Skip to content

fix: OIDC 토큰 엔드포인트 CSRF 체크 비활성화 #27

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mack-erel merged 1 commit into from
Apr 20, 2026
Merged

fix: OIDC 토큰 엔드포인트 CSRF 체크 비활성화 #27

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions svelte.config.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,9 +23,9 @@ const config = {
"object-src": ["none"],
},
},
// OIDC token endpoint 는 server-to-server 호출이므로 Origin 헤더 없이 전달된다.
// SvelteKit CSRF 체크는 Origin 헤더가 없을 때 자동으로 통과하므로 별도 설정 불필요.
// trustedOrigins: ['*'] 는 전체 CSRF 비활성화와 동일하여 제거함.
// OIDC/SAML 엔드포인트는 서비스 프로바이더(SP)에서 cross-origin으로 호출하므로
// SvelteKit CSRF 체크를 비활성화한다. UI 폼의 CSRF는 OIDC state 파라미터가 보호한다.
csrf: { checkOrigin: false },
typescript: {
config: (config) => ({
...config,
Expand Down
Loading