59 lines
3.0 KiB
XML
59 lines
3.0 KiB
XML
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 820 280" role="img"
|
|
aria-labelledby="t d">
|
|
<title id="t">AP2 split custody 경계</title>
|
|
<desc id="d">Spring mediator가 authorized client에 access token과 refresh token을 함께 보관하지만, access token만 브라우저 실행 영역으로 돌아온다. 브라우저는 그 값으로 Authorization 헤더를 만들어 Resource Server를 직접 호출하며 이 경로는 mediator를 지나지 않는다. 브라우저 실행 영역 전체가 실행 중 XSS가 닿는 범위다.</desc>
|
|
|
|
<style>
|
|
.lbl { font: 13px system-ui, -apple-system, "Segoe UI", sans-serif; fill: #17181b; }
|
|
.sub { font: 11px system-ui, -apple-system, sans-serif; fill: #5b6068; }
|
|
.zone { font: 600 11px system-ui, -apple-system, sans-serif; letter-spacing: .06em; }
|
|
.box { fill: #fff; stroke: #b9bdc4; stroke-width: 1; }
|
|
.arw { stroke: #6b7079; stroke-width: 1.4; fill: none; marker-end: url(#h); }
|
|
</style>
|
|
|
|
<defs>
|
|
<marker id="h" viewBox="0 0 10 10" refX="9" refY="5" markerWidth="6" markerHeight="6" orient="auto-start-reverse">
|
|
<path d="M0,0 L10,5 L0,10 z" fill="#6b7079"/>
|
|
</marker>
|
|
<pattern id="x" width="7" height="7" patternTransform="rotate(45)" patternUnits="userSpaceOnUse">
|
|
<line x1="0" y1="0" x2="0" y2="7" stroke="#c2695c" stroke-width="1" opacity=".28"/>
|
|
</pattern>
|
|
</defs>
|
|
|
|
<!-- XSS reach: hatch + border, so it reads without colour -->
|
|
<rect x="16" y="52" width="296" height="170" rx="7" fill="url(#x)" stroke="#c2695c" stroke-width="1.5"/>
|
|
<text x="16" y="42" class="zone" fill="#a8483c">실행 중 XSS가 닿는 범위</text>
|
|
|
|
<rect x="28" y="66" width="272" height="142" rx="5" class="box"/>
|
|
<text x="42" y="88" class="zone" fill="#5b6068">브라우저</text>
|
|
|
|
<rect x="42" y="100" width="244" height="44" rx="4" class="box"/>
|
|
<text x="56" y="120" class="lbl">AP2_SESSION</text>
|
|
<text x="56" y="136" class="sub">HttpOnly · SameSite=Lax</text>
|
|
|
|
<rect x="42" y="152" width="244" height="44" rx="4" class="box"/>
|
|
<text x="56" y="172" class="lbl">access token</text>
|
|
<text x="56" y="188" class="sub">JavaScript 지역 변수</text>
|
|
|
|
<rect x="392" y="52" width="224" height="156" rx="5" class="box"/>
|
|
<text x="404" y="74" class="zone" fill="#5b6068">SPRING MEDIATOR</text>
|
|
<text x="404" y="92" class="sub">confidential · client_secret_basic</text>
|
|
|
|
<rect x="404" y="106" width="200" height="44" rx="4" class="box"/>
|
|
<text x="416" y="126" class="lbl">authorized client</text>
|
|
<text x="416" y="142" class="sub">access · refresh</text>
|
|
|
|
<rect x="656" y="100" width="152" height="96" rx="5" class="box"/>
|
|
<text x="668" y="122" class="zone" fill="#5b6068">RESOURCE SERVER</text>
|
|
<text x="668" y="148" class="lbl">검증</text>
|
|
<text x="668" y="166" class="sub">서명 · issuer · audience</text>
|
|
|
|
<path class="arw" d="M314 122 H388"/>
|
|
<text x="316" y="114" class="sub">/token/access</text>
|
|
|
|
<path class="arw" d="M388 174 H316"/>
|
|
|
|
<path class="arw" d="M160 224 V258 H732 V200"/>
|
|
<text x="380" y="252" class="sub">Authorization: Bearer</text>
|
|
</svg>
|