DongHyeonkaandClaude Opus 5
e856e7af4d
One user session carries a client session per application, so visiting the second app skips the login screen. Deleting the identity provider session leaves both application sessions untouched and both apps keep serving, because the identity provider, the application session and the access token each have their own lifetime. That inverts the B-2 finding: there the app session was cleared and the surviving SSO session let the user straight back in. Either way, clearing one side leaves the other. It also means an identity provider outage is a single point of failure for logging in, not for already-authenticated users, and the failure arrives late and all at once. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
21 lines
685 B
Plaintext
21 lines
685 B
Plaintext
=== app2 방문 후 — 로그인 화면 없이 통과했는가 ===
|
|
user_session_id | client_sessions
|
|
--------------------------+-----------------
|
|
oqOjHekin4JU-BZjgQLjUByW | 2
|
|
(1 row)
|
|
|
|
|
|
=== 어느 클라이언트가 붙었는가 ===
|
|
client_id | name
|
|
--------------------------------------+------------------
|
|
9055fa46-6abb-4d6d-a339-8a9183bbf26d | bff-confidential
|
|
80431dbc-af81-4673-9790-ad06d1570b2e | oauth2-proxy
|
|
(2 rows)
|
|
|
|
|
|
=== 저장소 상태 ===
|
|
Redis 키:
|
|
_oauth2_proxy-6b028a70f69c8f0da9966eb36972dff2
|
|
bff:session:sessions:6e0d9af4-2c8f-47d2-bf83-8b1e9670c679
|
|
PostgreSQL authorized client: 1 행
|