이 페이지는 IAP(Identity-Aware Proxy) 사용에 대한 권장사항을 설명합니다.
캐싱
애플리케이션 앞에 제3자 CDN을 사용하지 마세요. CDN은 콘텐츠를 캐시하고 캐시된 페이지를 인증되지 않은 사용자에게 제공할 수 있습니다.
CDN에서 제공하려는 민감하지 않은 대량의 리소스가 있는 경우, 해당 리소스에 대해 images.yourapp.com과 같은 별도의 도메인을 사용하세요. 해당 도메인에 CDN을 사용하고, 인증된 사용자에게만 제공되어야 하는 모든 객체에 Cache-control:
private HTTP 응답 헤더를 추가합니다.
추가 보호를 위해서는 앱에서 요청의 소스 IP가 방화벽 규칙이 허용하는 동일한 IP 범위에서 시작되는지 확인합니다.
방화벽 규칙이 잘못 설정된 것으로 보이면 Google Cloud 콘솔에서 IAP에 오류 또는 경고가 표시됩니다. IAP Google Cloud 콘솔은 각 서비스에 사용되는 VM을 감지하지 않기 때문에 기본값 이외의 네트워크 및 방화벽 규칙 태그와 같은 고급 기능이 방화벽 분석에 포함되지 않습니다. 이 분석을 우회하려면 gcloud compute backend-services update 명령어를 통해 IAP를 사용 설정합니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-04(UTC)"],[[["\u003cp\u003eIdentity-Aware Proxy (IAP) best practices are outlined on this page, including caching, securing applications, and firewall configuration.\u003c/p\u003e\n"],["\u003cp\u003eAvoid using third-party CDNs directly in front of applications protected by IAP to prevent serving cached content to unauthenticated users.\u003c/p\u003e\n"],["\u003cp\u003eTo properly secure applications, use signed headers for App Engine standard environment, Compute Engine, and GKE.\u003c/p\u003e\n"],["\u003cp\u003eEnsure all requests to Compute Engine or GKE are routed through the load balancer and verify traffic is from a Google Front End (GFE) IP.\u003c/p\u003e\n"],["\u003cp\u003eIAP will display errors or warnings if firewall rules appear to be set incorrectly, however, not all advanced features are detectable.\u003c/p\u003e\n"]]],[],null,["# Best practices\n\nThis page describes best practices for using Identity-Aware Proxy\n(IAP).\n\nCaching\n-------\n\n- Don't use a third-party CDN in front of your application. CDNs may cache content and serve cached pages to unauthenticated users.\n - If you have large, non-sensitive resources that you want to serve from a CDN, use a separate domain such as `images.yourapp.com` for these resources. Use the CDN with that domain and add the `Cache-control:\n private` HTTP response header to all objects that should only be served to authenticated users.\n\nSecuring your app\n-----------------\n\nTo properly secure your app, you must use [signed headers](/iap/docs/signed-headers-howto)\nfor [App Engine standard environment](/appengine/docs/about-the-standard-environment),\nCompute Engine, and GKE applications.\n\nConfiguring your firewall\n-------------------------\n\n- Make sure all requests to Compute Engine or GKE are routed through the load balancer:\n - [Configure a firewall rule to allow health checking](/load-balancing/docs/health-checks) and make sure that all traffic to your Virtual Machine (VM) is from a Google Front End (GFE) IP.\n - For additional protection, check the source IP of requests in your app to make sure they're from the same IP range that the firewall rule allows.\n- In the Google Cloud console, IAP displays an error or warning if your firewall rules appear to be set up incorrectly. The IAP Google Cloud console doesn't detect which VM is used for each service, so the firewall analysis doesn't include advanced features like non-default networks and firewall rule tags. To bypass this analysis, enable IAP through the `gcloud compute backend-services update` command."]]
