feat: 2홉 구성 진행

backend/src/test/java/com/example/keycloakpattern/ApiSecurityTest.java

@@ -25,6 +25,18 @@ class ApiSecurityTest {
             .andExpect(jsonPath("$.status").value("ok"));
     }
 
+    @Test
+    void echoEndpointReflectsForwardedHeadersWithoutAuthentication() throws Exception {
+        mockMvc.perform(get("/api/echo")
+                .header("X-Forwarded-Proto", "https")
+                .header("X-Forwarded-Host", "app1.example.test"))
+            .andExpect(status().isOk())
+            .andExpect(jsonPath("$.headers['x-forwarded-proto'][0]").value("https"))
+            .andExpect(jsonPath("$.headers['x-forwarded-host'][0]").value("app1.example.test"))
+            .andExpect(jsonPath("$.requestUrl").exists())
+            .andExpect(jsonPath("$.remoteAddr").exists());
+    }
+
     @Test
     void protectedEndpointRejectsAnonymousRequests() throws Exception {
         mockMvc.perform(get("/api/me"))