feat(ap4): defend forwarded identity headers

2026-07-25 14:59:47 +09:00
parent 452aa4808a
commit 2d58dea5e1
11 changed files with 116 additions and 34 deletions
@@ -69,8 +69,9 @@ services:
      SERVER_PORT: "8081"
      SPRING_SECURITY_OAUTH2_RESOURCESERVER_JWT_ISSUER_URI: http://localhost:8080/realms/keycloak-patterns
      SPRING_SECURITY_OAUTH2_RESOURCESERVER_JWT_JWK_SET_URI: http://keycloak:8080/realms/keycloak-patterns/protocol/openid-connect/certs
-    ports:
-      - "127.0.0.1:8081:8081"
+      EDGE_INTERNAL_AUTH_TOKEN: ${INTERNAL_AUTH_TOKEN:?set INTERNAL_AUTH_TOKEN in .env}
+    expose:
+      - "8081"
    depends_on:
      keycloak:
        condition: service_healthy
@@ -141,6 +142,8 @@ services:
  nginx:
    build:
      context: ./frontend
+    environment:
+      INTERNAL_AUTH_TOKEN: ${INTERNAL_AUTH_TOKEN:?set INTERNAL_AUTH_TOKEN in .env}
    ports:
      - "127.0.0.1:${NGINX_PORT:-8088}:80"
    depends_on: