# AP3의 masked CSRF 응답과 raw POST credential
# Question: AP3에서 CSRF 응답의 masked token과 raw cookie 중 무엇이 실제 POST header의 data source가 되는가?
direction: right
n0: "BFF · /bff/csrf" {
  shape: rectangle
}
n1: "Browser cookie · raw" {
  shape: rectangle
}
n2: "JSON body · masked" {
  shape: rectangle
}
n3: "SPA POST 조립" {
  shape: rectangle
}
n4: "Spring CSRF filter" {
  shape: rectangle
}
n0 -> n1: "Set-Cookie · raw"
n0 -> n2: "masked JSON"
n1 -> n3: "document.cookie · raw"
n2 -> n3: "headerName only"
n3 -> n4: "Cookie raw = Header raw"