DongHyeonkaandClaude Opus 5
a2f749292a
Each of A-7a, B-7a and D-4a had the concepts, procedure, commands and
terminal evidence but no diagram, which the rest of the series carries.
a7a-cache-temperature.svg the three cache states and the SQL each issues
b7a-orphan-lifecycle.svg ticket structure, accumulation across two
rotations, and why TTL is the only signal
d4a-hook-timeline.svg the 38m25s gap against the 1-2s one, on one axis
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
75 lines
4.8 KiB
XML
75 lines
4.8 KiB
XML
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 860 500" font-family="-apple-system,BlinkMacSystemFont,'Segoe UI',Helvetica,sans-serif">
|
||
<style>
|
||
.box{fill:#fff;stroke:#8c959f;stroke-width:1.4;rx:6}
|
||
.dead{fill:#fff5f5;stroke:#cf222e;stroke-width:1.6;stroke-dasharray:5 3;rx:6}
|
||
.ok{fill:#f6fdf6;stroke:#1a7f37;stroke-width:1.6;rx:6}
|
||
.warn{fill:#fff8f0;stroke:#bf8700;stroke-width:1.5;rx:6}
|
||
.t{font-size:12px;fill:#1f2328}
|
||
.tb{font-size:12.5px;fill:#1f2328;font-weight:600}
|
||
.s{font-size:10.5px;fill:#656d76}
|
||
.ttl{font-size:14px;fill:#1f2328;font-weight:600}
|
||
.r{stroke:#cf222e;stroke-width:1.6;fill:none}
|
||
.g{stroke:#1a7f37;stroke-width:1.6;fill:none}
|
||
.k{stroke:#8c959f;stroke-width:1.3;fill:none}
|
||
</style>
|
||
<defs>
|
||
<marker id="a" markerWidth="8" markerHeight="8" refX="7" refY="3" orient="auto"><path d="M0,0 L7,3 L0,6 z" fill="#8c959f"/></marker>
|
||
<marker id="ar" markerWidth="8" markerHeight="8" refX="7" refY="3" orient="auto"><path d="M0,0 L7,3 L0,6 z" fill="#cf222e"/></marker>
|
||
<marker id="ag" markerWidth="8" markerHeight="8" refX="7" refY="3" orient="auto"><path d="M0,0 L7,3 L0,6 z" fill="#1a7f37"/></marker>
|
||
</defs>
|
||
<text x="20" y="26" class="ttl">B-7a — 고아 세션은 지울 수 있다. oauth2-proxy 가 못 할 뿐이다</text>
|
||
<text x="20" y="44" class="s">회전 2회 측정 · Redis + oauth2-proxy 로그 + 브라우저</text>
|
||
|
||
<text x="20" y="76" class="tb">왜 프록시는 못 지우는가 — 티켓의 구조</text>
|
||
<rect x="20" y="88" width="400" height="86" class="box"/>
|
||
<text x="34" y="110" class="t">쿠키에 담기는 것 = 티켓</text>
|
||
<rect x="36" y="120" width="180" height="30" class="box"/>
|
||
<text x="48" y="140" class="s">세션 ID → Redis 키 이름</text>
|
||
<rect x="224" y="120" width="180" height="30" class="box"/>
|
||
<text x="236" y="140" class="s">암호화 키 → 값 복호화</text>
|
||
<text x="34" y="166" class="s">티켓 전체가 cookie secret 으로 암호화되어 있다</text>
|
||
|
||
<rect x="444" y="88" width="396" height="86" class="dead"/>
|
||
<text x="458" y="110" class="tb">secret 을 바꾸면</text>
|
||
<text x="458" y="130" class="s">티켓을 못 연다 → 세션 ID 조차 못 읽는다</text>
|
||
<text x="458" y="148" class="s">→ 어느 Redis 키를 지울지 모른다</text>
|
||
<text x="458" y="166" class="s">Error removing session: error decoding ticket to clear session</text>
|
||
<path d="M424 131 L440 131" class="r" marker-end="url(#ar)"/>
|
||
|
||
<text x="20" y="208" class="tb">회전할 때마다 누적한다</text>
|
||
<line x1="70" y1="256" x2="800" y2="256" class="k"/>
|
||
<line x1="130" y1="244" x2="130" y2="268" stroke="#cf222e" stroke-width="2"/>
|
||
<line x1="430" y1="244" x2="430" y2="268" stroke="#cf222e" stroke-width="2"/>
|
||
<text x="92" y="288" class="s">1차 회전 11:29:56</text>
|
||
<text x="392" y="288" class="s">2차 회전 11:33:27</text>
|
||
|
||
<rect x="70" y="224" width="60" height="16" class="ok"/>
|
||
<text x="76" y="236" class="s">세션 A</text>
|
||
<rect x="130" y="224" width="300" height="16" class="dead"/>
|
||
<text x="150" y="236" class="s" fill="#cf222e">A 는 고아 · TTL 만료까지 남는다</text>
|
||
<rect x="130" y="224" width="0" height="0"/>
|
||
<rect x="150" y="304" width="280" height="16" class="ok"/>
|
||
<text x="156" y="316" class="s">세션 B (1차 회전 후 생성)</text>
|
||
<rect x="430" y="304" width="370" height="16" class="dead"/>
|
||
<text x="450" y="316" class="s" fill="#cf222e">B 도 고아가 된다</text>
|
||
<rect x="450" y="224" width="350" height="16" class="ok"/>
|
||
<text x="456" y="236" class="s">세션 C (2차 회전 후 생성)</text>
|
||
<text x="70" y="338" class="s">회전 1회 = 그 시점 로그인 사용자 수만큼의 고아</text>
|
||
|
||
<rect x="20" y="356" width="400" height="126" class="dead"/>
|
||
<text x="34" y="378" class="tb">Redis 만 보고는 구분할 수 없다</text>
|
||
<text x="34" y="400" class="s">이름 _oauth2_proxy-<불투명한 32자 hex> (동일 형식)</text>
|
||
<text x="34" y="418" class="s">type string (동일)</text>
|
||
<text x="34" y="436" class="s">크기 3510 바이트 (바이트까지 동일)</text>
|
||
<text x="34" y="454" class="s">값 암호화됨 (읽을 수 없다)</text>
|
||
<text x="34" y="474" class="s" fill="#cf222e">→ 다른 것은 TTL 하나뿐이다</text>
|
||
|
||
<rect x="444" y="356" width="396" height="126" class="ok"/>
|
||
<text x="458" y="378" class="tb">그래서 TTL 이 정리 규칙이 된다</text>
|
||
<text x="458" y="398" class="s">--cookie-refresh 가 없어 TTL 이 갱신되지 않는다 (refresh:disabled)</text>
|
||
<text x="458" y="416" class="s">→ TTL 은 생성 시각의 정확한 함수다</text>
|
||
<rect x="460" y="424" width="364" height="26" class="box"/>
|
||
<text x="470" y="442" class="t">생성시각 = 지금 − (cookie-expire − TTL)</text>
|
||
<text x="458" y="466" class="s" fill="#1a7f37">이 값이 회전 시각보다 이르면 고아. 검증: 역산 11:30:26 vs 로그 11:30:27 — 1초 오차</text>
|
||
</svg>
|