DongHyeonkaandClaude Opus 5
711878379c
Moving the authorized client to JdbcOAuth2AuthorizedClientService makes tokens work across replicas, so the session-in-Redis plus tokens-in-PostgreSQL split holds. The table then shows what sharing cannot fix: the primary key is (client_registration_id, principal_name) with no session in it, so a second login for the same user updates the same row rather than adding one. The refresh token sits in bytea as the raw JWT, readable with convert_from, and logout clears only the Redis session while the plaintext token row and the Keycloak SSO session both survive. The schema itself failed silently first because the default DDL uses blob, which PostgreSQL does not have, and continue-on-error swallowed it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
7 lines
563 B
YAML
7 lines
563 B
YAML
- main [ref=f38e2]:
|
|
- heading "AP3 · Backend-for-Frontend" [level=1] [ref=f38e3]
|
|
- paragraph [ref=f38e4]: 브라우저에는 OAuth token이 전혀 전달되지 않습니다. HttpOnly session cookie로 BFF만 호출하고, BFF가 서버 보관 access token을 Resource Server 요청에 붙입니다.
|
|
- button "Keycloak 로그인" [ref=f38e5] [cursor=pointer]
|
|
- button "token 경계 확인" [ref=f38e6] [cursor=pointer]
|
|
- button "BFF 경유 API 호출" [ref=f38e7] [cursor=pointer]
|
|
- button "CSRF token으로 상태 변경" [ref=f38e8] [cursor=pointer] |