BFF'de Güvenlik ve Alternatifler — Token Handler, GraphQL, Gateway

1
# spring-session-data-redis is on the classpath: sessions, and the tokens in them,
2
# live in Redis, so any BFF pod can serve the next request.
3
spring:
4
  security:
5
    oauth2:
6
      client:
7
        registration:
8
          bank:
9
            client-id: internet-banking-web
10
            client-secret: ${BFF_CLIENT_SECRET}      # stays on the server
11
            authorization-grant-type: authorization_code
12
            scope: openid,accounts.read,transfers.write
13
        provider:
14
          bank:
15
            issuer-uri: https://auth.bank.example/realms/retail
16
  cloud:
17
    gateway:
18
      server:
19
        webflux:
20
          routes:
21
            - id: transfers
22
              uri: lb://transfer-service
23
              predicates:
24
                - Path=/api/transfers/**
25
              filters:
26
                - TokenRelay=        # puts the session's access token in Authorization: Bearer
27
server:
28
  reactive:
29
    session:
30
      cookie:
31
        name: BANK_SESSION
32
        http-only: true              # no script can read it
33
        secure: true                 # sent over HTTPS only
34
        same-site: strict            # not sent on requests started by other sites

1
@Configuration
2
@EnableWebFluxSecurity
3
class SecurityConfig {
4

5
    @Bean
6
    SecurityWebFilterChain security(ServerHttpSecurity http) {
7
        return http
8
                .authorizeExchange(auth -> auth.anyExchange().authenticated())
9
                .oauth2Login(Customizer.withDefaults())      // the BFF runs the OAuth flow
10
                .csrf(csrf -> csrf
11
                        .csrfTokenRepository(CookieServerCsrfTokenRepository.withHttpOnlyFalse())
12
                        // Plain token: the page copies the XSRF-TOKEN cookie into X-XSRF-TOKEN.
13
                        .csrfTokenRequestHandler(new ServerCsrfTokenRequestAttributeHandler()))
14
                .build();
15
    }
16

17
    // The CSRF token is created lazily; subscribing to it here makes sure the cookie is written.
18
    @Bean
19
    WebFilter csrfCookieFilter() {
20
        return (exchange, chain) -> exchange
21
                .<Mono<CsrfToken>>getAttributeOrDefault(CsrfToken.class.getName(), Mono.empty())
22
                .then(chain.filter(exchange));
23
    }
24
}

1
function csrfToken(): string {
2
  const value = /(?:^|; )XSRF-TOKEN=([^;]*)/.exec(document.cookie)?.[1];
3
  return value ? decodeURIComponent(value) : '';
4
}
5

6
// No token anywhere in the browser: the HttpOnly session cookie travels on its own.
7
export function sendTransfer(toIban: string, amountKurus: number): Promise<Response> {
8
  return fetch('/api/transfers', {
9
    method: 'POST',
10
    credentials: 'same-origin',
11
    headers: { 'Content-Type': 'application/json', 'X-XSRF-TOKEN': csrfToken() },
12
    body: JSON.stringify({ toIban, amountKurus }),
13
  });
14
}

1
// Another way to write it: the page keeps the access token itself.
2
export function sendTransfer(toIban: string, amountKurus: number): Promise<Response> {
3
  // Any script on the page can run this same line, including one injected through a comment field.
4
  const token = localStorage.getItem('access_token');
5
  return fetch('https://api.bank.example/transfers', {
6
    method: 'POST',
7
    headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${token}` },
8
    body: JSON.stringify({ toIban, amountKurus }),
9
  });
10
}