63 lines
3.3 KiB
XML
63 lines
3.3 KiB
XML
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 800 285" role="img"
|
|
aria-labelledby="t d">
|
|
<title id="t">AP3 BFF custody 경계</title>
|
|
<desc id="d">브라우저에는 HttpOnly AP3_SESSION과 JavaScript가 읽을 수 있는 XSRF-TOKEN만 있고 OAuth token은 없다. BFF가 authorized client에서 access token과 refresh token을 들고 있으며, Resource Server로 가는 Bearer 요청은 BFF에서 새로 만들어진다. 브라우저의 session cookie는 downstream으로 전달되지 않는다. 브라우저 실행 영역 전체가 실행 중 XSS가 닿는 범위다.</desc>
|
|
|
|
<style>
|
|
.lbl { font: 13px system-ui, -apple-system, "Segoe UI", sans-serif; fill: #17181b; }
|
|
.sub { font: 11px system-ui, -apple-system, sans-serif; fill: #5b6068; }
|
|
.zone { font: 600 11px system-ui, -apple-system, sans-serif; letter-spacing: .06em; }
|
|
.box { fill: #fff; stroke: #b9bdc4; stroke-width: 1; }
|
|
.gone { fill: #fff; stroke: #b9bdc4; stroke-width: 1; stroke-dasharray: 4 3; }
|
|
.arw { stroke: #6b7079; stroke-width: 1.4; fill: none; marker-end: url(#h); }
|
|
</style>
|
|
|
|
<defs>
|
|
<marker id="h" viewBox="0 0 10 10" refX="9" refY="5" markerWidth="6" markerHeight="6" orient="auto-start-reverse">
|
|
<path d="M0,0 L10,5 L0,10 z" fill="#6b7079"/>
|
|
</marker>
|
|
<pattern id="x" width="7" height="7" patternTransform="rotate(45)" patternUnits="userSpaceOnUse">
|
|
<line x1="0" y1="0" x2="0" y2="7" stroke="#c2695c" stroke-width="1" opacity=".28"/>
|
|
</pattern>
|
|
</defs>
|
|
|
|
<rect x="16" y="52" width="270" height="190" rx="7" fill="url(#x)" stroke="#c2695c" stroke-width="1.5"/>
|
|
<text x="16" y="42" class="zone" fill="#a8483c">실행 중 XSS가 닿는 범위</text>
|
|
|
|
<rect x="28" y="66" width="246" height="164" rx="5" class="box"/>
|
|
<text x="42" y="88" class="zone" fill="#5b6068">브라우저</text>
|
|
|
|
<rect x="42" y="100" width="218" height="42" rx="4" class="box"/>
|
|
<text x="56" y="119" class="lbl">AP3_SESSION</text>
|
|
<text x="56" y="134" class="sub">HttpOnly · JavaScript 읽기 x</text>
|
|
|
|
<rect x="42" y="150" width="218" height="42" rx="4" class="box"/>
|
|
<text x="56" y="169" class="lbl">XSRF-TOKEN</text>
|
|
<text x="56" y="184" class="sub">JavaScript 읽기 o</text>
|
|
|
|
<rect x="42" y="198" width="218" height="26" rx="4" class="gone"/>
|
|
<text x="56" y="215" class="lbl">OAuth token</text>
|
|
<text x="240" y="215" class="lbl">x</text>
|
|
|
|
<rect x="350" y="52" width="230" height="170" rx="5" class="box"/>
|
|
<text x="362" y="74" class="zone" fill="#5b6068">BFF</text>
|
|
<text x="362" y="92" class="sub">confidential · client_secret_basic</text>
|
|
|
|
<rect x="362" y="106" width="206" height="42" rx="4" class="box"/>
|
|
<text x="374" y="125" class="lbl">authorized client</text>
|
|
<text x="374" y="140" class="sub">access · refresh</text>
|
|
|
|
<rect x="636" y="100" width="150" height="90" rx="5" class="box"/>
|
|
<text x="648" y="122" class="zone" fill="#5b6068">RESOURCE SERVER</text>
|
|
<text x="648" y="148" class="lbl">검증</text>
|
|
<text x="648" y="166" class="sub">서명 · issuer · audience</text>
|
|
|
|
<path class="arw" d="M288 122 H346"/>
|
|
<text x="290" y="114" class="sub">/bff/api/me</text>
|
|
|
|
<path class="arw" d="M346 174 H290"/>
|
|
|
|
<path class="arw" d="M465 224 V260 H711 V194"/>
|
|
<text x="500" y="254" class="sub">Authorization: Bearer</text>
|
|
</svg>
|