24 lines
3.4 KiB
XML
24 lines
3.4 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
<mxfile host="app.diagrams.net" modified="2026-07-23T00:00:00.000Z" agent="techviz-harness" version="24.7.17" type="device">
|
|
<diagram id="credential-custody-map" name="Credential은 사라지지 않고 owner와 형태가 바뀐다">
|
|
<mxGraphModel dx="1138" dy="300" grid="1" gridSize="10" guides="1" tooltips="1" connect="1" arrows="1" fold="1" page="1" pageScale="1" pageWidth="1138" pageHeight="1169" math="0" shadow="0">
|
|
<root>
|
|
<mxCell id="0"/>
|
|
<mxCell id="1" parent="0"/>
|
|
<mxCell id="n_ap1-browser-memory" value="AP1 · browser memory<br/>OAuth: token 3종 → JS<br/>브라우저: 실행 중 JS가 읽음<br/>보관: runtime memory<br/>운영: 영속 Web Storage 없음" tooltip="AP1은 OAuth token을 실행 중 JavaScript memory에 두며 memory-only 선택은 persistent script-readable 복사본을 줄인다. | Evidence: L53-L53, L66-L66" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;strokeColor=#d97706;fillColor=#fffdf5;" vertex="1" parent="1">
|
|
<mxGeometry x="45.0" y="45.0" width="223.0" height="122.0" as="geometry"/>
|
|
</mxCell>
|
|
<mxCell id="n_ap2-mediator-custody" value="AP2 · mediator custody<br/>OAuth: refresh → mediator<br/>브라우저: session cookie<br/>보관: server-side state<br/>운영: shared store 미입증" tooltip="AP2는 refresh token owner를 mediator로 옮기고 server-side login state를 식별하는 cookie를 사용하지만 shared durable persistence는 입증되지 않았다. | Evidence: L53-L54, L72-L72" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;" vertex="1" parent="1">
|
|
<mxGeometry x="320.0" y="45.0" width="223.0" height="122.0" as="geometry"/>
|
|
</mxCell>
|
|
<mxCell id="n_ap3-bff-custody" value="AP3 · BFF/session<br/>OAuth: refresh → BFF<br/>브라우저: HttpOnly session<br/>보관: session + readable XSRF<br/>운영: shared store 미입증" tooltip="AP3는 OAuth token을 JavaScript에 주지 않고 BFF가 refresh token을 소유하지만 브라우저에는 session과 CSRF용 readable token이 남는다. | Evidence: L53-L54, L64-L64, L72-L72" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;strokeColor=#2563eb;strokeWidth=2;" vertex="1" parent="1">
|
|
<mxGeometry x="595.0" y="45.0" width="223.0" height="122.0" as="geometry"/>
|
|
</mxCell>
|
|
<mxCell id="n_ap4-proxy-session" value="AP4 · proxy session<br/>OAuth: JS 미수신<br/>브라우저: proxy session<br/>보관: minimal client-side<br/>운영: secret 공유·회전 미검증" tooltip="AP4는 minimal client-side proxy session을 사용하며 JavaScript는 OAuth token을 받지 않지만 replica 간 cookie secret 운영은 검증되지 않았다. | Evidence: L55-L55, L64-L64, L72-L72" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;" vertex="1" parent="1">
|
|
<mxGeometry x="870.0" y="45.0" width="223.0" height="122.0" as="geometry"/>
|
|
</mxCell>
|
|
</root>
|
|
</mxGraphModel>
|
|
</diagram>
|
|
</mxfile>
|