56 lines
2.1 KiB
Plaintext
56 lines
2.1 KiB
Plaintext
수집 시각: 2026-09-03 15:32:04 KST
|
|
단계: A(nginx) + B(Traefik) + C(앱) 모두 적용 후
|
|
|
|
=== [1] nginx 가 보내는 값 ===
|
|
28: proxy_set_header X-Forwarded-Proto https;
|
|
29: proxy_set_header X-Forwarded-Port 443;
|
|
30: proxy_set_header X-Forwarded-For $remote_addr;
|
|
31: proxy_set_header X-Real-IP $remote_addr;
|
|
|
|
=== [2] Traefik entryPoint 인자 ===
|
|
"--entryPoints.web.forwardedHeaders.trustedIPs=10.42.0.0/16
|
|
"--entryPoints.websecure.forwardedHeaders.trustedIPs=10.42.0.0/16
|
|
|
|
=== [3] 앱 스위치 ===
|
|
SERVER_FORWARD_HEADERS_STRATEGY=native
|
|
|
|
=== [4] 최종 측정 ===
|
|
x-forwarded-proto https
|
|
x-forwarded-port 443
|
|
x-forwarded-host app1.hyeonworks.com
|
|
x-real-ip 100.123.124.30
|
|
x-forwarded-server traefik-697889c85-g7xpp
|
|
--- 앱이 해석한 값
|
|
scheme https
|
|
secure True
|
|
serverName app1.hyeonworks.com
|
|
serverPort 443
|
|
remoteAddr 100.123.124.30
|
|
localAddr 10.42.0.10
|
|
requestUrl https://app1.hyeonworks.com/api/echo
|
|
|
|
=== [5] 위조 테스트 — 클라이언트가 http/evil/1.2.3.4 를 주입 ===
|
|
x-forwarded-proto https
|
|
x-forwarded-port 443
|
|
x-forwarded-host app1.hyeonworks.com
|
|
x-real-ip 100.123.124.30
|
|
x-forwarded-server traefik-697889c85-g7xpp
|
|
--- 앱이 해석한 값
|
|
scheme https
|
|
secure True
|
|
serverName app1.hyeonworks.com
|
|
serverPort 443
|
|
remoteAddr 100.123.124.30
|
|
localAddr 10.42.1.6
|
|
requestUrl https://app1.hyeonworks.com/api/echo
|
|
|
|
★ 주입값이 하나도 반영되지 않았다. nginx 의 $remote_addr 덮어쓰기가 방어한다.
|
|
|
|
=== [6] 파드 분배 6회 ===
|
|
pod 10.42.0.10 | remoteAddr 100.123.124.30 | scheme https
|
|
pod 10.42.1.6 | remoteAddr 100.123.124.30 | scheme https
|
|
pod 10.42.0.10 | remoteAddr 100.123.124.30 | scheme https
|
|
pod 10.42.1.6 | remoteAddr 100.123.124.30 | scheme https
|
|
pod 10.42.0.10 | remoteAddr 100.123.124.30 | scheme https
|
|
pod 10.42.1.6 | remoteAddr 100.123.124.30 | scheme https
|