store/final/assets/b4-header-trust-boundary/b4-header-trust-boundary.manifest.json
+32
View File
@@ -0,0 +1,32 @@
{
"harness_version": "0.2.0",
"spec_id": "b4-header-trust-boundary",
"spec_version": "1.1",
"spec_sha256": "9ae5cf39dfc20e31d81b892ae7483d2b9ccf94fa2c91a03837200b463bfc1103",
"source_context": {
"document": "docs/keycloak-session-store/final/document.md",
"document_sha256": "1d44cba1905544d92f1d26ae36a8deb64a3db3914d6b488fd30d6ae7f8cfbabe",
"anchor": {
"kind": "heading",
"value": "B-4 · Edge 인가의 범위 (Q4)",
"line": 401
}
},
"outputs": [
"b4-header-trust-boundary.svg",
"b4-header-trust-boundary.mmd",
"b4-header-trust-boundary.d2",
"b4-header-trust-boundary.dot",
"b4-header-trust-boundary.drawio",
"b4-header-trust-boundary.excalidraw",
"b4-header-trust-boundary.alt.md"
],
"lint_issue_count": 0,
"assumption_count": 0,
"assumptions_allowed": false,
"composition_profile": "component-flow",
"reference_ids": [
"payment-event-flow"
],
"diagram_only": true
}
docs/keycloak-session-store/final/assets/b4-header-trust-boundary/b4-header-trust-boundary.mmd
+12
View File
@@ -0,0 +1,12 @@
%% 지우지 않으면 통과한다
%% question: Edge 가 넣어주는 인가 헤더를 앱이 믿어도 되는가
flowchart TB
n0(["밖에서 보낸 위조 헤더"])
n1{"nginx"}
n2{"oauth2-proxy"}
n3["앱"]
n0 -->|"위조 헤더"| n1
n1 -->|"지우지 않으면 그대로 지난다"| n2
n2 -->|"인가 헤더"| n3
classDef external stroke-dasharray: 6 4
class n0 external
docs/keycloak-session-store/final/assets/b4-header-trust-boundary/b4-header-trust-boundary.svg
+84
View File
@@ -0,0 +1,84 @@
<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" width="680" height="690" viewBox="0 0 680 690" role="img" aria-labelledby="diagram-title diagram-description">
<title id="diagram-title">지우지 않으면 통과한다</title>
<desc id="diagram-description">nginx 는 자기가 proxy_set_header 로 설정한 헤더만 덮어쓴다. 설정하지 않은 이름은 클라이언트가 보낸 값이 그대로 지나간다. 그래서 X-Auth-Request-Roles 같은 헤더를 앱이 믿으려면 프록시가 그 이름을 먼저 빈 값으로 지워야 한다. 그리고 IdP 에서 클레임을 바꿔도 반영되지 않는다. 12회 요청 6초 동안 옛 값이 갔고 세션을 지워 재인증한 뒤에야 새 값이 왔다. 세션은 로그인 시점의 스냅샷이다.</desc>
<metadata>{&quot;techviz&quot;:{&quot;spec_version&quot;:&quot;1.1&quot;,&quot;id&quot;:&quot;b4-header-trust-boundary&quot;,&quot;profile&quot;:&quot;component-flow&quot;},&quot;source_context&quot;:{&quot;document&quot;:&quot;docs/keycloak-session-store/final/document.md&quot;,&quot;document_sha256&quot;:&quot;1d44cba1905544d92f1d26ae36a8deb64a3db3914d6b488fd30d6ae7f8cfbabe&quot;,&quot;anchor&quot;:{&quot;kind&quot;:&quot;heading&quot;,&quot;value&quot;:&quot;B-4 · Edge 인가의 범위 (Q4)&quot;,&quot;line&quot;:401}},&quot;evidence_policy&quot;:&quot;Each factual element cites source lines or is marked assumption.&quot;,&quot;diagram_only&quot;:true}</metadata>
<defs>
<marker id="arrow" viewBox="0 0 10 10" refX="9" refY="5" markerWidth="7" markerHeight="7" orient="auto-start-reverse">
<path d="M 0 0 L 10 5 L 0 10 z" />
</marker>
<style>
:root { color-scheme: light; }
text { font-family: Inter, Pretendard, ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif; fill: #111827; }
.canvas { fill: #ffffff; }
.group-box { fill: #ffffff; stroke: #9ca3af; stroke-width: 1.4; stroke-dasharray: 7 5; }
.group-label-bg { fill: #ffffff; }
.group-label { font-size: 13px; font-weight: 650; fill: #374151; }
.edge { fill: none; stroke: #374151; stroke-width: 1.8; stroke-linejoin: round; stroke-linecap: round; marker-end: url(#arrow); }
.edge.style-dashed, .edge.semantic-dashed, .edge.assumption { stroke-dasharray: 7 5; }
.edge.style-dotted { stroke-dasharray: 2 5; }
.edge.emphasis-primary { stroke: #2563eb; stroke-width: 2.2; }
.edge.emphasis-muted { stroke: #9ca3af; }
.edge.emphasis-warning, .edge.kind-failure, .edge.kind-error { stroke: #dc2626; stroke-width: 2.2; }
.edge-label-bg { fill: #ffffff; }
.edge-label { font-size: 12px; font-weight: 560; text-anchor: middle; }
.node-shape { fill: #ffffff; stroke: #4b5563; stroke-width: 1.7; }
.node-shape.emphasis-primary { stroke: #2563eb; stroke-width: 2.2; }
.node-shape.emphasis-muted { stroke: #9ca3af; fill: #f9fafb; }
.node-shape.emphasis-warning { stroke: #d97706; stroke-width: 2; fill: #fffdf5; }
.node-shape.kind-database, .node-shape.kind-datastore, .node-shape.kind-storage { fill: #f8fafc; }
.node-shape.kind-queue, .node-shape.kind-event, .node-shape.kind-topic { fill: #fafafa; }
.node-shape.assumption { stroke-dasharray: 4 4; }
.storage-bottom, .controller-divider { fill: none; stroke: #4b5563; stroke-width: 1.4; }
.controller-led { fill: #4b5563; }
.actor-symbol { fill: none; stroke: #4b5563; stroke-width: 1.8; stroke-linecap: round; }
.actor-symbol.emphasis-primary { stroke: #2563eb; stroke-width: 2.2; }
.node-label { font-size: 14px; font-weight: 650; text-anchor: middle; }
.node-role { font-size: 10px; letter-spacing: 0.04em; text-anchor: middle; fill: #6b7280; }
.node-detail-divider { stroke: #d1d5db; stroke-width: 1; }
.node-detail { font-size: 11px; fill: #374151; }
.assumption-badge { font-size: 9px; font-weight: 700; fill: #92400e; }
.failure-mark { stroke: #dc2626; stroke-width: 4; stroke-linecap: round; }
.lifeline { stroke: #9ca3af; stroke-width: 1.2; stroke-dasharray: 5 5; }
.timeline-axis { stroke: #374151; stroke-width: 1.8; marker-end: url(#arrow); }
.timeline-stem { stroke: #6b7280; stroke-width: 1.3; }
.timeline-marker { fill: #ffffff; stroke: #374151; stroke-width: 1.7; }
.timeline-marker.primary { fill: #2563eb; stroke: #2563eb; }
.timeline-marker.warning { fill: #dc2626; stroke: #dc2626; }
.timeline-label { font-size: 13px; font-weight: 650; text-anchor: middle; }
.timeline-detail { font-size: 11px; fill: #4b5563; text-anchor: middle; }
</style>
</defs>
<rect class="canvas" width="680" height="690" />
<polyline class="edge kind-request style-solid emphasis-normal" points="209.5,144.0 209.5,192.0 209.5,192.0 209.5,240.0" data-evidence="393-400" />
<rect class="edge-label-bg" x="207.8" y="178.0" width="51.5" height="22" rx="3" />
<text class="edge-label" x="233.5" y="193.0">위조 헤더</text>
<polyline class="edge kind-request style-solid emphasis-normal" points="209.5,311.0 209.5,359.0 209.5,359.0 209.5,407.0" data-evidence="393-400" />
<rect class="edge-label-bg" x="174.2" y="345.0" width="118.5" height="22" rx="3" />
<text class="edge-label" x="233.5" y="360.0">지우지 않으면 그대로 지난다</text>
<polyline class="edge kind-request style-solid emphasis-normal" points="209.5,478.0 209.5,526.0 209.5,526.0 209.5,574.0" data-evidence="393-408" />
<rect class="edge-label-bg" x="207.8" y="512.0" width="51.5" height="22" rx="3" />
<text class="edge-label" x="233.5" y="527.0">인가 헤더</text>
<g id="node-attacker">
<g class="actor-symbol emphasis-warning" data-evidence="393-400"><circle cx="209.5" cy="80.0" r="11.0" /><line x1="209.5" y1="96.0" x2="209.5" y2="105.0" /><line x1="191.5" y1="106.0" x2="227.5" y2="106.0" /><line x1="209.5" y1="105.0" x2="194.5" y2="122.0" /><line x1="209.5" y1="105.0" x2="224.5" y2="122.0" /></g>
<text class="node-label" x="209.5" y="137.0">밖에서 보낸 위조 헤더</text>
</g>
<g id="node-nginx">
<polygon class="node-shape kind-gateway emphasis-warning role-control" data-evidence="393-400" points="209.5,240.0 349.0,275.5 209.5,311.0 70.0,275.5" />
<text class="node-label" x="209.5" y="267.0">nginx</text>
<line class="node-detail-divider" x1="84.0" y1="288.0" x2="335.0" y2="288.0" />
<text class="node-detail" x="86.0" y="305.0">proxy_set_header ... &quot;&quot; 로 먼저 지워야 한다</text>
</g>
<g id="node-proxy">
<polygon class="node-shape kind-gateway emphasis-normal role-control" data-evidence="393-400" points="209.5,407.0 289.5,442.5 209.5,478.0 129.5,442.5" />
<text class="node-label" x="209.5" y="434.0">oauth2-proxy</text>
<line class="node-detail-divider" x1="143.5" y1="455.0" x2="275.5" y2="455.0" />
<text class="node-detail" x="145.5" y="472.0">--set-xauthrequest</text>
</g>
<g id="node-app">
<rect class="node-shape kind-service emphasis-primary role-target" data-evidence="401-408" x="134.5" y="574.0" width="150.0" height="71.0" rx="7" />
<text class="node-label" x="209.5" y="601.0">앱</text>
<line class="node-detail-divider" x1="148.5" y1="622.0" x2="270.5" y2="622.0" />
<text class="node-detail" x="150.5" y="639.0">세션은 로그인 시점의 스냅샷</text>
</g>
</svg>
Side by Side

After

Width:  |  Height:  |  Size: 7.0 KiB