67 lines
3.4 KiB
XML
67 lines
3.4 KiB
XML
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 820 285" role="img"
|
|
aria-labelledby="t4 d4">
|
|
<title id="t4">AP4 edge 신뢰 경계</title>
|
|
<desc id="d4">브라우저는 AP4_SESSION과 함께 client가 만든 identity header도 보낼 수 있지만 그 header는 Nginx에서 덮어써진다. Nginx는 oauth2-proxy의 internal auth endpoint에 subrequest를 보내 user와 email을 받고, 그 값과 자신이 가진 internal token으로 upstream 요청을 새로 만든다. oauth2-proxy와 Spring upstream은 host port가 닫혀 있어 외부에서 직접 닿을 수 없다.</desc>
|
|
|
|
<style>
|
|
.lbl { font: 13px system-ui, -apple-system, "Segoe UI", sans-serif; fill: #17181b; }
|
|
.sub { font: 11px system-ui, -apple-system, sans-serif; fill: #5b6068; }
|
|
.zone { font: 600 11px system-ui, -apple-system, sans-serif; letter-spacing: .06em; }
|
|
.box { fill: #fff; stroke: #b9bdc4; stroke-width: 1; }
|
|
.gone { fill: #fff; stroke: #b9bdc4; stroke-width: 1; stroke-dasharray: 4 3; }
|
|
.arw { stroke: #6b7079; stroke-width: 1.4; fill: none; marker-end: url(#h4); }
|
|
</style>
|
|
|
|
<defs>
|
|
<marker id="h4" viewBox="0 0 10 10" refX="9" refY="5" markerWidth="6" markerHeight="6" orient="auto-start-reverse">
|
|
<path d="M0,0 L10,5 L0,10 z" fill="#6b7079"/>
|
|
</marker>
|
|
<pattern id="x4" width="7" height="7" patternTransform="rotate(45)" patternUnits="userSpaceOnUse">
|
|
<line x1="0" y1="0" x2="0" y2="7" stroke="#c2695c" stroke-width="1" opacity=".28"/>
|
|
</pattern>
|
|
</defs>
|
|
|
|
<rect x="16" y="52" width="210" height="150" rx="7" fill="url(#x4)" stroke="#c2695c" stroke-width="1.5"/>
|
|
<text x="16" y="42" class="zone" fill="#a8483c">외부 · 신뢰하지 않는 입력</text>
|
|
|
|
<rect x="28" y="66" width="186" height="124" rx="5" class="box"/>
|
|
<text x="42" y="88" class="zone" fill="#5b6068">브라우저</text>
|
|
|
|
<rect x="42" y="100" width="158" height="38" rx="4" class="box"/>
|
|
<text x="54" y="118" class="lbl">AP4_SESSION</text>
|
|
<text x="54" y="132" class="sub">HttpOnly · Lax</text>
|
|
|
|
<rect x="42" y="144" width="158" height="38" rx="4" class="gone"/>
|
|
<text x="54" y="162" class="lbl">client 제공 header</text>
|
|
<text x="54" y="176" class="sub">덮어쓰기 대상</text>
|
|
|
|
<rect x="280" y="52" width="150" height="150" rx="5" class="box"/>
|
|
<text x="292" y="74" class="zone" fill="#5b6068">NGINX</text>
|
|
<text x="292" y="92" class="sub">8088 공개</text>
|
|
<text x="292" y="122" class="lbl">header 덮어쓰기</text>
|
|
<text x="292" y="140" class="sub">trusted proxy</text>
|
|
|
|
<rect x="490" y="40" width="316" height="210" rx="7" class="gone"/>
|
|
<text x="640" y="30" class="zone" fill="#5b6068">HOST PORT 닫힘</text>
|
|
|
|
<rect x="504" y="56" width="288" height="64" rx="5" class="box"/>
|
|
<text x="518" y="80" class="lbl">oauth2-proxy</text>
|
|
<text x="518" y="98" class="sub">internal /oauth2/auth</text>
|
|
|
|
<rect x="504" y="160" width="288" height="76" rx="5" class="box"/>
|
|
<text x="518" y="182" class="zone" fill="#5b6068">SPRING UPSTREAM</text>
|
|
<text x="518" y="204" class="lbl">/edge/me</text>
|
|
<text x="518" y="222" class="sub">user header + internal token</text>
|
|
|
|
<path class="arw" d="M228 122 H276"/>
|
|
|
|
<path class="arw" d="M432 80 H500"/>
|
|
<text x="436" y="72" class="sub">auth_request</text>
|
|
|
|
<path class="arw" d="M500 104 H434"/>
|
|
<text x="436" y="118" class="sub">user · email</text>
|
|
|
|
<path class="arw" d="M355 204 V262 H648 V240"/>
|
|
<text x="390" y="256" class="sub">nginx-owned header · internal token</text>
|
|
</svg>
|