22 lines
653 B
Plaintext
22 lines
653 B
Plaintext
# AP4 proxy session에서 trusted identity JSON까지
|
|
# Question: AP4에서 AP4_SESSION은 어떤 순서로 검증되고 allowlisted identity header와 internal token을 거쳐 JSON이 되는가?
|
|
direction: right
|
|
n0: "브라우저" {
|
|
shape: rectangle
|
|
}
|
|
n1: "Nginx edge" {
|
|
shape: rectangle
|
|
}
|
|
n2: "oauth2-proxy" {
|
|
shape: rectangle
|
|
}
|
|
n3: "Spring upstream" {
|
|
shape: rectangle
|
|
}
|
|
n0 -> n1: "GET /api/edge + AP4_SESSION"
|
|
n1 -> n2: "internal /oauth2/auth subrequest"
|
|
n2 -> n1: "authenticated user + email"
|
|
n1 -> n3: "GET /edge/me · trusted headers + internal token"
|
|
n3 -> n1: "trusted identity JSON"
|
|
n1 -> n0: "pattern + user + email + identityHeader"
|