feat: 2홉 구성 진행

backend/src/main/java/com/example/keycloakpattern/ApiController.java

@@ -1,6 +1,8 @@
 package com.example.keycloakpattern;
 
+import java.util.Collections;
 import java.util.LinkedHashMap;
+import java.util.List;
 import java.util.Map;
 
 import org.springframework.security.core.annotation.AuthenticationPrincipal;
@@ -9,6 +11,8 @@ import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RestController;
 
+import jakarta.servlet.http.HttpServletRequest;
+
 @RestController
 @RequestMapping("/api")
 public class ApiController {
@@ -18,6 +22,35 @@ public class ApiController {
         return Map.of("status", "ok", "service", "keycloak-pattern-api");
     }
 
+    /**
+     * Reflects what actually reached the application after the proxy chain.
+     *
+     * <p>The reverse proxy contract is defined in {@code docs/reverse-proxy-headers.md}
+     * for a single nginx hop. The lab runs {@code nginx -> Traefik -> pod}, so this
+     * endpoint exists to measure the two-hop result instead of assuming it.
+     *
+     * <p>{@code scheme}, {@code secure} and {@code requestUrl} are the values Keycloak
+     * uses to build the {@code iss} claim and redirect URLs. If forwarded headers are
+     * lost or rewritten, the mismatch shows up here first.
+     */
+    @GetMapping("/echo")
+    public Map<String, Object> echo(HttpServletRequest request) {
+        Map<String, List<String>> headers = new LinkedHashMap<>();
+        for (String name : Collections.list(request.getHeaderNames())) {
+            headers.put(name.toLowerCase(), Collections.list(request.getHeaders(name)));
+        }
+
+        Map<String, Object> response = new LinkedHashMap<>();
+        response.put("headers", headers);
+        response.put("remoteAddr", request.getRemoteAddr());
+        response.put("scheme", request.getScheme());
+        response.put("secure", request.isSecure());
+        response.put("serverName", request.getServerName());
+        response.put("serverPort", request.getServerPort());
+        response.put("requestUrl", request.getRequestURL().toString());
+        return response;
+    }
+
     @GetMapping("/me")
     public Map<String, Object> currentUser(@AuthenticationPrincipal Jwt jwt) {
         Map<String, Object> response = new LinkedHashMap<>();