merge: Traefik ForwardAuth alternative

# Conflicts:
#	.env.example

.env.example

@@ -10,6 +10,8 @@ POSTGRES_PASSWORD=change-me-postgres-password
 TOKEN_MEDIATING_CLIENT_SECRET=change-me-token-mediating-client-secret
 BFF_CLIENT_SECRET=change-me-bff-client-secret
 EDGE_PROXY_CLIENT_SECRET=change-me-edge-proxy-client-secret
+OAUTH2_PROXY_COOKIE_SECRET=generate-a-base64-encoded-32-byte-secret
+INTERNAL_AUTH_TOKEN=generate-a-long-random-edge-to-backend-token
 MOCK_GOOGLE_BROKER_CLIENT_SECRET=change-me-mock-google-broker-client-secret
 ADMIN_USER_PASSWORD=change-me-admin-user-password
 REGULAR_USER_PASSWORD=change-me-regular-user-password

.gitignore

@@ -4,7 +4,6 @@
 *.iml
 
 backend/target/
-bff/target/
 **/node_modules/
 frontend/dist/
 build/

README.md

@@ -104,18 +104,21 @@ Keycloak을 잠시 중지하고 export한 뒤 자동으로 다시 올립니다.
 runtime export에는 실제 client secret과 credential hash가 포함될 수 있어
 gitignored `build/keycloak-export/`에 권한 `0600`으로만 저장됩니다.
 
-## AP3: Backend-for-Frontend
+## AP4: oauth2-proxy Edge Forward Auth
 
-`develop-keycloak-pattern3`의 Spring BFF는 `http://localhost:8083`에서
+`develop-keycloak-pattern4`는 oauth2-proxy와 Nginx `auth_request`가
-실행됩니다. 브라우저에는 HttpOnly session cookie만 두고 access/refresh
+인증을 edge에서 강제하는 패턴입니다.
-token은 BFF가 서버에 보관합니다. `/bff/api/me`는 BFF가 보유 access
-token을 붙여 Resource Server로 proxy합니다.
 
 ```bash
-./scripts/verify-pattern3.sh
+./scripts/verify-pattern4.sh
 ```
 
-자세한 경계와 session 저장소 trade-off는
+첫 feature에서는 oauth2-proxy를 `http://localhost:4180`에 직접 노출해
-[`docs/ap3-bff-boundary.md`](docs/ap3-bff-boundary.md)를 참고하세요.
+OIDC redirect/PKCE/callback과 forwarded-user를 분리 확인합니다. 두 번째
-최종 AP3 branch는 `AP3_SESSION; HttpOnly; SameSite=Lax`와 Spring CSRF
+feature부터 `http://localhost:8088` Nginx가 단일 진입점이며, 내부
-token을 함께 사용하며, token 없는 상태 변경 요청은 403으로 거부합니다.
+`auth_request`는 브라우저 요청을 login 302로, API 요청을 JSON 401로
+구분합니다. 최종 feature에서는 backend와 oauth2-proxy의 호스트 노출을
+제거하고 Nginx 헤더 덮어쓰기와 내부 토큰 검증으로 spoofing을 막습니다.
+자세한 내용은
+[`docs/ap4-edge-forward-auth.md`](docs/ap4-edge-forward-auth.md)를
+참고하세요.

backend/src/main/java/com/example/keycloakpattern/AudienceValidator.java

@@ -1,29 +0,0 @@
-package com.example.keycloakpattern;
-
-import org.springframework.security.oauth2.core.OAuth2Error;
-import org.springframework.security.oauth2.core.OAuth2TokenValidator;
-import org.springframework.security.oauth2.core.OAuth2TokenValidatorResult;
-import org.springframework.security.oauth2.jwt.Jwt;
-
-final class AudienceValidator implements OAuth2TokenValidator<Jwt> {
-
-    private static final OAuth2Error MISSING_AUDIENCE = new OAuth2Error(
-        "invalid_token",
-        "The required resource audience is missing",
-        null
-    );
-
-    private final String expectedAudience;
-
-    AudienceValidator(String expectedAudience) {
-        this.expectedAudience = expectedAudience;
-    }
-
-    @Override
-    public OAuth2TokenValidatorResult validate(Jwt jwt) {
-        if (jwt.getAudience().contains(expectedAudience)) {
-            return OAuth2TokenValidatorResult.success();
-        }
-        return OAuth2TokenValidatorResult.failure(MISSING_AUDIENCE);
-    }
-}

backend/src/main/java/com/example/keycloakpattern/EdgeIdentityController.java

@@ -0,0 +1,59 @@
+package com.example.keycloakpattern;
+
+import java.nio.charset.StandardCharsets;
+import java.security.MessageDigest;
+import java.util.LinkedHashMap;
+import java.util.Map;
+
+import jakarta.servlet.http.HttpServletRequest;
+
+import org.springframework.http.ResponseEntity;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+@RestController
+public class EdgeIdentityController {
+
+    private final byte[] internalAuthToken;
+
+    EdgeIdentityController(@Value("${edge.internal-auth-token}") String internalAuthToken) {
+        if (!hasText(internalAuthToken)) {
+            throw new IllegalStateException("edge.internal-auth-token must be configured");
+        }
+        this.internalAuthToken = internalAuthToken.getBytes(StandardCharsets.UTF_8);
+    }
+
+    @GetMapping("/edge/me")
+    ResponseEntity<Map<String, Object>> currentUser(HttpServletRequest request) {
+        String authRequestUser = request.getHeader("X-Auth-Request-User");
+        if (!hasText(authRequestUser) || !hasValidInternalToken(request)) {
+            return ResponseEntity.status(401).body(Map.of(
+                "error",
+                "trusted edge authentication is required"
+            ));
+        }
+
+        Map<String, Object> response = new LinkedHashMap<>();
+        response.put("pattern", "AP4-edge-forward-auth");
+        response.put("user", authRequestUser);
+        response.put("email", request.getHeader("X-Auth-Request-Email"));
+        response.put("identityHeader", "X-Auth-Request-User");
+        return ResponseEntity.ok(response);
+    }
+
+    private boolean hasValidInternalToken(HttpServletRequest request) {
+        String suppliedToken = request.getHeader("X-Internal-Auth-Token");
+        if (!hasText(suppliedToken)) {
+            return false;
+        }
+        return MessageDigest.isEqual(
+            internalAuthToken,
+            suppliedToken.getBytes(StandardCharsets.UTF_8)
+        );
+    }
+
+    private static boolean hasText(String value) {
+        return value != null && !value.isBlank();
+    }
+}

backend/src/main/java/com/example/keycloakpattern/JwtDecoderConfig.java

@@ -1,31 +0,0 @@
-package com.example.keycloakpattern;
-
-import org.springframework.beans.factory.annotation.Value;
-import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Configuration;
-import org.springframework.security.oauth2.core.DelegatingOAuth2TokenValidator;
-import org.springframework.security.oauth2.core.OAuth2TokenValidator;
-import org.springframework.security.oauth2.jwt.Jwt;
-import org.springframework.security.oauth2.jwt.JwtDecoder;
-import org.springframework.security.oauth2.jwt.JwtValidators;
-import org.springframework.security.oauth2.jwt.NimbusJwtDecoder;
-
-@Configuration
-public class JwtDecoderConfig {
-
-    @Bean
-    JwtDecoder jwtDecoder(
-        @Value("${spring.security.oauth2.resourceserver.jwt.issuer-uri}") String issuer,
-        @Value("${spring.security.oauth2.resourceserver.jwt.jwk-set-uri}") String jwkSetUri,
-        @Value("${security.expected-audience}") String expectedAudience
-    ) {
-        NimbusJwtDecoder decoder = NimbusJwtDecoder.withJwkSetUri(jwkSetUri).build();
-        OAuth2TokenValidator<Jwt> issuerAndTimestamp =
-            JwtValidators.createDefaultWithIssuer(issuer);
-        OAuth2TokenValidator<Jwt> audience = new AudienceValidator(expectedAudience);
-        decoder.setJwtValidator(
-            new DelegatingOAuth2TokenValidator<>(issuerAndTimestamp, audience)
-        );
-        return decoder;
-    }
-}

backend/src/main/java/com/example/keycloakpattern/SecurityConfig.java

@@ -17,7 +17,12 @@ public class SecurityConfig {
             .sessionManagement(session ->
                 session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
             .authorizeHttpRequests(authorize -> authorize
-                .requestMatchers("/actuator/health", "/actuator/health/**", "/api/public")
+                .requestMatchers(
+                    "/actuator/health",
+                    "/actuator/health/**",
+                    "/api/public",
+                    "/edge/**"
+                )
                 .permitAll()
                 .anyRequest()
                 .authenticated())

backend/src/main/resources/application.yml

@@ -1,6 +1,9 @@
 server:
   port: ${SERVER_PORT:8081}
 
+edge:
+  internal-auth-token: ${EDGE_INTERNAL_AUTH_TOKEN:}
+
 spring:
   application:
     name: keycloak-pattern-api
@@ -11,9 +14,6 @@ spring:
           issuer-uri: ${SPRING_SECURITY_OAUTH2_RESOURCESERVER_JWT_ISSUER_URI:http://localhost:8080/realms/keycloak-patterns}
           jwk-set-uri: ${SPRING_SECURITY_OAUTH2_RESOURCESERVER_JWT_JWK_SET_URI:http://localhost:8080/realms/keycloak-patterns/protocol/openid-connect/certs}
 
-security:
-  expected-audience: ${SECURITY_EXPECTED_AUDIENCE:keycloak-pattern-api}
-
 management:
   endpoint:
     health:

backend/src/test/java/com/example/keycloakpattern/ApiSecurityTest.java

@@ -11,7 +11,7 @@ import org.springframework.boot.test.autoconfigure.web.servlet.AutoConfigureMock
 import org.springframework.boot.test.context.SpringBootTest;
 import org.springframework.test.web.servlet.MockMvc;
 
-@SpringBootTest
+@SpringBootTest(properties = "edge.internal-auth-token=test-internal-edge-token")
 @AutoConfigureMockMvc
 class ApiSecurityTest {
 
@@ -40,4 +40,36 @@ class ApiSecurityTest {
             .andExpect(jsonPath("$.subject").value("test-subject"))
             .andExpect(jsonPath("$.username").value("regular-user"));
     }
+
+    @Test
+    void edgeEndpointRejectsMissingTrustedHeaders() throws Exception {
+        mockMvc.perform(get("/edge/me"))
+            .andExpect(status().isUnauthorized());
+    }
+
+    @Test
+    void edgeEndpointRejectsForgedIdentityWithoutInternalToken() throws Exception {
+        mockMvc.perform(get("/edge/me")
+                .header("X-Auth-Request-User", "spoofed-admin"))
+            .andExpect(status().isUnauthorized());
+    }
+
+    @Test
+    void edgeEndpointRejectsWrongInternalToken() throws Exception {
+        mockMvc.perform(get("/edge/me")
+                .header("X-Auth-Request-User", "spoofed-admin")
+                .header("X-Internal-Auth-Token", "wrong-token"))
+            .andExpect(status().isUnauthorized());
+    }
+
+    @Test
+    void edgeEndpointAcceptsIdentityFromTrustedEdge() throws Exception {
+        mockMvc.perform(get("/edge/me")
+                .header("X-Auth-Request-User", "regular-user")
+                .header("X-Auth-Request-Email", "regular-user@example.test")
+                .header("X-Internal-Auth-Token", "test-internal-edge-token"))
+            .andExpect(status().isOk())
+            .andExpect(jsonPath("$.user").value("regular-user"))
+            .andExpect(jsonPath("$.identityHeader").value("X-Auth-Request-User"));
+    }
 }

backend/src/test/java/com/example/keycloakpattern/AudienceValidatorTest.java

@@ -1,49 +0,0 @@
-package com.example.keycloakpattern;
-
-import static org.assertj.core.api.Assertions.assertThat;
-
-import java.time.Instant;
-import java.util.List;
-import java.util.Map;
-
-import org.junit.jupiter.api.Test;
-import org.springframework.security.oauth2.core.OAuth2TokenValidatorResult;
-import org.springframework.security.oauth2.jwt.Jwt;
-
-class AudienceValidatorTest {
-
-    private final AudienceValidator validator =
-        new AudienceValidator("keycloak-pattern-api");
-
-    @Test
-    void acceptsRequiredAudience() {
-        OAuth2TokenValidatorResult result = validator.validate(jwtWithAudience(
-            List.of("account", "keycloak-pattern-api")
-        ));
-
-        assertThat(result.hasErrors()).isFalse();
-    }
-
-    @Test
-    void rejectsForeignAudience() {
-        OAuth2TokenValidatorResult result = validator.validate(jwtWithAudience(
-            List.of("another-resource")
-        ));
-
-        assertThat(result.hasErrors()).isTrue();
-        assertThat(result.getErrors())
-            .extracting(error -> error.getErrorCode())
-            .containsExactly("invalid_token");
-    }
-
-    private Jwt jwtWithAudience(List<String> audience) {
-        Instant now = Instant.now();
-        return new Jwt(
-            "test-token",
-            now,
-            now.plusSeconds(300),
-            Map.of("alg", "none"),
-            Map.of("sub", "test-subject", "aud", audience)
-        );
-    }
-}

bff/.dockerignore

@@ -1 +0,0 @@
-target/

bff/Dockerfile

@@ -1,14 +0,0 @@
-FROM maven:3.9.11-eclipse-temurin-21-alpine AS build
-WORKDIR /workspace
-COPY pom.xml .
-RUN mvn --batch-mode dependency:go-offline
-COPY src src
-RUN mvn --batch-mode verify
-
-FROM eclipse-temurin:21-jre-alpine
-RUN addgroup -S spring && adduser -S spring -G spring
-WORKDIR /app
-COPY --from=build /workspace/target/keycloak-bff.jar app.jar
-USER spring:spring
-EXPOSE 8083
-ENTRYPOINT ["java", "-jar", "/app/app.jar"]

bff/pom.xml

@@ -1,58 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<project xmlns="http://maven.apache.org/POM/4.0.0"
-         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
-    <modelVersion>4.0.0</modelVersion>
-
-    <parent>
-        <groupId>org.springframework.boot</groupId>
-        <artifactId>spring-boot-starter-parent</artifactId>
-        <version>3.5.16</version>
-        <relativePath/>
-    </parent>
-
-    <groupId>com.example</groupId>
-    <artifactId>keycloak-bff</artifactId>
-    <version>0.0.1-SNAPSHOT</version>
-    <name>keycloak-bff</name>
-
-    <properties>
-        <java.version>21</java.version>
-    </properties>
-
-    <dependencies>
-        <dependency>
-            <groupId>org.springframework.boot</groupId>
-            <artifactId>spring-boot-starter-actuator</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>org.springframework.boot</groupId>
-            <artifactId>spring-boot-starter-oauth2-client</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>org.springframework.boot</groupId>
-            <artifactId>spring-boot-starter-web</artifactId>
-        </dependency>
-
-        <dependency>
-            <groupId>org.springframework.boot</groupId>
-            <artifactId>spring-boot-starter-test</artifactId>
-            <scope>test</scope>
-        </dependency>
-        <dependency>
-            <groupId>org.springframework.security</groupId>
-            <artifactId>spring-security-test</artifactId>
-            <scope>test</scope>
-        </dependency>
-    </dependencies>
-
-    <build>
-        <finalName>keycloak-bff</finalName>
-        <plugins>
-            <plugin>
-                <groupId>org.springframework.boot</groupId>
-                <artifactId>spring-boot-maven-plugin</artifactId>
-            </plugin>
-        </plugins>
-    </build>
-</project>

bff/src/main/java/com/example/keycloakpattern/bff/BffApplication.java

@@ -1,12 +0,0 @@
-package com.example.keycloakpattern.bff;
-
-import org.springframework.boot.SpringApplication;
-import org.springframework.boot.autoconfigure.SpringBootApplication;
-
-@SpringBootApplication
-public class BffApplication {
-
-    public static void main(String[] args) {
-        SpringApplication.run(BffApplication.class, args);
-    }
-}

bff/src/main/java/com/example/keycloakpattern/bff/BffController.java

@@ -1,112 +0,0 @@
-package com.example.keycloakpattern.bff;
-
-import java.util.LinkedHashMap;
-import java.util.Map;
-import java.util.concurrent.atomic.AtomicReference;
-
-import org.springframework.beans.factory.annotation.Value;
-import org.springframework.http.CacheControl;
-import org.springframework.http.HttpHeaders;
-import org.springframework.http.ResponseEntity;
-import org.springframework.security.core.Authentication;
-import org.springframework.security.oauth2.client.OAuth2AuthorizeRequest;
-import org.springframework.security.oauth2.client.OAuth2AuthorizedClient;
-import org.springframework.security.oauth2.client.OAuth2AuthorizedClientManager;
-import org.springframework.security.oauth2.client.OAuth2AuthorizedClientService;
-import org.springframework.web.bind.annotation.GetMapping;
-import org.springframework.web.bind.annotation.PostMapping;
-import org.springframework.web.bind.annotation.RequestParam;
-import org.springframework.web.bind.annotation.RestController;
-import org.springframework.web.client.RestClient;
-import org.springframework.web.server.ResponseStatusException;
-
-import static org.springframework.http.HttpStatus.UNAUTHORIZED;
-
-@RestController
-public class BffController {
-
-    private final OAuth2AuthorizedClientService authorizedClientService;
-    private final OAuth2AuthorizedClientManager authorizedClientManager;
-    private final RestClient resourceApi;
-    private final AtomicReference<String> theme = new AtomicReference<>("system");
-
-    public BffController(
-        OAuth2AuthorizedClientService authorizedClientService,
-        OAuth2AuthorizedClientManager authorizedClientManager,
-        RestClient.Builder restClientBuilder,
-        @Value("${resource-api.base-url}") String resourceApiBaseUrl
-    ) {
-        this.authorizedClientService = authorizedClientService;
-        this.authorizedClientManager = authorizedClientManager;
-        this.resourceApi = restClientBuilder.baseUrl(resourceApiBaseUrl).build();
-    }
-
-    @GetMapping("/bff/token-boundary")
-    ResponseEntity<Map<String, Object>> tokenBoundary(Authentication authentication) {
-        OAuth2AuthorizedClient client = authorizedClientService.loadAuthorizedClient(
-            "keycloak",
-            authentication.getName()
-        );
-
-        Map<String, Object> response = new LinkedHashMap<>();
-        response.put("pattern", "AP3-backend-for-frontend");
-        response.put("principal", authentication.getName());
-        response.put("accessTokenStoredOnServer", client != null
-            && client.getAccessToken() != null);
-        response.put("refreshTokenStoredOnServer", client != null
-            && client.getRefreshToken() != null);
-        response.put("browserTokenCount", 0);
-        response.put("csrfProtectionEnabled", true);
-
-        return ResponseEntity.ok()
-            .cacheControl(CacheControl.noStore())
-            .header("Pragma", "no-cache")
-            .body(response);
-    }
-
-    @GetMapping("/bff/api/me")
-    ResponseEntity<?> currentUser(Authentication authentication) {
-        OAuth2AuthorizedClient client = authorizedClient(authentication);
-        return resourceApi.get()
-            .uri("/api/me")
-            .header(
-                HttpHeaders.AUTHORIZATION,
-                "Bearer " + client.getAccessToken().getTokenValue()
-            )
-            .retrieve()
-            .toEntity(Map.class);
-    }
-
-    @PostMapping("/bff/api/preferences")
-    Map<String, Object> updatePreference(
-        Authentication authentication,
-        @RequestParam(defaultValue = "system") String theme
-    ) {
-        this.theme.set(theme);
-        return Map.of(
-            "updated", true,
-            "theme", this.theme.get(),
-            "principal", authentication.getName()
-        );
-    }
-
-    @GetMapping("/bff/api/preferences")
-    Map<String, String> preference() {
-        return Map.of("theme", theme.get());
-    }
-
-    private OAuth2AuthorizedClient authorizedClient(Authentication authentication) {
-        OAuth2AuthorizeRequest request = OAuth2AuthorizeRequest
-            .withClientRegistrationId("keycloak")
-            .principal(authentication)
-            .build();
-        OAuth2AuthorizedClient client = authorizedClientManager.authorize(request);
-        if (client == null || client.getAccessToken() == null) {
-            throw new ResponseStatusException(
-                UNAUTHORIZED,
-                "No authorized Keycloak client is available"
-            );
-        }
-        return client;
-    }
-}

bff/src/main/java/com/example/keycloakpattern/bff/CsrfController.java

@@ -1,25 +0,0 @@
-package com.example.keycloakpattern.bff;
-
-import java.util.Map;
-
-import org.springframework.http.CacheControl;
-import org.springframework.http.ResponseEntity;
-import org.springframework.security.web.csrf.CsrfToken;
-import org.springframework.web.bind.annotation.GetMapping;
-import org.springframework.web.bind.annotation.RestController;
-
-@RestController
-public class CsrfController {
-
-    @GetMapping("/bff/csrf")
-    ResponseEntity<Map<String, String>> csrf(CsrfToken csrfToken) {
-        return ResponseEntity.ok()
-            .cacheControl(CacheControl.noStore())
-            .header("Pragma", "no-cache")
-            .body(Map.of(
-                "headerName", csrfToken.getHeaderName(),
-                "parameterName", csrfToken.getParameterName(),
-                "token", csrfToken.getToken()
-            ));
-    }
-}

bff/src/main/java/com/example/keycloakpattern/bff/SecurityConfig.java

@@ -1,80 +0,0 @@
-package com.example.keycloakpattern.bff;
-
-import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Configuration;
-import org.springframework.security.config.annotation.web.builders.HttpSecurity;
-import org.springframework.security.oauth2.client.AuthorizedClientServiceOAuth2AuthorizedClientManager;
-import org.springframework.security.oauth2.client.OAuth2AuthorizedClientManager;
-import org.springframework.security.oauth2.client.OAuth2AuthorizedClientProvider;
-import org.springframework.security.oauth2.client.OAuth2AuthorizedClientProviderBuilder;
-import org.springframework.security.oauth2.client.OAuth2AuthorizedClientService;
-import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository;
-import org.springframework.security.oauth2.client.web.DefaultOAuth2AuthorizationRequestResolver;
-import org.springframework.security.oauth2.client.web.OAuth2AuthorizationRequestCustomizers;
-import org.springframework.security.web.SecurityFilterChain;
-import org.springframework.security.web.csrf.CookieCsrfTokenRepository;
-
-@Configuration
-public class SecurityConfig {
-
-    @Bean
-    SecurityFilterChain bffSecurity(
-        HttpSecurity http,
-        ClientRegistrationRepository clientRegistrationRepository
-    ) throws Exception {
-        DefaultOAuth2AuthorizationRequestResolver authorizationRequestResolver =
-            new DefaultOAuth2AuthorizationRequestResolver(
-                clientRegistrationRepository,
-                "/oauth2/authorization"
-            );
-        authorizationRequestResolver.setAuthorizationRequestCustomizer(
-            OAuth2AuthorizationRequestCustomizers.withPkce()
-        );
-
-        CookieCsrfTokenRepository csrfTokenRepository =
-            CookieCsrfTokenRepository.withHttpOnlyFalse();
-        csrfTokenRepository.setCookiePath("/");
-
-        return http
-            .csrf(csrf -> csrf
-                .csrfTokenRepository(csrfTokenRepository)
-                .csrfTokenRequestHandler(new SpaCsrfTokenRequestHandler()))
-            .authorizeHttpRequests(authorize -> authorize
-                .requestMatchers(
-                    "/",
-                    "/index.html",
-                    "/app.js",
-                    "/favicon.ico",
-                    "/actuator/health",
-                    "/actuator/health/**"
-                )
-                .permitAll()
-                .anyRequest()
-                .authenticated())
-            .oauth2Login(oauth2 -> oauth2
-                .authorizationEndpoint(endpoint -> endpoint
-                    .authorizationRequestResolver(authorizationRequestResolver))
-                .defaultSuccessUrl("/", true))
-            .build();
-    }
-
-    @Bean
-    OAuth2AuthorizedClientManager authorizedClientManager(
-        ClientRegistrationRepository clientRegistrationRepository,
-        OAuth2AuthorizedClientService authorizedClientService
-    ) {
-        OAuth2AuthorizedClientProvider authorizedClientProvider =
-            OAuth2AuthorizedClientProviderBuilder.builder()
-                .authorizationCode()
-                .refreshToken()
-                .build();
-
-        AuthorizedClientServiceOAuth2AuthorizedClientManager manager =
-            new AuthorizedClientServiceOAuth2AuthorizedClientManager(
-                clientRegistrationRepository,
-                authorizedClientService
-            );
-        manager.setAuthorizedClientProvider(authorizedClientProvider);
-        return manager;
-    }
-}

bff/src/main/java/com/example/keycloakpattern/bff/SpaCsrfTokenRequestHandler.java

@@ -1,40 +0,0 @@
-package com.example.keycloakpattern.bff;
-
-import java.util.function.Supplier;
-
-import jakarta.servlet.http.HttpServletRequest;
-import jakarta.servlet.http.HttpServletResponse;
-
-import org.springframework.security.web.csrf.CsrfToken;
-import org.springframework.security.web.csrf.CsrfTokenRequestAttributeHandler;
-import org.springframework.security.web.csrf.CsrfTokenRequestHandler;
-import org.springframework.security.web.csrf.XorCsrfTokenRequestAttributeHandler;
-import org.springframework.util.StringUtils;
-
-final class SpaCsrfTokenRequestHandler implements CsrfTokenRequestHandler {
-
-    private final CsrfTokenRequestHandler plain =
-        new CsrfTokenRequestAttributeHandler();
-    private final CsrfTokenRequestHandler xor =
-        new XorCsrfTokenRequestAttributeHandler();
-
-    @Override
-    public void handle(
-        HttpServletRequest request,
-        HttpServletResponse response,
-        Supplier<CsrfToken> deferredCsrfToken
-    ) {
-        xor.handle(request, response, deferredCsrfToken);
-    }
-
-    @Override
-    public String resolveCsrfTokenValue(
-        HttpServletRequest request,
-        CsrfToken csrfToken
-    ) {
-        if (StringUtils.hasText(request.getHeader(csrfToken.getHeaderName()))) {
-            return plain.resolveCsrfTokenValue(request, csrfToken);
-        }
-        return xor.resolveCsrfTokenValue(request, csrfToken);
-    }
-}

bff/src/main/resources/application.yml

@@ -1,47 +0,0 @@
-server:
-  port: ${SERVER_PORT:8083}
-  servlet:
-    session:
-      cookie:
-        name: AP3_SESSION
-        http-only: true
-        same-site: lax
-
-spring:
-  application:
-    name: keycloak-bff
-  security:
-    oauth2:
-      client:
-        registration:
-          keycloak:
-            provider: keycloak
-            client-id: bff-confidential
-            client-secret: ${KEYCLOAK_CLIENT_SECRET}
-            client-authentication-method: client_secret_basic
-            authorization-grant-type: authorization_code
-            redirect-uri: "{baseUrl}/login/oauth2/code/{registrationId}"
-            scope:
-              - openid
-              - profile
-              - email
-        provider:
-          keycloak:
-            authorization-uri: http://localhost:8080/realms/keycloak-patterns/protocol/openid-connect/auth
-            token-uri: http://keycloak:8080/realms/keycloak-patterns/protocol/openid-connect/token
-            jwk-set-uri: http://keycloak:8080/realms/keycloak-patterns/protocol/openid-connect/certs
-            user-info-uri: http://keycloak:8080/realms/keycloak-patterns/protocol/openid-connect/userinfo
-            user-name-attribute: preferred_username
-
-resource-api:
-  base-url: ${RESOURCE_API_BASE_URL:http://localhost:8081}
-
-management:
-  endpoint:
-    health:
-      probes:
-        enabled: true
-  endpoints:
-    web:
-      exposure:
-        include: health,info

bff/src/main/resources/static/app.js

@@ -1,59 +0,0 @@
-const result = document.querySelector("#result");
-
-function render(value) {
-  result.textContent = JSON.stringify(value, null, 2);
-}
-
-function readCookie(name) {
-  const prefix = `${encodeURIComponent(name)}=`;
-  const value = document.cookie
-    .split("; ")
-    .find((cookie) => cookie.startsWith(prefix));
-  return value ? decodeURIComponent(value.slice(prefix.length)) : null;
-}
-
-async function request(path, options = {}) {
-  const response = await fetch(path, {
-    ...options,
-    headers: { Accept: "application/json", ...options.headers },
-  });
-  if (response.redirected || response.status === 401) {
-    window.location.assign("/oauth2/authorization/keycloak");
-    return null;
-  }
-  const body = await response.json();
-  render({ status: response.status, ...body });
-  return { response, body };
-}
-
-document.querySelector("#login").addEventListener("click", () => {
-  window.location.assign("/oauth2/authorization/keycloak");
-});
-
-document.querySelector("#inspect").addEventListener("click", () => {
-  void request("/bff/token-boundary");
-});
-
-document.querySelector("#call-bff").addEventListener("click", () => {
-  void request("/bff/api/me");
-});
-
-document.querySelector("#change-with-csrf").addEventListener("click", async () => {
-  const csrfResponse = await fetch("/bff/csrf", {
-    headers: { Accept: "application/json" },
-  });
-  const csrf = await csrfResponse.json();
-  const csrfToken = readCookie("XSRF-TOKEN");
-  if (!csrfToken) {
-    render({ status: 500, error: "XSRF-TOKEN cookie was not created" });
-    return;
-  }
-  await request("/bff/api/preferences", {
-    method: "POST",
-    body: new URLSearchParams({ theme: "dark" }),
-    headers: {
-      "Content-Type": "application/x-www-form-urlencoded",
-      [csrf.headerName]: csrfToken,
-    },
-  });
-});

bff/src/main/resources/static/index.html

@@ -1,31 +0,0 @@
-<!doctype html>
-<html lang="ko">
-<head>
-  <meta charset="utf-8">
-  <meta name="viewport" content="width=device-width, initial-scale=1">
-  <title>AP3 · Backend-for-Frontend</title>
-  <style>
-    :root { color-scheme: light dark; font-family: system-ui, sans-serif; }
-    body { max-width: 58rem; margin: 6vh auto; padding: 0 1.5rem; line-height: 1.6; }
-    button { margin: 0 0.5rem 0.5rem 0; padding: 0.6rem 0.9rem; cursor: pointer; }
-    pre { min-height: 9rem; padding: 1rem; border-radius: 0.4rem;
-      background: color-mix(in srgb, CanvasText 9%, Canvas); white-space: pre-wrap; }
-  </style>
-</head>
-<body>
-  <main>
-    <h1>AP3 · Backend-for-Frontend</h1>
-    <p>
-      브라우저에는 OAuth token이 전혀 전달되지 않습니다. HttpOnly session
-      cookie로 BFF만 호출하고, BFF가 서버 보관 access token을 Resource
-      Server 요청에 붙입니다.
-    </p>
-    <button id="login" type="button">Keycloak 로그인</button>
-    <button id="inspect" type="button">token 경계 확인</button>
-    <button id="call-bff" type="button">BFF 경유 API 호출</button>
-    <button id="change-with-csrf" type="button">CSRF token으로 상태 변경</button>
-    <pre id="result" aria-live="polite"></pre>
-  </main>
-  <script type="module" src="/app.js"></script>
-</body>
-</html>

bff/src/test/java/com/example/keycloakpattern/bff/BffControllerTest.java

@@ -1,90 +0,0 @@
-package com.example.keycloakpattern.bff;
-
-import static org.mockito.Mockito.mock;
-import static org.mockito.Mockito.when;
-import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.oidcLogin;
-import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.csrf;
-import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
-import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post;
-import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.header;
-import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath;
-import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
-
-import org.junit.jupiter.api.Test;
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.boot.test.autoconfigure.web.servlet.AutoConfigureMockMvc;
-import org.springframework.boot.test.context.SpringBootTest;
-import org.springframework.security.oauth2.client.OAuth2AuthorizedClient;
-import org.springframework.security.oauth2.client.OAuth2AuthorizedClientManager;
-import org.springframework.security.oauth2.client.OAuth2AuthorizedClientService;
-import org.springframework.security.oauth2.core.OAuth2AccessToken;
-import org.springframework.security.oauth2.core.OAuth2RefreshToken;
-import org.springframework.test.context.bean.override.mockito.MockitoBean;
-import org.springframework.test.web.servlet.MockMvc;
-
-@SpringBootTest(properties = {
-    "KEYCLOAK_CLIENT_SECRET=test-only-secret",
-    "resource-api.base-url=http://127.0.0.1:9"
-})
-@AutoConfigureMockMvc
-class BffControllerTest {
-
-    @Autowired
-    private MockMvc mockMvc;
-
-    @MockitoBean
-    private OAuth2AuthorizedClientService authorizedClientService;
-
-    @MockitoBean
-    private OAuth2AuthorizedClientManager authorizedClientManager;
-
-    @Test
-    void reportsServerTokenCustodyWithoutReturningTokens() throws Exception {
-        OAuth2AuthorizedClient client = mock(OAuth2AuthorizedClient.class);
-        when(client.getAccessToken()).thenReturn(mock(OAuth2AccessToken.class));
-        when(client.getRefreshToken()).thenReturn(mock(OAuth2RefreshToken.class));
-        when(authorizedClientService.loadAuthorizedClient("keycloak", "test-subject"))
-            .thenReturn(client);
-
-        mockMvc.perform(get("/bff/token-boundary").with(oidcLogin()
-                .idToken(token -> token.subject("test-subject"))))
-            .andExpect(status().isOk())
-            .andExpect(header().string("Cache-Control", "no-store"))
-            .andExpect(jsonPath("$.accessTokenStoredOnServer").value(true))
-            .andExpect(jsonPath("$.refreshTokenStoredOnServer").value(true))
-            .andExpect(jsonPath("$.browserTokenCount").value(0))
-            .andExpect(jsonPath("$.csrfProtectionEnabled").value(true))
-            .andExpect(jsonPath("$.access_token").doesNotExist())
-            .andExpect(jsonPath("$.refresh_token").doesNotExist());
-    }
-
-    @Test
-    void rejectsStateChangeWithoutCsrfToken() throws Exception {
-        mockMvc.perform(post("/bff/api/preferences")
-                .param("theme", "attacker")
-                .with(oidcLogin().idToken(token -> token.subject("test-subject"))))
-            .andExpect(status().isForbidden());
-    }
-
-    @Test
-    void acceptsStateChangeWithCsrfToken() throws Exception {
-        mockMvc.perform(post("/bff/api/preferences")
-                .param("theme", "dark")
-                .with(oidcLogin().idToken(token -> token.subject("test-subject")))
-                .with(csrf()))
-            .andExpect(status().isOk())
-            .andExpect(jsonPath("$.updated").value(true))
-            .andExpect(jsonPath("$.theme").value("dark"));
-    }
-
-    @Test
-    void exposesSpaCsrfTokenWithoutCaching() throws Exception {
-        mockMvc.perform(get("/bff/csrf").with(oidcLogin()
-                .idToken(token -> token.subject("test-subject"))))
-            .andExpect(status().isOk())
-            .andExpect(header().string("Cache-Control", "no-store"))
-            .andExpect(header().exists("Set-Cookie"))
-            .andExpect(jsonPath("$.headerName").value("X-XSRF-TOKEN"))
-            .andExpect(jsonPath("$.token").isNotEmpty());
-    }
-}

deploy/traefik/dynamic.yml

@@ -0,0 +1,35 @@
+http:
+  routers:
+    oauth:
+      entryPoints:
+        - web
+      rule: PathPrefix(`/oauth2/`)
+      service: oauth2-proxy
+      priority: 100
+    application:
+      entryPoints:
+        - web
+      rule: PathPrefix(`/`)
+      middlewares:
+        - keycloak-forward-auth
+      service: application
+
+  middlewares:
+    keycloak-forward-auth:
+      forwardAuth:
+        address: http://oauth2-proxy:4180/oauth2/auth
+        trustForwardHeader: false
+        authResponseHeaders:
+          - X-Auth-Request-User
+          - X-Auth-Request-Email
+          - Set-Cookie
+
+  services:
+    oauth2-proxy:
+      loadBalancer:
+        servers:
+          - url: http://oauth2-proxy:4180
+    application:
+      loadBalancer:
+        servers:
+          - url: http://app:8081

deploy/traefik/traefik.yml

@@ -0,0 +1,14 @@
+entryPoints:
+  web:
+    address: ":8080"
+
+providers:
+  file:
+    filename: /etc/traefik/dynamic.yml
+    watch: false
+
+api:
+  dashboard: false
+
+log:
+  level: INFO

docker-compose.yml

@@ -71,8 +71,9 @@ services:
       SERVER_PORT: "8081"
       SPRING_SECURITY_OAUTH2_RESOURCESERVER_JWT_ISSUER_URI: http://localhost:8080/realms/keycloak-patterns
       SPRING_SECURITY_OAUTH2_RESOURCESERVER_JWT_JWK_SET_URI: http://keycloak:8080/realms/keycloak-patterns/protocol/openid-connect/certs
-    ports:
+      EDGE_INTERNAL_AUTH_TOKEN: ${INTERNAL_AUTH_TOKEN:?set INTERNAL_AUTH_TOKEN in .env}
-      - "127.0.0.1:8081:8081"
+    expose:
+      - "8081"
     depends_on:
       keycloak:
         condition: service_healthy
@@ -88,15 +89,41 @@ services:
       - keycloak-net
     restart: unless-stopped
 
-  bff:
+  oauth2-proxy:
-    build:
+    image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.2
-      context: ./bff
+    command:
+      - --http-address=0.0.0.0:4180
+      - --provider=keycloak-oidc
+      - --oidc-issuer-url=http://localhost:8080/realms/keycloak-patterns
+      - --skip-oidc-discovery=true
+      - --login-url=http://localhost:8080/realms/keycloak-patterns/protocol/openid-connect/auth
+      - --redeem-url=http://keycloak:8080/realms/keycloak-patterns/protocol/openid-connect/token
+      - --oidc-jwks-url=http://keycloak:8080/realms/keycloak-patterns/protocol/openid-connect/certs
+      - --profile-url=http://keycloak:8080/realms/keycloak-patterns/protocol/openid-connect/userinfo
+      - --validate-url=http://keycloak:8080/realms/keycloak-patterns/protocol/openid-connect/userinfo
+      - --redirect-url=http://localhost:8088/oauth2/callback
+      - --upstream=http://app:8081
+      - --email-domain=*
+      - --scope=openid profile email
+      - --code-challenge-method=S256
+      - --reverse-proxy=true
+      - --trusted-proxy-ip=172.30.40.10/32
+      - --cookie-name=AP4_SESSION
+      - --cookie-secure=false
+      - --cookie-samesite=lax
+      - --cookie-expire=1h
+      - --session-cookie-minimal=true
+      - --skip-provider-button=true
+      - --set-xauthrequest=true
+      - --pass-user-headers=true
+      - --whitelist-domain=localhost:8088
+      - --whitelist-domain=localhost:8080
     environment:
-      SERVER_PORT: "8083"
+      OAUTH2_PROXY_CLIENT_ID: edge-proxy
-      KEYCLOAK_CLIENT_SECRET: ${BFF_CLIENT_SECRET:?set BFF_CLIENT_SECRET in .env}
+      OAUTH2_PROXY_CLIENT_SECRET: ${EDGE_PROXY_CLIENT_SECRET:?set EDGE_PROXY_CLIENT_SECRET in .env}
-      RESOURCE_API_BASE_URL: http://app:8081
+      OAUTH2_PROXY_COOKIE_SECRET: ${OAUTH2_PROXY_COOKIE_SECRET:?set OAUTH2_PROXY_COOKIE_SECRET in .env}
-    ports:
+    expose:
-      - "127.0.0.1:8083:8083"
+      - "4180"
     depends_on:
       keycloak:
         condition: service_healthy
@@ -104,12 +131,13 @@ services:
         condition: service_healthy
     healthcheck:
       test:
-        - CMD-SHELL
+        - CMD
-        - wget -q -O - http://127.0.0.1:8083/actuator/health | grep -q '"status":"UP"'
+        - /bin/oauth2-proxy
+        - --version
       interval: 10s
       timeout: 5s
-      retries: 12
+      retries: 3
-      start_period: 20s
+      start_period: 5s
     networks:
       - keycloak-net
     restart: unless-stopped
@@ -117,10 +145,12 @@ services:
   nginx:
     build:
       context: ./frontend
+    environment:
+      INTERNAL_AUTH_TOKEN: ${INTERNAL_AUTH_TOKEN:?set INTERNAL_AUTH_TOKEN in .env}
     ports:
       - "127.0.0.1:${NGINX_PORT:-8088}:80"
     depends_on:
-      app:
+      oauth2-proxy:
         condition: service_healthy
     healthcheck:
       test:
@@ -130,7 +160,8 @@ services:
       timeout: 5s
       retries: 12
     networks:
-      - keycloak-net
+      keycloak-net:
+        ipv4_address: 172.30.40.10
     restart: unless-stopped
 
 volumes:
@@ -140,3 +171,6 @@ volumes:
 networks:
   keycloak-net:
     driver: bridge
+    ipam:
+      config:
+        - subnet: 172.30.40.0/24

docs/ap3-bff-boundary.md

@@ -1,36 +0,0 @@
-# AP3 · Backend-for-Frontend
-
-## 요청과 token 경계
-
-1. 브라우저는 BFF의 `/oauth2/authorization/keycloak`로 로그인을 시작합니다.
-2. Spring `oauth2Login`은 PKCE S256 authorization code flow를 수행합니다.
-3. BFF가 client secret으로 code를 교환하고 access/refresh token을 서버의
-   `OAuth2AuthorizedClientService`에 보관합니다.
-4. 브라우저에는 OAuth token 대신 HttpOnly `AP3_SESSION` 식별자만 남습니다.
-5. 브라우저가 `/bff/api/me`를 cookie로 호출하면 BFF가 access token을
-   `Authorization: Bearer`로 붙여 Resource Server에 fan-out합니다.
-
-Resource Server는 `aud=keycloak-pattern-api`를 검증합니다. 브라우저에서는
-8081로 직접 요청하거나 Keycloak token endpoint를 호출하지 않습니다.
-
-학습용 구성은 단일 인스턴스 메모리에 session과 authorized client를
-보관합니다. BFF를 재시작하면 세션이 사라집니다. 다중 인스턴스 운영에서는
-Spring Session/Redis 같은 공유 저장소와 저장 token 암호화 정책이 필요합니다.
-
-## CSRF와 SameSite 방어
-
-`feature/keycloak-bff-oauth2login-session`에서는 방어 전 비교를 위해
-CSRF를 끄고, 다른 origin의 자동 제출 form이 `/bff/api/preferences`
-상태를 바꾸는 것을 재현합니다.
-
-`feature/keycloak-bff-csrf-samesite-defense`에서는 다음 방어를 함께
-적용합니다.
-
-- Spring synchronizer CSRF token과 `CookieCsrfTokenRepository`
-- JS가 읽는 `XSRF-TOKEN`과 요청의 `X-XSRF-TOKEN` header
-- HttpOnly `AP3_SESSION` cookie의 명시적 `SameSite=Lax`
-
-E2E는 token 없는 동일 위조 POST가 403이 되는 것, CSRF header가 있는
-정상 POST는 200인 것, cross-site POST에는 AP3 session cookie가 제외되는
-것을 각각 확인합니다. SameSite는 CSRF token을 대체하지 않는
-defense-in-depth입니다.

docs/ap4-edge-forward-auth.md

@@ -0,0 +1,70 @@
+# AP4 · oauth2-proxy Edge Forward Auth
+
+## 첫 단계: oauth2-proxy 자체 OIDC 흐름
+
+`feature/keycloak-oauth2-proxy-oidc-flow`에서는 oauth2-proxy를
+`http://localhost:4180`에 직접 노출해 구성 요소를 분리해서 확인합니다.
+
+1. `/edge/me` 미인증 요청이 Keycloak로 redirect됩니다.
+2. oauth2-proxy는 confidential `edge-proxy` client와 PKCE S256을 사용합니다.
+3. callback에서 code/token 교환과 ID/access token 검증은 서버끼리
+   수행합니다.
+4. 브라우저에는 HttpOnly `AP4_SESSION` cookie만 남습니다.
+5. oauth2-proxy가 backend 요청에 `X-Forwarded-User`를 붙여 200을 받습니다.
+
+Keycloak이 발급하는 issuer는 브라우저 기준
+`http://localhost:8080/realms/keycloak-patterns`입니다. 컨테이너 내부의
+`localhost`는 oauth2-proxy 자신이므로 discovery endpoint에 도달할 수
+없습니다. 그래서 이 로컬 Compose 구성은 issuer 검증값은 외부 URL로
+유지하되, login URL은 브라우저용 외부 주소, token/JWKS/userinfo는
+`http://keycloak:8080` 내부 주소로 각각 명시합니다.
+
+HTTP 로컬 시연이라 `cookie-secure=false`를 사용합니다. 운영 HTTPS에서는
+반드시 secure cookie로 되돌려야 합니다.
+
+## 다음 단계의 보안 전제
+
+이 첫 feature의 backend는 전달된 사용자 헤더를 신뢰하며 8081도
+loopback에 publish되어 있습니다. 따라서 로컬에서 직접
+`X-Forwarded-User: spoofed-admin`을 보내면 우회가 재현됩니다. 이후
+Nginx `auth_request` 통합을 거쳐 최종 feature에서 backend no-publish와
+내부 shared-secret 검증을 함께 적용합니다.
+
+## 두 번째 단계: Nginx `auth_request`
+
+`feature/keycloak-nginx-auth-request-integration`부터 외부 진입점은
+`http://localhost:8088` Nginx 하나입니다. oauth2-proxy의 4180 포트는
+Compose 네트워크에만 expose됩니다.
+
+- Nginx의 정확 일치 `location = /oauth2/auth`는 `internal`이라 외부에서
+  직접 호출할 수 없습니다.
+- 인증 서브리퀘스트에는 본문을 보내지 않고 `Content-Length`도
+  비웁니다.
+- 일반 브라우저 요청의 401은 `/oauth2/start` 302로 변환합니다.
+- API 요청 `/api/edge`는 redirect하지 않고 JSON 401을 반환합니다.
+- 인증 성공 시 oauth2-proxy의 `X-Auth-Request-User`와 email만 backend로
+  전달합니다.
+
+Nginx 컨테이너 IP를 전용 Compose subnet에서 고정하고 oauth2-proxy의
+trusted proxy를 그 단일 IP로 제한합니다. 다만 이 단계에서는 backend
+8081이 로컬 호스트에 열려 있어 신뢰 헤더를 직접 위조할 수 있습니다.
+그 재현 조건은 마지막 feature에서 제거합니다.
+
+## 마지막 단계: 신뢰 경계와 헤더 스푸핑 방어
+
+`feature/keycloak-header-spoofing-defense`에서는 신뢰 경계를 실제
+네트워크와 application 양쪽에서 강제합니다.
+
+1. backend 8081과 oauth2-proxy 4180은 host에 publish하지 않습니다.
+   브라우저가 접근 가능한 application 포트는 Nginx 8088뿐입니다.
+2. Nginx는 client가 보낸 `X-Auth-Request-User`, email, 내부 토큰을
+   그대로 전달하지 않고 oauth2-proxy 결과와 server-side 토큰으로
+   항상 덮어씁니다.
+3. backend는 `X-Auth-Request-User`와 `X-Internal-Auth-Token`이 모두
+   유효할 때만 edge identity를 받아들이며 token은 constant-time으로
+   비교합니다.
+
+shared token은 방어 심층화 수단입니다. 운영에서는 Secret Manager나
+orchestrator secret으로 주입하고 주기적으로 교체해야 합니다. 서비스
+간 mTLS 또는 service mesh identity를 사용할 수 있다면 단순 shared
+token보다 강한 workload identity로 대체하는 편이 좋습니다.

docs/bff-vs-spa-direct.md

@@ -1,22 +0,0 @@
-# BFF vs SPA direct
-
-| 항목 | SPA direct (AP1) | BFF (AP3) |
-|---|---|---|
-| OAuth client | public + PKCE | confidential + server secret |
-| token holder | browser JavaScript memory | BFF server |
-| browser credential | access/refresh token | HttpOnly session cookie |
-| XSS 영향 | 실행 중 token/API 권한 탈취 가능 | cookie 읽기는 막지만 same-origin 요청 악용 가능 |
-| CSRF | bearer header 중심이라 상대적으로 작음 | session cookie이므로 명시적 방어 필요 |
-| backend 상태 | stateless 가능 | session store 필요 |
-| logout/revocation | browser와 Keycloak 조정 | BFF session과 Keycloak logout 조정 |
-| scale-out | JWT 검증 위주 | sticky session 또는 shared store |
-
-이 repository의 AP3는 Spring `oauth2Login`, confidential `bff-confidential`
-client, server-side authorized-client/token 보관, HttpOnly/SameSite session,
-CSRF token을 실제 구현한다. AP1은 token을 메모리에만 두지만 XSS가 실행되면
-현재 token을 사용할 수 있다는 경계를 E2E로 보여 준다.
-
-선택은 “BFF가 항상 더 안전하다”가 아니라 threat model과 운영비의 교환이다.
-브라우저에 OAuth token을 노출하지 않는 것이 우선이고 stateful 운영을 감당할
-수 있으면 BFF, protocol과 stateless Resource Server를 직접 학습하려면 AP1이
-더 투명하다.

docs/edge-forwardauth-google-federation.md

@@ -0,0 +1,26 @@
+# AP4 edge forward-auth with Google federation
+
+Google federation은 AP4의 edge contract를 바꾸지 않는다.
+
+```text
+Browser -> nginx -> oauth2-proxy -> Keycloak -> Google
+Browser <- AP4_SESSION <- oauth2-proxy <- Keycloak
+nginx -> trusted identity headers -> upstream app
+```
+
+oauth2-proxy가 신뢰하는 issuer는 Google이 아니라 Keycloak이다. Google ID
+token은 Keycloak broker 경계 안에서 검증되고, oauth2-proxy는 Keycloak
+authorization code/token과 session cookie만 다룬다. upstream 앱도
+broker 여부와 무관하게 동일한 trusted headers를 받는다.
+
+`verify-edge-google-federation.sh`는 mock Google 로그인, confidential
+server-side token 교환(브라우저에 token 요청 없음), 미검증 broker email 거부,
+Keycloak email verification 완료 후 HttpOnly edge cookie와 brokered
+subject/email header를 실제 컨테이너와 브라우저로 검증한다. minimal session의
+`X-Auth-Request-User`는 표시용 username이 아니라 Keycloak의 안정적인 local
+subject UUID이며, 화면 이름이 필요하면 별도 허용 header를 명시한다.
+
+brokered token/claims가 client-side session cookie의 4KB 한계를 넘지 않도록
+oauth2-proxy에는 `session-cookie-minimal=true`를 적용한다. AP4 upstream은
+token forwarding이 아니라 trusted identity headers만 사용하므로 cookie에
+access/refresh/ID token을 보관할 필요가 없다.

docs/edge-forwardauth-no-google.md

@@ -0,0 +1,20 @@
+# AP4 edge forward-auth: local identity profile
+
+nginx의 `auth_request`가 oauth2-proxy `/oauth2/auth`를 호출하고, 미인증
+브라우저만 Keycloak로 redirect한다. oauth2-proxy는 confidential
+`edge-proxy` client로 code를 교환하며 browser에는 HttpOnly session cookie만
+남긴다.
+
+Google이 없어도 이 경계는 완전히 동작한다. 사용자는 Keycloak local
+credential로 로그인하고 upstream 애플리케이션은 OAuth/OIDC를 몰라도 된다.
+
+보안 경계:
+
+- backend와 oauth2-proxy 포트를 host에 publish하지 않는다.
+- 외부에서 받은 identity header를 nginx가 제거·덮어쓴다.
+- backend는 trusted nginx가 주입하는 별도 internal token도 확인한다.
+- 브라우저가 직접 호출한 `/oauth2/auth`는 공개하지 않는다.
+
+`verify-edge-no-google-profile.sh`는 Compose와 nginx 계약을 검사하고,
+`verify-pattern4.sh`는 실제 local-user 브라우저 흐름과 spoofing 방어를
+검증한다.

docs/traefik-forwardauth-alternative.md

@@ -0,0 +1,22 @@
+# Traefik ForwardAuth alternative
+
+Traefik의 `forwardAuth` middleware는 nginx `auth_request`와 같은 정책 지점을
+제공한다. 예제는 `/oauth2/auth`를 oauth2-proxy에 위임하고 성공 응답의
+허용된 identity headers만 application request로 복사한다.
+
+중요한 차이:
+
+- ForwardAuth 자체는 OIDC client나 session manager가 아니다. 이 예제에서도
+  oauth2-proxy가 code 교환과 cookie를 담당한다.
+- `trustForwardHeader=false`로 외부 forwarded header를 신뢰하지 않는다.
+- `/oauth2/` router는 callback/start 경로를 oauth2-proxy에 연결해야 한다.
+- nginx의 `error_page 401 -> /oauth2/start`와 같은 로그인 redirect UX는
+  Traefik errors middleware 또는 oauth2-proxy의 forward-auth redirect
+  profile을 추가로 설계해야 한다.
+- Docker socket label discovery 대신 file provider를 사용해 socket 노출을
+  피했다. Kubernetes에서는 Middleware/IngressRoute CRD라는 vendor-specific
+  운영 객체가 추가된다.
+
+이 repository의 실제 AP4 baseline은 학습 가시성이 높은 nginx 조합을
+유지한다. `verify-traefik-forwardauth-config.sh`는 대안 파일을 Traefik
+binary로 로드하고 즉시 발생하는 provider/config 오류가 없는지 확인한다.

e2e/package.json

@@ -4,7 +4,8 @@
   "version": "1.0.0",
   "type": "module",
   "scripts": {
-    "test:pattern3": "node pattern3.mjs"
+    "test:pattern4": "node pattern4.mjs",
+    "test:pattern4-google": "node pattern4-google.mjs"
   },
   "devDependencies": {
     "playwright-core": "1.62.0"

e2e/pattern3.mjs

@@ -1,198 +0,0 @@
-import assert from "node:assert/strict";
-import { chromium } from "playwright-core";
-
-const password = process.env.E2E_PASSWORD;
-assert.ok(password, "E2E_PASSWORD must be set");
-
-async function completeKeycloakLogin(page) {
-  for (let attempt = 1; attempt <= 2; attempt += 1) {
-    await page.locator("#username").fill(
-      process.env.E2E_USERNAME ?? "regular-user",
-    );
-    await page.locator("#password").fill(password);
-    await page.locator("#kc-login").click();
-    await page.waitForLoadState("domcontentloaded");
-
-    if (page.url() === "http://localhost:8083/") {
-      return;
-    }
-    if (attempt === 1) {
-      await page.goto(
-        "http://localhost:8083/oauth2/authorization/keycloak",
-      );
-      await page.waitForURL(/localhost:8080/u);
-    }
-  }
-  throw new Error(`Keycloak login did not return to AP3: ${page.url()}`);
-}
-
-const browser = await chromium.launch({
-  executablePath: process.env.CHROME_BIN ?? "/usr/bin/google-chrome",
-  headless: true,
-  args: ["--no-sandbox"],
-});
-
-try {
-  const context = await browser.newContext();
-  const page = await context.newPage();
-  const browserRequests = [];
-  page.on("request", (request) =>
-    browserRequests.push({ method: request.method(), url: request.url() }),
-  );
-
-  await page.goto("http://localhost:8083");
-  const authorizationRequestPromise = page.waitForRequest((request) =>
-    request.url().includes(
-      "/protocol/openid-connect/auth?response_type=code",
-    ),
-  );
-  await page.locator("#login").click();
-  const authorizationRequest = await authorizationRequestPromise;
-  const authorizationUrl = new URL(authorizationRequest.url());
-  assert.equal(authorizationUrl.searchParams.get("client_id"), "bff-confidential");
-  assert.equal(authorizationUrl.searchParams.get("code_challenge_method"), "S256");
-  assert.ok(authorizationUrl.searchParams.get("code_challenge"));
-
-  await page.waitForURL(/localhost:8080/u);
-  await completeKeycloakLogin(page);
-  const callbackRequest = browserRequests.find(({ url }) =>
-    url.startsWith("http://localhost:8083/login/oauth2/code/keycloak?"),
-  );
-  assert.ok(callbackRequest, "authorization response must use the BFF callback");
-  assert.equal(callbackRequest.method, "GET");
-
-  const boundaryResponsePromise = page.waitForResponse((response) =>
-    response.url().endsWith("/bff/token-boundary"),
-  );
-  await page.locator("#inspect").click();
-  const boundaryResponse = await boundaryResponsePromise;
-  assert.equal(boundaryResponse.status(), 200);
-  const boundary = await boundaryResponse.json();
-  assert.equal(boundary.accessTokenStoredOnServer, true);
-  assert.equal(boundary.refreshTokenStoredOnServer, true);
-  assert.equal(boundary.browserTokenCount, 0);
-  assert.equal(boundary.csrfProtectionEnabled, true);
-  assert.equal(JSON.stringify(boundary).includes("access_token"), false);
-  assert.equal(JSON.stringify(boundary).includes("refresh_token"), false);
-
-  const proxyResponsePromise = page.waitForResponse((response) =>
-    response.url().endsWith("/bff/api/me"),
-  );
-  await page.locator("#call-bff").click();
-  const proxyResponse = await proxyResponsePromise;
-  assert.equal(proxyResponse.status(), 200);
-  const resource = await proxyResponse.json();
-  assert.equal(resource.username, "regular-user");
-  assert.ok(resource.audience.includes("keycloak-pattern-api"));
-
-  assert.equal(
-    browserRequests.some(({ url }) =>
-      url.startsWith("http://localhost:8081/"),
-    ),
-    false,
-    "the browser must not bypass the BFF",
-  );
-  assert.equal(
-    browserRequests.some(({ url }) =>
-      url.includes("/protocol/openid-connect/token"),
-    ),
-    false,
-    "the token exchange must be server-to-server",
-  );
-
-  const cookies = await context.cookies("http://localhost:8083/");
-  const sessionCookie = cookies.find((cookie) => cookie.name === "AP3_SESSION");
-  assert.ok(sessionCookie);
-  assert.equal(sessionCookie.httpOnly, true);
-  assert.equal(sessionCookie.sameSite, "Lax");
-
-  const storage = await page.evaluate(() => ({
-    localStorage: Object.values(localStorage),
-    sessionStorage: Object.values(sessionStorage),
-    readableCookies: document.cookie,
-  }));
-  assert.deepEqual(storage.localStorage, []);
-  assert.deepEqual(storage.sessionStorage, []);
-  assert.equal(storage.readableCookies.includes("AP3_SESSION"), false);
-
-  const missingCsrfResponse = await page.evaluate(async () => {
-    const response = await fetch("/bff/api/preferences", {
-      method: "POST",
-      body: new URLSearchParams({ theme: "missing-csrf" }),
-      headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    });
-    return response.status;
-  });
-  assert.equal(missingCsrfResponse, 403);
-
-  const csrfResponsePromise = page.waitForResponse((response) =>
-    response.url().endsWith("/bff/csrf"),
-  );
-  const validChangeResponsePromise = page.waitForResponse(
-    (response) =>
-      response.url().endsWith("/bff/api/preferences") &&
-      response.request().method() === "POST" &&
-      response.status() === 200,
-  );
-  await page.locator("#change-with-csrf").click();
-  const csrfResponse = await csrfResponsePromise;
-  const validChangeResponse = await validChangeResponsePromise;
-  assert.equal(csrfResponse.status(), 200);
-  assert.equal(validChangeResponse.status(), 200);
-  const validChange = await validChangeResponse.json();
-  assert.equal(validChange.theme, "dark");
-
-  const csrfCookies = await context.cookies("http://localhost:8083/");
-  const csrfCookie = csrfCookies.find((cookie) => cookie.name === "XSRF-TOKEN");
-  assert.ok(csrfCookie);
-  assert.equal(csrfCookie.httpOnly, false);
-
-  await page.goto("http://localhost:8088");
-  const [forgedResponse] = await Promise.all([
-    page.waitForNavigation(),
-    page.evaluate(() => {
-      const form = document.createElement("form");
-      form.method = "POST";
-      form.action = "http://localhost:8083/bff/api/preferences";
-      const input = document.createElement("input");
-      input.name = "theme";
-      input.value = "attacker";
-      form.append(input);
-      document.body.append(form);
-      form.submit();
-    }),
-  ]);
-  assert.ok(forgedResponse);
-  assert.equal(forgedResponse.status(), 403);
-
-  await page.goto("http://127.0.0.1:8088");
-  const crossSiteRequestPromise = page.waitForRequest(
-    (request) =>
-      request.url() === "http://localhost:8083/bff/api/preferences" &&
-      request.method() === "POST",
-  );
-  await page.evaluate(() => {
-    const form = document.createElement("form");
-    form.method = "POST";
-    form.action = "http://localhost:8083/bff/api/preferences";
-    const input = document.createElement("input");
-    input.name = "theme";
-    input.value = "cross-site-attacker";
-    form.append(input);
-    document.body.append(form);
-    form.submit();
-  });
-  const crossSiteRequest = await crossSiteRequestPromise;
-  const crossSiteHeaders = await crossSiteRequest.allHeaders();
-  assert.equal(
-    (crossSiteHeaders.cookie ?? "").includes("AP3_SESSION="),
-    false,
-    "SameSite=Lax must omit the session cookie on a cross-site POST",
-  );
-
-  console.log(
-    "pattern3 BFF verified: tokenless POST 403, CSRF header 200, SameSite=Lax session",
-  );
-} finally {
-  await browser.close();
-}

e2e/pattern4-google.mjs

@@ -0,0 +1,99 @@
+import assert from "node:assert/strict";
+import { chromium } from "playwright-core";
+
+const password = process.env.MOCK_GOOGLE_USER_PASSWORD;
+const adminUsername = process.env.KC_BOOTSTRAP_ADMIN_USERNAME;
+const adminPassword = process.env.KC_BOOTSTRAP_ADMIN_PASSWORD;
+assert.ok(password && adminUsername && adminPassword);
+
+async function verifyBrokeredEmail() {
+  const tokenResponse = await fetch(
+    "http://localhost:8080/realms/master/protocol/openid-connect/token",
+    {
+      method: "POST",
+      body: new URLSearchParams({
+        client_id: "admin-cli",
+        grant_type: "password",
+        username: adminUsername,
+        password: adminPassword,
+      }),
+    },
+  );
+  assert.equal(tokenResponse.status, 200);
+  const token = (await tokenResponse.json()).access_token;
+  const headers = { Authorization: `Bearer ${token}` };
+  const usersResponse = await fetch(
+    "http://localhost:8080/admin/realms/keycloak-patterns/users"
+      + "?email=broker-new-user%40example.test&exact=true",
+    { headers },
+  );
+  assert.equal(usersResponse.status, 200);
+  const users = await usersResponse.json();
+  assert.equal(users.length, 1);
+  const userResponse = await fetch(
+    `http://localhost:8080/admin/realms/keycloak-patterns/users/${users[0].id}`,
+    { headers },
+  );
+  const user = await userResponse.json();
+  assert.equal(user.emailVerified, false);
+  const updateResponse = await fetch(
+    `http://localhost:8080/admin/realms/keycloak-patterns/users/${user.id}`,
+    {
+      method: "PUT",
+      headers: { ...headers, "Content-Type": "application/json" },
+      body: JSON.stringify({ ...user, emailVerified: true }),
+    },
+  );
+  assert.equal(updateResponse.status, 204);
+}
+
+const browser = await chromium.launch({
+  executablePath: process.env.CHROME_BIN ?? "/usr/bin/google-chrome",
+  headless: true,
+  args: ["--no-sandbox"],
+});
+
+try {
+  const context = await browser.newContext();
+  const page = await context.newPage();
+  const browserRequests = [];
+  page.on("request", (request) => browserRequests.push(request.url()));
+
+  await page.goto("http://localhost:8088/");
+  await page.waitForURL(/localhost:8080/u);
+  await page.locator('a[href*="/broker/mock-google/login"]').click();
+  await page.waitForURL(/\/realms\/mock-google\//u);
+  await page.locator("#username").fill("mock-new-user");
+  await page.locator("#password").fill(password);
+  await page.locator("#kc-login").click();
+  await page.waitForURL(/\/oauth2\/callback/u);
+  assert.match(await page.locator("body").innerText(), /Internal Server Error/u);
+
+  await verifyBrokeredEmail();
+  await page.goto(
+    "http://localhost:8088/oauth2/start"
+      + "?rd=http%3A%2F%2Flocalhost%3A8088%2F",
+  );
+  await page.waitForURL("http://localhost:8088/");
+
+  const identity = JSON.parse(await page.locator("body").innerText());
+  assert.equal(identity.pattern, "AP4-edge-forward-auth");
+  assert.match(identity.user, /^[0-9a-f-]{36}$/u);
+  assert.equal(identity.email, "broker-new-user@example.test");
+  assert.equal(
+    browserRequests.some((url) =>
+      url.includes("/protocol/openid-connect/token"),
+    ),
+    false,
+  );
+
+  const session = (await context.cookies()).find(
+    (cookie) => cookie.name === "AP4_SESSION",
+  );
+  assert.ok(session?.httpOnly);
+  console.log(
+    "AP4 Google federation verified: unverified email rejected, verified identity -> edge session -> trusted headers",
+  );
+} finally {
+  await browser.close();
+}

e2e/pattern4.mjs

@@ -0,0 +1,138 @@
+import assert from "node:assert/strict";
+import { chromium } from "playwright-core";
+
+const password = process.env.E2E_PASSWORD;
+assert.ok(password, "E2E_PASSWORD must be set");
+
+const edgeBaseUrl = "http://localhost:8088";
+const edgeEntryUrl = `${edgeBaseUrl}/`;
+
+async function completeKeycloakLogin(page) {
+  for (let attempt = 1; attempt <= 2; attempt += 1) {
+    await page.locator("#username").fill(
+      process.env.E2E_USERNAME ?? "regular-user",
+    );
+    await page.locator("#password").fill(password);
+    await page.locator("#kc-login").click();
+    await page.waitForLoadState("domcontentloaded");
+
+    if (page.url() === edgeEntryUrl) {
+      return;
+    }
+    if (attempt === 1) {
+      await page.goto(`${edgeBaseUrl}/oauth2/start?rd=${encodeURIComponent(edgeEntryUrl)}`);
+      await page.waitForURL(/localhost:8080/u);
+    }
+  }
+  throw new Error(`Keycloak login did not return to AP4: ${page.url()}`);
+}
+
+const browser = await chromium.launch({
+  executablePath: process.env.CHROME_BIN ?? "/usr/bin/google-chrome",
+  headless: true,
+  args: ["--no-sandbox"],
+});
+
+try {
+  const context = await browser.newContext();
+  const page = await context.newPage();
+  const browserRequests = [];
+  page.on("request", (request) =>
+    browserRequests.push({ method: request.method(), url: request.url() }),
+  );
+
+  const edgeResponsePromise = page.waitForResponse(
+    (response) =>
+      response.url() === edgeEntryUrl &&
+      response.status() === 302,
+  );
+  const authorizationRequestPromise = page.waitForRequest((request) =>
+    request.url().includes(
+      "/protocol/openid-connect/auth?approval_prompt=",
+    ),
+  );
+  await page.goto(edgeEntryUrl);
+  const unauthenticatedEdgeResponse = await edgeResponsePromise;
+  assert.equal(unauthenticatedEdgeResponse.status(), 302);
+
+  const authorizationRequest = await authorizationRequestPromise;
+  const authorizationUrl = new URL(authorizationRequest.url());
+  assert.equal(authorizationUrl.searchParams.get("client_id"), "edge-proxy");
+  assert.equal(authorizationUrl.searchParams.get("code_challenge_method"), "S256");
+  assert.ok(authorizationUrl.searchParams.get("code_challenge"));
+
+  await page.waitForURL(/localhost:8080/u);
+  await completeKeycloakLogin(page);
+  const edgeIdentity = JSON.parse(await page.locator("body").innerText());
+  assert.equal(edgeIdentity.pattern, "AP4-edge-forward-auth");
+  assert.ok(edgeIdentity.user);
+  assert.equal(edgeIdentity.identityHeader, "X-Auth-Request-User");
+
+  const callbackRequest = browserRequests.find(({ url }) =>
+    url.startsWith(`${edgeBaseUrl}/oauth2/callback?`),
+  );
+  assert.ok(callbackRequest);
+  assert.equal(callbackRequest.method, "GET");
+  assert.equal(
+    browserRequests.some(({ url }) =>
+      url.includes("/protocol/openid-connect/token"),
+    ),
+    false,
+    "the confidential token exchange must be server-to-server",
+  );
+
+  const cookies = await context.cookies(edgeEntryUrl);
+  const sessionCookie = cookies.find((cookie) => cookie.name === "AP4_SESSION");
+  assert.ok(sessionCookie);
+  assert.equal(sessionCookie.httpOnly, true);
+  assert.equal(sessionCookie.sameSite, "Lax");
+  assert.equal(sessionCookie.secure, false);
+
+  const storage = await page.evaluate(() => ({
+    localStorage: Object.values(localStorage),
+    sessionStorage: Object.values(sessionStorage),
+    readableCookies: document.cookie,
+  }));
+  assert.deepEqual(storage.localStorage, []);
+  assert.deepEqual(storage.sessionStorage, []);
+  assert.equal(storage.readableCookies.includes("AP4_SESSION"), false);
+
+  const spoofAttempt = await page.evaluate(async () => {
+    const response = await fetch("/", {
+      headers: {
+        "X-Auth-Request-User": "spoofed-admin",
+        "X-Auth-Request-Email": "spoofed-admin@example.test",
+        "X-Internal-Auth-Token": "attacker-controlled-token",
+      },
+    });
+    return { status: response.status, body: await response.json() };
+  });
+  assert.equal(spoofAttempt.status, 200);
+  assert.equal(spoofAttempt.body.user, edgeIdentity.user);
+  assert.notEqual(spoofAttempt.body.user, "spoofed-admin");
+
+  const externalAuthSubrequest = await fetch(`${edgeBaseUrl}/oauth2/auth`);
+  assert.equal(externalAuthSubrequest.status, 404);
+
+  const apiResponse = await fetch(`${edgeBaseUrl}/api/edge`, {
+    redirect: "manual",
+  });
+  assert.equal(apiResponse.status, 401);
+  assert.equal(apiResponse.headers.get("location"), null);
+
+  await assert.rejects(
+    fetch("http://localhost:4180/ping"),
+    "oauth2-proxy must not be published on the host",
+  );
+
+  await assert.rejects(
+    fetch("http://localhost:8081/edge/me"),
+    "backend must not be published on the host",
+  );
+
+  console.log(
+    "pattern4 hardened edge verified: auth_request, no backend publish, spoofed headers overwritten",
+  );
+} finally {
+  await browser.close();
+}

frontend/Dockerfile

@@ -1,4 +1,4 @@
 FROM nginx:1.29-alpine
 
-COPY nginx.conf /etc/nginx/conf.d/default.conf
+COPY default.conf.template /etc/nginx/templates/default.conf.template
 COPY index.html /usr/share/nginx/html/index.html

frontend/default.conf.template

@@ -0,0 +1,75 @@
+server {
+    listen 80;
+    server_name _;
+
+    large_client_header_buffers 4 16k;
+
+    location = /health {
+        access_log off;
+        default_type text/plain;
+        return 200 "ok\n";
+    }
+
+    location = /oauth2/auth {
+        internal;
+        proxy_pass http://oauth2-proxy:4180;
+        proxy_pass_request_body off;
+        proxy_set_header Content-Length "";
+        proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Host $http_host;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-Uri $request_uri;
+    }
+
+    location /oauth2/ {
+        proxy_pass http://oauth2-proxy:4180;
+        proxy_http_version 1.1;
+        proxy_set_header Host $http_host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Host $http_host;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Auth-Request-Redirect $scheme://$http_host$request_uri;
+    }
+
+    location = /api/edge {
+        auth_request /oauth2/auth;
+        error_page 401 = @api_unauthorized;
+
+        auth_request_set $auth_user $upstream_http_x_auth_request_user;
+        auth_request_set $auth_email $upstream_http_x_auth_request_email;
+        auth_request_set $auth_cookie $upstream_http_set_cookie;
+        add_header Set-Cookie $auth_cookie always;
+
+        proxy_pass http://app:8081/edge/me;
+        proxy_set_header X-Auth-Request-User $auth_user;
+        proxy_set_header X-Auth-Request-Email $auth_email;
+        proxy_set_header X-Internal-Auth-Token "${INTERNAL_AUTH_TOKEN}";
+    }
+
+    location / {
+        auth_request /oauth2/auth;
+        error_page 401 = @oauth2_signin;
+
+        auth_request_set $auth_user $upstream_http_x_auth_request_user;
+        auth_request_set $auth_email $upstream_http_x_auth_request_email;
+        auth_request_set $auth_cookie $upstream_http_set_cookie;
+        add_header Set-Cookie $auth_cookie always;
+
+        proxy_pass http://app:8081/edge/me;
+        proxy_set_header X-Auth-Request-User $auth_user;
+        proxy_set_header X-Auth-Request-Email $auth_email;
+        proxy_set_header X-Internal-Auth-Token "${INTERNAL_AUTH_TOKEN}";
+    }
+
+    location @oauth2_signin {
+        return 302 $scheme://$http_host/oauth2/start?rd=$scheme://$http_host$request_uri;
+    }
+
+    location @api_unauthorized {
+        default_type application/json;
+        return 401 '{"error":"authentication required"}';
+    }
+}

frontend/nginx.conf

@@ -1,26 +0,0 @@
-server {
-    listen 80;
-    server_name _;
-
-    root /usr/share/nginx/html;
-    index index.html;
-
-    location = /health {
-        access_log off;
-        default_type text/plain;
-        return 200 "ok\n";
-    }
-
-    location /api/ {
-        proxy_pass http://app:8081;
-        proxy_http_version 1.1;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-    }
-
-    location / {
-        try_files $uri $uri/ /index.html;
-    }
-}

keycloak/import/keycloak-patterns-realm.json

@@ -102,24 +102,8 @@
         "http://localhost:8083"
       ],
       "attributes": {
-        "pkce.code.challenge.method": "S256",
         "post.logout.redirect.uris": "http://localhost:8083/*"
-      },
+      }
-      "protocolMappers": [
-        {
-          "name": "keycloak-pattern-api-audience",
-          "protocol": "openid-connect",
-          "protocolMapper": "oidc-audience-mapper",
-          "consentRequired": false,
-          "config": {
-            "included.custom.audience": "keycloak-pattern-api",
-            "id.token.claim": "false",
-            "access.token.claim": "true",
-            "userinfo.token.claim": "false",
-            "introspection.token.claim": "true"
-          }
-        }
-      ]
     },
     {
       "clientId": "edge-proxy",
@@ -136,10 +120,11 @@
       "serviceAccountsEnabled": false,
       "frontchannelLogout": true,
       "redirectUris": [
-        "http://localhost:4180/oauth2/callback"
+        "http://localhost:8088/oauth2/callback"
       ],
       "webOrigins": [],
       "attributes": {
+        "pkce.code.challenge.method": "S256",
         "post.logout.redirect.uris": "http://localhost:8088/*"
       }
     }

scripts/verify-edge-google-federation.sh

@@ -0,0 +1,15 @@
+#!/usr/bin/env sh
+set -eu
+
+set -a
+. ./.env
+set +a
+
+docker compose down --volumes --remove-orphans
+docker compose up --build -d --wait
+./scripts/set-first-broker-login-mode.sh secure
+npm --prefix e2e ci
+MOCK_GOOGLE_USER_PASSWORD="$MOCK_GOOGLE_USER_PASSWORD" \
+KC_BOOTSTRAP_ADMIN_USERNAME="$KC_BOOTSTRAP_ADMIN_USERNAME" \
+KC_BOOTSTRAP_ADMIN_PASSWORD="$KC_BOOTSTRAP_ADMIN_PASSWORD" \
+  npm --prefix e2e run test:pattern4-google

scripts/verify-edge-no-google-profile.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env sh
+set -eu
+
+rendered="$(docker compose config --format json)"
+printf '%s\n' "$rendered" | jq -e '
+  (.services["oauth2-proxy"].command | index("--provider=keycloak-oidc") != null)
+  and
+  (.services["oauth2-proxy"].command | index("--code-challenge-method=S256") != null)
+  and
+  (.services.app.ports == null)
+  and
+  (.services["oauth2-proxy"].ports == null)
+' >/dev/null
+
+rg -Fq 'auth_request /oauth2/auth;' frontend/default.conf.template
+rg -Fq 'proxy_set_header X-Auth-Request-User $auth_user;' \
+  frontend/default.conf.template
+echo "AP4 local-identity edge profile verified"

scripts/verify-pattern3.sh

@@ -1,21 +0,0 @@
-#!/usr/bin/env sh
-set -eu
-
-if [ ! -f .env ]; then
-  echo "missing .env; copy .env.example and set development values" >&2
-  exit 1
-fi
-
-set -a
-. ./.env
-set +a
-
-docker compose down --volumes --remove-orphans
-docker compose up --build -d --wait
-
-npm --prefix e2e ci
-E2E_USERNAME=regular-user \
-E2E_PASSWORD="$REGULAR_USER_PASSWORD" \
-  npm --prefix e2e run test:pattern3
-
-echo "AP3 BFF session and CSRF behavior verified"

scripts/verify-pattern4.sh

@@ -0,0 +1,41 @@
+#!/usr/bin/env sh
+set -eu
+
+if [ ! -f .env ]; then
+  echo "missing .env; copy .env.example and set development values" >&2
+  exit 1
+fi
+
+set -a
+. ./.env
+set +a
+
+docker compose down --volumes --remove-orphans
+docker compose up --build -d --wait
+
+docker compose exec -T nginx nginx -V 2>&1 |
+  grep -q -- '--with-http_auth_request_module'
+docker compose exec -T nginx nginx -T 2>&1 |
+  grep -q 'proxy_pass_request_body off'
+
+app_container_id="$(docker compose ps -q app)"
+published_app_port="$(docker inspect "$app_container_id" \
+  --format '{{with (index .NetworkSettings.Ports "8081/tcp")}}{{json .}}{{end}}')"
+if [ -n "$published_app_port" ]; then
+  echo "backend port 8081 must not be published on the host" >&2
+  exit 1
+fi
+
+if docker compose exec -T nginx wget -q -O /dev/null \
+  --header 'X-Auth-Request-User: spoofed-admin' \
+  http://app:8081/edge/me 2>/dev/null; then
+  echo "backend accepted a forged identity without the internal token" >&2
+  exit 1
+fi
+
+npm --prefix e2e ci
+E2E_USERNAME=regular-user \
+E2E_PASSWORD="$REGULAR_USER_PASSWORD" \
+  npm --prefix e2e run test:pattern4
+
+echo "AP4 hardened Nginx auth_request edge flow verified"

scripts/verify-traefik-forwardauth-config.sh

@@ -0,0 +1,28 @@
+#!/usr/bin/env sh
+set -eu
+
+config_dir="$PWD/deploy/traefik"
+output_file="$(mktemp)"
+cleanup() {
+  rm -f "$output_file"
+}
+trap cleanup EXIT
+
+status=0
+timeout 4 docker run --rm \
+  -v "$config_dir:/etc/traefik:ro" \
+  traefik:v3.5.3 \
+  --configFile=/etc/traefik/traefik.yml >"$output_file" 2>&1 || status=$?
+
+if [ "$status" -ne 0 ] && [ "$status" -ne 124 ]; then
+  cat "$output_file" >&2
+  exit "$status"
+fi
+if rg -qi 'error|failed' "$output_file"; then
+  cat "$output_file" >&2
+  exit 1
+fi
+
+grep -q 'trustForwardHeader: false' deploy/traefik/dynamic.yml
+grep -q 'X-Auth-Request-User' deploy/traefik/dynamic.yml
+echo "Traefik file provider and ForwardAuth configuration verified"