donghyeon.kang/document-haness
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

refactor: 문서 개선 중

Browse Source
This commit is contained in:
donghyeon-ka
2026-09-21 14:30:55 +09:00
parent c93cdea150
commit 805a18f486
1497 changed files with 525837 additions and 59152 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/keycloak-session-store/final/assets/b4-header-trust-boundary/b4-header-trust-boundary.drawio
+15 -15
View File
@@ -1,35 +1,35 @@
<?xml version="1.0" encoding="UTF-8"?>
<mxfile host="app.diagrams.net" modified="2026-07-23T00:00:00.000Z" agent="techviz-harness" version="24.7.17" type="device">
<diagram id="b4-header-trust-boundary" name="지우지 않으면 통과한다">
<mxGraphModel dx="680" dy="690" grid="1" gridSize="10" guides="1" tooltips="1" connect="1" arrows="1" fold="1" page="1" pageScale="1" pageWidth="827" pageHeight="1169" math="0" shadow="0">
<diagram id="b4-header-trust-boundary" name="헤더 도착과 인가 우회는 다르다">
<mxGraphModel dx="999" dy="319" grid="1" gridSize="10" guides="1" tooltips="1" connect="1" arrows="1" fold="1" page="1" pageScale="1" pageWidth="999" pageHeight="1169" math="0" shadow="0">
<root>
<mxCell id="0"/>
<mxCell id="1" parent="0"/>
<mxCell id="n_attacker" value="외부 위조 헤더&lt;br/&gt;X-Auth-Request-Roles" tooltip="밖에서 들어온 요청이 앱이 믿는 헤더 이름을 그대로 쓴다. | Evidence: L393-L400" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;dashed=1;fillColor=#f5f7fa;strokeColor=#d97706;fillColor=#fffdf5;" vertex="1" parent="1">
<mxGeometry x="82.5" y="60.0" width="170.0" height="84.0" as="geometry"/>
<mxCell id="n_attacker" value="외부 위조 헤더&lt;br/&gt;X-Auth-Request-Roles" tooltip="앱이 신뢰할 수 있는 이름과 같은 헤더를 보낸다. | Evidence: L823-L830" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;dashed=1;fillColor=#f5f7fa;strokeColor=#d97706;fillColor=#fffdf5;" vertex="1" parent="1">
<mxGeometry x="70.0" y="125.0" width="170.0" height="84.0" as="geometry"/>
</mxCell>
<mxCell id="n_nginx" value="nginx&lt;br/&gt;proxy_set_header ... &quot;&quot;" tooltip="설정하지 않은 이름은 덮어쓰지 않는다. | Evidence: L393-L400" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;rhombus;perimeter=rhombusPerimeter;fillColor=#fff7e8;strokeColor=#d97706;fillColor=#fffdf5;" vertex="1" parent="1">
<mxGeometry x="70.0" y="240.0" width="195.0" height="71.0" as="geometry"/>
<mxCell id="n_nginx" value="nginx&lt;br/&gt;동명 헤더 미삭제" tooltip="설정하지 않은 동명 헤더를 덮어쓰지 않는다. | Evidence: L829-L830" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;rhombus;perimeter=rhombusPerimeter;fillColor=#fff7e8;strokeColor=#d97706;fillColor=#fffdf5;" vertex="1" parent="1">
<mxGeometry x="400.0" y="131.5" width="150.0" height="71.0" as="geometry"/>
</mxCell>
<mxCell id="n_proxy" value="oauth2-proxy&lt;br/&gt;--set-xauthrequest" tooltip="인증 결과를 헤더로 넣는다. | Evidence: L393-L400" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;rhombus;perimeter=rhombusPerimeter;fillColor=#fff7e8;" vertex="1" parent="1">
<mxGeometry x="87.5" y="407.0" width="160.0" height="71.0" as="geometry"/>
<mxCell id="n_echo" value="permitAll echo&lt;br/&gt;/api/echo · HTTP 200" tooltip="위조 헤더가 도착하는 것을 관측한 경로다. | Evidence: L825-L840" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;" vertex="1" parent="1">
<mxGeometry x="745.0" y="60.0" width="174.0" height="71.0" as="geometry"/>
</mxCell>
<mxCell id="n_app" value="앱&lt;br/&gt;로그인 시점 스냅샷" tooltip="헤더를 믿고 인가한다. | Evidence: L401-L408" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;strokeColor=#2563eb;strokeWidth=2;" vertex="1" parent="1">
<mxGeometry x="92.5" y="574.0" width="150.0" height="71.0" as="geometry"/>
<mxCell id="n_protected" value="JWT 보호 경로&lt;br/&gt;/api/me · /api/protected · 401" tooltip="같은 위조 헤더만으로는 통과하지 못했다. | Evidence: L832-L840" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;strokeColor=#2563eb;strokeWidth=2;" vertex="1" parent="1">
<mxGeometry x="710.0" y="203.0" width="244.0" height="71.0" as="geometry"/>
</mxCell>
<mxCell id="e_a-n" value="위조 헤더" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeWidth=2;endArrow=block;endFill=1;" edge="1" parent="1" source="n_attacker" target="n_nginx">
<mxGeometry relative="1" as="geometry">
<mxPoint x="191.5" y="192.0" as="offset"/>
<mxPoint x="320.0" y="139.0" as="offset"/>
</mxGeometry>
</mxCell>
<mxCell id="e_n-p" value="미삭제 시 통과" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeWidth=2;endArrow=block;endFill=1;" edge="1" parent="1" source="n_nginx" target="n_proxy">
<mxCell id="e_n-e" value="그대로 전달" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeWidth=2;endArrow=block;endFill=1;" edge="1" parent="1" source="n_nginx" target="n_echo">
<mxGeometry relative="1" as="geometry">
<mxPoint x="191.5" y="359.0" as="offset"/>
<mxPoint x="671.5" y="126.8" as="offset"/>
</mxGeometry>
</mxCell>
<mxCell id="e_p-a" value="인가 헤더" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeWidth=2;endArrow=block;endFill=1;" edge="1" parent="1" source="n_proxy" target="n_app">
<mxCell id="e_n-p" value="같은 헤더" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeWidth=2;endArrow=block;endFill=1;" edge="1" parent="1" source="n_nginx" target="n_protected">
<mxGeometry relative="1" as="geometry">
<mxPoint x="191.5" y="526.0" as="offset"/>
<mxPoint x="654.0" y="207.2" as="offset"/>
</mxGeometry>
</mxCell>
</root>