39 lines
3.6 KiB
XML
39 lines
3.6 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
<mxfile host="app.diagrams.net" modified="2026-07-23T00:00:00.000Z" agent="techviz-harness" version="24.7.17" type="device">
|
|
<diagram id="b4-header-trust-boundary" name="헤더 도착과 인가 우회는 다르다">
|
|
<mxGraphModel dx="999" dy="319" grid="1" gridSize="10" guides="1" tooltips="1" connect="1" arrows="1" fold="1" page="1" pageScale="1" pageWidth="999" pageHeight="1169" math="0" shadow="0">
|
|
<root>
|
|
<mxCell id="0"/>
|
|
<mxCell id="1" parent="0"/>
|
|
<mxCell id="n_attacker" value="외부 위조 헤더<br/>X-Auth-Request-Roles" tooltip="앱이 신뢰할 수 있는 이름과 같은 헤더를 보낸다. | Evidence: L823-L830" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;dashed=1;fillColor=#f5f7fa;strokeColor=#d97706;fillColor=#fffdf5;" vertex="1" parent="1">
|
|
<mxGeometry x="70.0" y="125.0" width="170.0" height="84.0" as="geometry"/>
|
|
</mxCell>
|
|
<mxCell id="n_nginx" value="nginx<br/>동명 헤더 미삭제" tooltip="설정하지 않은 동명 헤더를 덮어쓰지 않는다. | Evidence: L829-L830" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;rhombus;perimeter=rhombusPerimeter;fillColor=#fff7e8;strokeColor=#d97706;fillColor=#fffdf5;" vertex="1" parent="1">
|
|
<mxGeometry x="400.0" y="131.5" width="150.0" height="71.0" as="geometry"/>
|
|
</mxCell>
|
|
<mxCell id="n_echo" value="permitAll echo<br/>/api/echo · HTTP 200" tooltip="위조 헤더가 도착하는 것을 관측한 경로다. | Evidence: L825-L840" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;" vertex="1" parent="1">
|
|
<mxGeometry x="745.0" y="60.0" width="174.0" height="71.0" as="geometry"/>
|
|
</mxCell>
|
|
<mxCell id="n_protected" value="JWT 보호 경로<br/>/api/me · /api/protected · 401" tooltip="같은 위조 헤더만으로는 통과하지 못했다. | Evidence: L832-L840" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;strokeColor=#2563eb;strokeWidth=2;" vertex="1" parent="1">
|
|
<mxGeometry x="710.0" y="203.0" width="244.0" height="71.0" as="geometry"/>
|
|
</mxCell>
|
|
<mxCell id="e_a-n" value="위조 헤더" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeWidth=2;endArrow=block;endFill=1;" edge="1" parent="1" source="n_attacker" target="n_nginx">
|
|
<mxGeometry relative="1" as="geometry">
|
|
<mxPoint x="320.0" y="139.0" as="offset"/>
|
|
</mxGeometry>
|
|
</mxCell>
|
|
<mxCell id="e_n-e" value="그대로 전달" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeWidth=2;endArrow=block;endFill=1;" edge="1" parent="1" source="n_nginx" target="n_echo">
|
|
<mxGeometry relative="1" as="geometry">
|
|
<mxPoint x="671.5" y="126.8" as="offset"/>
|
|
</mxGeometry>
|
|
</mxCell>
|
|
<mxCell id="e_n-p" value="같은 헤더" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeWidth=2;endArrow=block;endFill=1;" edge="1" parent="1" source="n_nginx" target="n_protected">
|
|
<mxGeometry relative="1" as="geometry">
|
|
<mxPoint x="654.0" y="207.2" as="offset"/>
|
|
</mxGeometry>
|
|
</mxCell>
|
|
</root>
|
|
</mxGraphModel>
|
|
</diagram>
|
|
</mxfile>
|