DongHyeonkaandClaude Opus 5
bcb563a04e
oauth2-proxy carries the authorization request in a signed cookie, so the callback can land on a different replica and still succeed, which is the opposite of the BFF failure in B-0. Sharing is therefore just sharing one Secret. Rotating it is all-or-nothing: --cookie-secret is singular, so there is no second key to read old tickets with, and the log shows both the validation failure and Error removing session, leaving the Redis session orphaned because the key cannot be derived from a ticket that will not decode. Getting there required two diagnoses: the callback 502 came from the full session riding in Set-Cookie past nginx's buffer, and every earlier attempt to read nginx config returned nothing because sudo on the host asks for a password while the guests do not. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
10 lines
435 B
Plaintext
10 lines
435 B
Plaintext
=== curl 로 OAuth 흐름을 완주한다 (nginx 우회, Traefik 직접) ===
|
|
로그인 폼 action: https://auth.hyeonworks.com/realms/keycloak-patterns/login-actions/authenticate?session_co...
|
|
쿠키 항아리:
|
|
len=0
|
|
KC_AUTH_SESSION_HASH len=64
|
|
|
|
=== 두 replica 모두 이 쿠키를 받아들이는가 ===
|
|
10.42.1.135 /oauth2/auth HTTP 000
|
|
10.42.1.134 /oauth2/auth HTTP 000
|