24 lines
586 B
Plaintext
24 lines
586 B
Plaintext
# AP3의 masked CSRF 응답과 raw POST credential
|
|
# Question: AP3에서 CSRF 응답의 masked token과 raw cookie 중 무엇이 실제 POST header의 data source가 되는가?
|
|
direction: right
|
|
n0: "BFF · /bff/csrf" {
|
|
shape: rectangle
|
|
}
|
|
n1: "Browser cookie · raw" {
|
|
shape: rectangle
|
|
}
|
|
n2: "JSON body · masked" {
|
|
shape: rectangle
|
|
}
|
|
n3: "SPA POST 조립" {
|
|
shape: rectangle
|
|
}
|
|
n4: "Spring CSRF filter" {
|
|
shape: rectangle
|
|
}
|
|
n0 -> n1: "Set-Cookie · raw"
|
|
n0 -> n2: "masked JSON"
|
|
n1 -> n3: "document.cookie · raw"
|
|
n2 -> n3: "headerName only"
|
|
n3 -> n4: "Cookie raw = Header raw"
|