docs: C-2 — nothing propagates because nobody implemented the receiving end

Neither client had a backchannel logout URL and the BFF has no oidcLogout configuration, so the three candidate paths all answer 302, which is the authentication redirect rather than a handler. Setting the URL on the identity provider alone changed nothing: with a live session, logging the user out emptied the Keycloak side and left the Redis session untouched.

Reachability is not the blocker here, since a Keycloak pod fetches the app's public URL with a 200, but that is a property of this tailnet split-DNS lab and is the assumption most likely to fail in production, where it fails silently.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.playwright-mcp/page-2026-09-04T05-51-26-882Z.yml

@@ -0,0 +1 @@
+- generic [active] [ref=f50e1]: "{\"pattern\":\"AP3-backend-for-frontend\",\"principal\":\"labuser\",\"accessTokenStoredOnServer\":true,\"refreshTokenStoredOnServer\":true,\"browserTokenCount\":0,\"csrfProtectionEnabled\":true}"

.playwright-mcp/page-2026-09-04T05-52-09-485Z.yml

@@ -0,0 +1,16 @@
+- generic [ref=f51e3]:
+  - banner [ref=f51e4]:
+    - generic [ref=f51e5]: keycloak-patterns
+  - main [ref=f51e6]:
+    - heading "Sign in to your account" [level=1] [ref=f51e8]
+    - generic [ref=f51e12]:
+      - generic [ref=f51e13]:
+        - generic [ref=f51e14]: Username or email
+        - textbox "Username or email" [active] [ref=f51e17]
+      - generic [ref=f51e18]:
+        - generic [ref=f51e19]: Password
+        - generic [ref=f51e21]:
+          - textbox "Password" [ref=f51e24]
+          - button "Show password" [ref=f51e26] [cursor=pointer]:
+            - generic [aria-hidden] [ref=f51e27]: 
+      - button "Sign In" [ref=f51e30] [cursor=pointer]

.playwright-mcp/page-2026-09-04T05-52-19-135Z.yml

@@ -0,0 +1,7 @@
+- main [ref=f52e2]:
+  - heading "AP3 · Backend-for-Frontend" [level=1] [ref=f52e3]
+  - paragraph [ref=f52e4]: 브라우저에는 OAuth token이 전혀 전달되지 않습니다. HttpOnly session cookie로 BFF만 호출하고, BFF가 서버 보관 access token을 Resource Server 요청에 붙입니다.
+  - button "Keycloak 로그인" [ref=f52e5] [cursor=pointer]
+  - button "token 경계 확인" [ref=f52e6] [cursor=pointer]
+  - button "BFF 경유 API 호출" [ref=f52e7] [cursor=pointer]
+  - button "CSRF token으로 상태 변경" [ref=f52e8] [cursor=pointer]

.playwright-mcp/page-2026-09-04T05-54-31-795Z.yml

@@ -0,0 +1,16 @@
+- generic [ref=f53e3]:
+  - banner [ref=f53e4]:
+    - generic [ref=f53e5]: keycloak-patterns
+  - main [ref=f53e6]:
+    - heading "Sign in to your account" [level=1] [ref=f53e8]
+    - generic [ref=f53e12]:
+      - generic [ref=f53e13]:
+        - generic [ref=f53e14]: Username or email
+        - textbox "Username or email" [ref=f53e17]
+      - generic [ref=f53e18]:
+        - generic [ref=f53e19]: Password
+        - generic [ref=f53e21]:
+          - textbox "Password" [ref=f53e24]
+          - button "Show password" [ref=f53e26] [cursor=pointer]:
+            - generic [aria-hidden] [ref=f53e27]: 
+      - button "Sign In" [ref=f53e30] [cursor=pointer]

.playwright-mcp/page-2026-09-04T05-54-45-185Z.yml

@@ -0,0 +1,16 @@
+- generic [ref=f53e3]:
+  - banner [ref=f53e4]:
+    - generic [ref=f53e5]: keycloak-patterns
+  - main [ref=f53e6]:
+    - heading "Sign in to your account" [level=1] [ref=f53e8]
+    - generic [ref=f53e12]:
+      - generic [ref=f53e13]:
+        - generic [ref=f53e14]: Username or email
+        - textbox "Username or email" [ref=f53e17]: labuser
+      - generic [ref=f53e18]:
+        - generic [ref=f53e19]: Password
+        - generic [ref=f53e21]:
+          - textbox "Password" [active] [ref=f53e24]: labpass
+          - button "Show password" [ref=f53e26] [cursor=pointer]:
+            - generic [aria-hidden] [ref=f53e27]: 
+      - button "Sign In" [ref=f53e30] [cursor=pointer]

.playwright-mcp/page-2026-09-04T05-54-50-691Z.yml

@@ -0,0 +1,16 @@
+- generic [ref=f53e3]:
+  - banner [ref=f53e4]:
+    - generic [ref=f53e5]: keycloak-patterns
+  - main [ref=f53e6]:
+    - heading "Sign in to your account" [level=1] [ref=f53e8]
+    - generic [ref=f53e12]:
+      - generic [ref=f53e13]:
+        - generic [ref=f53e14]: Username or email
+        - textbox "Username or email" [ref=f53e17]: labuser
+      - generic [ref=f53e18]:
+        - generic [ref=f53e19]: Password
+        - generic [ref=f53e21]:
+          - textbox "Password" [active] [ref=f53e24]: labpass
+          - button "Show password" [ref=f53e26] [cursor=pointer]:
+            - generic [aria-hidden] [ref=f53e27]: 
+      - button "Sign In" [ref=f53e30] [cursor=pointer]

.playwright-mcp/page-2026-09-04T05-55-00-942Z.yml

@@ -0,0 +1,16 @@
+- generic [ref=f53e3]:
+  - banner [ref=f53e4]:
+    - generic [ref=f53e5]: keycloak-patterns
+  - main [ref=f53e6]:
+    - heading "Sign in to your account" [level=1] [ref=f53e8]
+    - generic [ref=f53e12]:
+      - generic [ref=f53e13]:
+        - generic [ref=f53e14]: Username or email
+        - textbox "Username or email" [ref=f53e17]: labuser
+      - generic [ref=f53e18]:
+        - generic [ref=f53e19]: Password
+        - generic [ref=f53e21]:
+          - textbox "Password" [active] [ref=f53e24]: labpass
+          - button "Show password" [ref=f53e26] [cursor=pointer]:
+            - generic [aria-hidden] [ref=f53e27]: 
+      - button "Sign In" [ref=f53e30] [cursor=pointer]

.playwright-mcp/page-2026-09-04T05-55-08-213Z.yml

@@ -0,0 +1,16 @@
+- generic [ref=f54e3]:
+  - banner [ref=f54e4]:
+    - generic [ref=f54e5]: keycloak-patterns
+  - main [ref=f54e6]:
+    - heading "Sign in to your account" [level=1] [ref=f54e8]
+    - generic [ref=f54e12]:
+      - generic [ref=f54e13]:
+        - generic [ref=f54e14]: Username or email
+        - textbox "Username or email" [ref=f54e17]
+      - generic [ref=f54e18]:
+        - generic [ref=f54e19]: Password
+        - generic [ref=f54e21]:
+          - textbox "Password" [ref=f54e24]
+          - button "Show password" [ref=f54e26] [cursor=pointer]:
+            - generic [aria-hidden] [ref=f54e27]: 
+      - button "Sign In" [ref=f54e30] [cursor=pointer]

.playwright-mcp/page-2026-09-04T05-55-18-791Z.yml

@@ -0,0 +1,16 @@
+- generic [ref=f54e3]:
+  - banner [ref=f54e4]:
+    - generic [ref=f54e5]: keycloak-patterns
+  - main [ref=f54e6]:
+    - heading "Sign in to your account" [level=1] [ref=f54e8]
+    - generic [ref=f54e12]:
+      - generic [ref=f54e13]:
+        - generic [ref=f54e14]: Username or email
+        - textbox "Username or email" [ref=f54e17]: labuser
+      - generic [ref=f54e18]:
+        - generic [ref=f54e19]: Password
+        - generic [ref=f54e21]:
+          - textbox "Password" [active] [ref=f54e24]: labpass
+          - button "Show password" [ref=f54e26] [cursor=pointer]:
+            - generic [aria-hidden] [ref=f54e27]: 
+      - button "Sign In" [ref=f54e30] [cursor=pointer]