DongHyeonkaandClaude Opus 5
6c310c93b7
Neither client had a backchannel logout URL and the BFF has no oidcLogout configuration, so the three candidate paths all answer 302, which is the authentication redirect rather than a handler. Setting the URL on the identity provider alone changed nothing: with a live session, logging the user out emptied the Keycloak side and left the Redis session untouched. Reachability is not the blocker here, since a Keycloak pod fetches the app's public URL with a 200, but that is a property of this tailnet split-DNS lab and is the assumption most likely to fail in production, where it fails silently. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
7 lines
563 B
YAML
7 lines
563 B
YAML
- main [ref=f52e2]:
|
|
- heading "AP3 · Backend-for-Frontend" [level=1] [ref=f52e3]
|
|
- paragraph [ref=f52e4]: 브라우저에는 OAuth token이 전혀 전달되지 않습니다. HttpOnly session cookie로 BFF만 호출하고, BFF가 서버 보관 access token을 Resource Server 요청에 붙입니다.
|
|
- button "Keycloak 로그인" [ref=f52e5] [cursor=pointer]
|
|
- button "token 경계 확인" [ref=f52e6] [cursor=pointer]
|
|
- button "BFF 경유 API 호출" [ref=f52e7] [cursor=pointer]
|
|
- button "CSRF token으로 상태 변경" [ref=f52e8] [cursor=pointer] |