Files
technical-visualization-haness/.work/keycloak-four-patterns/final/assets/ap3-csrf-boundary/ap3-csrf-boundary.mmd
T
2026-07-29 18:03:21 +09:00

14 lines
514 B
Plaintext

%% AP3의 masked CSRF 응답과 raw POST credential
%% question: AP3에서 CSRF 응답의 masked token과 raw cookie 중 무엇이 실제 POST header의 data source가 되는가?
flowchart LR
n0["BFF · /bff/csrf"]
n1["Browser cookie · raw"]
n2["JSON body · masked"]
n3["SPA POST 조립"]
n4["Spring CSRF filter"]
n0 -->|"Set-Cookie · raw"| n1
n0 -->|"masked JSON"| n2
n1 -->|"document.cookie · raw"| n3
n2 -->|"headerName only"| n3
n3 -->|"Cookie raw = Header raw"| n4