수집 시각: 2026-09-03 15:32:04 KST
단계: A(nginx) + B(Traefik) + C(앱) 모두 적용 후

=== [1] nginx 가 보내는 값 ===
28:		proxy_set_header X-Forwarded-Proto	https;
29:		proxy_set_header X-Forwarded-Port	443;
30:		proxy_set_header X-Forwarded-For	$remote_addr;
31:		proxy_set_header X-Real-IP		$remote_addr;

=== [2] Traefik entryPoint 인자 ===
"--entryPoints.web.forwardedHeaders.trustedIPs=10.42.0.0/16
"--entryPoints.websecure.forwardedHeaders.trustedIPs=10.42.0.0/16

=== [3] 앱 스위치 ===
SERVER_FORWARD_HEADERS_STRATEGY=native

=== [4] 최종 측정 ===
  x-forwarded-proto    https
  x-forwarded-port     443
  x-forwarded-host     app1.hyeonworks.com
  x-real-ip            100.123.124.30
  x-forwarded-server   traefik-697889c85-g7xpp
  --- 앱이 해석한 값        
  scheme               https
  secure               True
  serverName           app1.hyeonworks.com
  serverPort           443
  remoteAddr           100.123.124.30
  localAddr            10.42.0.10
  requestUrl           https://app1.hyeonworks.com/api/echo

=== [5] 위조 테스트 — 클라이언트가 http/evil/1.2.3.4 를 주입 ===
  x-forwarded-proto    https
  x-forwarded-port     443
  x-forwarded-host     app1.hyeonworks.com
  x-real-ip            100.123.124.30
  x-forwarded-server   traefik-697889c85-g7xpp
  --- 앱이 해석한 값        
  scheme               https
  secure               True
  serverName           app1.hyeonworks.com
  serverPort           443
  remoteAddr           100.123.124.30
  localAddr            10.42.1.6
  requestUrl           https://app1.hyeonworks.com/api/echo

  ★ 주입값이 하나도 반영되지 않았다. nginx 의 $remote_addr 덮어쓰기가 방어한다.

=== [6] 파드 분배 6회 ===
  pod 10.42.0.10 | remoteAddr 100.123.124.30 | scheme https
  pod 10.42.1.6 | remoteAddr 100.123.124.30 | scheme https
  pod 10.42.0.10 | remoteAddr 100.123.124.30 | scheme https
  pod 10.42.1.6 | remoteAddr 100.123.124.30 | scheme https
  pod 10.42.0.10 | remoteAddr 100.123.124.30 | scheme https
  pod 10.42.1.6 | remoteAddr 100.123.124.30 | scheme https