12367dd3a1
Phase 1 CRITICAL XSS: - marked.parse() → DOMPurify.sanitize() (system3 ai-assistant, issues-management) - toast innerHTML에 escapeHtml 적용 (system1 api-base, system3 common-header) - onclick 핸들러 → data 속성 + addEventListener (system2 issue-detail) Phase 2 HIGH 인가: - getUserBalance 본인확인 추가 (tksupport vacationController) Phase 3 HIGH 토큰+CSP: - localStorage 토큰 저장 제거 — 쿠키 전용 (7개 서비스) - unsafe-eval CSP 제거 (system1 security.js) Phase 4 MEDIUM: - nginx 보안 헤더 추가 (8개 서비스) - 500 에러 메시지 마스킹 (5개 API) - path traversal 방지 (system3 file_service.py) - cookie fallback 데드코드 제거 (4개 auth.js) - /login/form rate limiting 추가 (sso-auth) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
79 lines
2.3 KiB
Nginx Configuration File
79 lines
2.3 KiB
Nginx Configuration File
server {
|
|
listen 80;
|
|
server_name _;
|
|
charset utf-8;
|
|
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
add_header X-Frame-Options "SAMEORIGIN" always;
|
|
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
|
|
|
root /usr/share/nginx/html;
|
|
index index.html;
|
|
|
|
# gzip 압축
|
|
gzip on;
|
|
gzip_types text/plain text/css application/javascript application/json;
|
|
gzip_min_length 1024;
|
|
|
|
# HTML 캐시 비활성화
|
|
location ~* \.html$ {
|
|
expires -1;
|
|
add_header Cache-Control "no-store, no-cache, must-revalidate";
|
|
}
|
|
|
|
# JS/CSS 캐시 활성화 (버전 쿼리 스트링으로 무효화)
|
|
location ~* \.(js|css)$ {
|
|
expires 1h;
|
|
add_header Cache-Control "public, no-transform";
|
|
}
|
|
|
|
# 정적 파일 (이미지 등)
|
|
location ~* \.(png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf)$ {
|
|
expires 1h;
|
|
add_header Cache-Control "public, no-transform";
|
|
}
|
|
|
|
# 정적 파일
|
|
location / {
|
|
try_files $uri $uri/ /index.html;
|
|
}
|
|
|
|
# 업로드 파일 프록시 (^~ 로 regex location보다 우선 매칭)
|
|
location ^~ /uploads/ {
|
|
proxy_pass http://tkuser-api:3000/uploads/;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
}
|
|
|
|
# work-issues API 프록시 → system2-api
|
|
location /api/work-issues/ {
|
|
proxy_pass http://system2-api:3005;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
}
|
|
|
|
# API 프록시 → tkuser-api
|
|
location /api/ {
|
|
proxy_pass http://tkuser-api:3000;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection 'upgrade';
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_cache_bypass $http_upgrade;
|
|
}
|
|
|
|
# Health check
|
|
location /health {
|
|
access_log off;
|
|
return 200 'ok';
|
|
add_header Content-Type text/plain;
|
|
}
|
|
}
|