docs: record the staged fix and post-fix evidence

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-03 15:33:40 +09:00
parent 1c1b86e849
commit 7737787937
6 changed files with 303 additions and 24 deletions
@@ -0,0 +1,55 @@
+수집 시각: 2026-09-03 15:32:04 KST
+단계: A(nginx) + B(Traefik) + C(앱) 모두 적용 후
+
+=== [1] nginx 가 보내는 값 ===
+28:		proxy_set_header X-Forwarded-Proto	https;
+29:		proxy_set_header X-Forwarded-Port	443;
+30:		proxy_set_header X-Forwarded-For	$remote_addr;
+31:		proxy_set_header X-Real-IP		$remote_addr;
+
+=== [2] Traefik entryPoint 인자 ===
+"--entryPoints.web.forwardedHeaders.trustedIPs=10.42.0.0/16
+"--entryPoints.websecure.forwardedHeaders.trustedIPs=10.42.0.0/16
+
+=== [3] 앱 스위치 ===
+SERVER_FORWARD_HEADERS_STRATEGY=native
+
+=== [4] 최종 측정 ===
+  x-forwarded-proto    https
+  x-forwarded-port     443
+  x-forwarded-host     app1.hyeonworks.com
+  x-real-ip            100.123.124.30
+  x-forwarded-server   traefik-697889c85-g7xpp
+  --- 앱이 해석한 값        
+  scheme               https
+  secure               True
+  serverName           app1.hyeonworks.com
+  serverPort           443
+  remoteAddr           100.123.124.30
+  localAddr            10.42.0.10
+  requestUrl           https://app1.hyeonworks.com/api/echo
+
+=== [5] 위조 테스트 — 클라이언트가 http/evil/1.2.3.4 를 주입 ===
+  x-forwarded-proto    https
+  x-forwarded-port     443
+  x-forwarded-host     app1.hyeonworks.com
+  x-real-ip            100.123.124.30
+  x-forwarded-server   traefik-697889c85-g7xpp
+  --- 앱이 해석한 값        
+  scheme               https
+  secure               True
+  serverName           app1.hyeonworks.com
+  serverPort           443
+  remoteAddr           100.123.124.30
+  localAddr            10.42.1.6
+  requestUrl           https://app1.hyeonworks.com/api/echo
+
+  ★ 주입값이 하나도 반영되지 않았다. nginx 의 $remote_addr 덮어쓰기가 방어한다.
+
+=== [6] 파드 분배 6회 ===
+  pod 10.42.0.10 | remoteAddr 100.123.124.30 | scheme https
+  pod 10.42.1.6 | remoteAddr 100.123.124.30 | scheme https
+  pod 10.42.0.10 | remoteAddr 100.123.124.30 | scheme https
+  pod 10.42.1.6 | remoteAddr 100.123.124.30 | scheme https
+  pod 10.42.0.10 | remoteAddr 100.123.124.30 | scheme https
+  pod 10.42.1.6 | remoteAddr 100.123.124.30 | scheme https