fix(translator): strip scheme from CSRF additional_origins before xDS translation

Envoy's CSRF filter calls hostAndPort() on the Origin header before matching
against additional_origins, which strips the scheme (e.g., "https://") and
compares only host:port. However, the xDS translation was passing origin values
with schemes intact, causing exact, prefix, and regex matches to always fail
(suffix matches worked because they typically don't include a scheme).

This fix strips the scheme from StringMatch values in buildXdsCSRFOrigins
before passing them to Envoy, so users can write natural full URLs
(e.g., "https://www.example.com") and the translation handles the conversion.

Fixes E2E test failures: CSRFFromSecurityPolicy/should_allow_POST_with_matching_exact_Origin,
CSRFFromSecurityPolicy/should_allow_POST_with_matching_prefix_Origin,
CSRFFromSecurityPolicy/should_allow_POST_with_matching_regex_Origin.

Signed-off-by: asalvador <asalvador@newrelic.com>

Author: albsga4

internal/xds/translator/csrf.go

@@ -8,6 +8,7 @@ package translator
 import (
 	"errors"
 	"fmt"
+	"net/url"
 
 	corev3 "github.com/envoyproxy/go-control-plane/envoy/config/core/v3"
 	routev3 "github.com/envoyproxy/go-control-plane/envoy/config/route/v3"
@@ -155,14 +156,68 @@ func (*csrf) patchResources(*types.ResourceVersionTable, []*ir.HTTPRoute) error
 }
 
 // buildXdsCSRFOrigins converts IR StringMatches to Envoy StringMatchers for CSRF origins.
+// Envoy's CSRF filter strips the scheme from the Origin header before matching
+// (it calls hostAndPort() which extracts only host:port from the URL).
+// We must strip schemes from matcher values so they match what Envoy actually compares.
 func buildXdsCSRFOrigins(csrf *ir.CSRF) []*matcherv3.StringMatcher {
 	if csrf == nil {
 		return nil
 	}
 
 	var origins []*matcherv3.StringMatcher
 	for _, origin := range csrf.AdditionalOrigins {
-		origins = append(origins, buildXdsStringMatcher(origin))
+		stripped := stripSchemeFromStringMatch(origin)
+		origins = append(origins, buildXdsStringMatcher(stripped))
 	}
 	return origins
 }
+
+// stripSchemeFromStringMatch removes the scheme (e.g., "https://") from a
+// StringMatch value. This is needed because Envoy's CSRF filter compares
+// against host:port only, not the full origin URL.
+func stripSchemeFromStringMatch(m *ir.StringMatch) *ir.StringMatch {
+	out := &ir.StringMatch{
+		Name:     m.Name,
+		Distinct: m.Distinct,
+	}
+	switch {
+	case m.Exact != nil:
+		v := stripScheme(*m.Exact)
+		out.Exact = &v
+	case m.Prefix != nil:
+		v := stripScheme(*m.Prefix)
+		out.Prefix = &v
+	case m.Suffix != nil:
+		// Suffix values typically don't include a scheme, but strip just in case.
+		v := stripScheme(*m.Suffix)
+		out.Suffix = &v
+	case m.SafeRegex != nil:
+		v := stripSchemeFromRegex(*m.SafeRegex)
+		out.SafeRegex = &v
+	}
+	return out
+}
+
+// stripScheme removes the scheme prefix (e.g., "https://") from a URL string.
+func stripScheme(origin string) string {
+	if u, err := url.Parse(origin); err == nil && u.Scheme != "" && u.Host != "" {
+		return u.Host
+	}
+	return origin
+}
+
+// stripSchemeFromRegex removes a leading scheme pattern from a regex.
+// Common patterns: "https://.*" -> ".*", "https?://foo" -> "foo"
+func stripSchemeFromRegex(regex string) string {
+	prefixes := []string{
+		`https?://`,
+		`https://`,
+		`http://`,
+	}
+	for _, p := range prefixes {
+		if len(regex) > len(p) && regex[:len(p)] == p {
+			return regex[len(p):]
+		}
+	}
+	return regex
+}

internal/xds/translator/testdata/out/xds-ir/csrf.routes.yaml

@@ -16,11 +16,11 @@
         envoy.filters.http.csrf:
           '@type': type.googleapis.com/envoy.extensions.filters.http.csrf.v3.CsrfPolicy
           additionalOrigins:
-          - exact: https://www.example.com
-          - prefix: https://app.example
+          - exact: www.example.com
+          - prefix: app.example
           - suffix: .trusted.com
           - safeRegex:
-              regex: https://.*\.partner\.com
+              regex: .*\.partner\.com
           filterEnabled:
             defaultValue:
               numerator: 100

site/content/en/latest/tasks/security/csrf.md

@@ -19,6 +19,10 @@ When CSRF protection is enabled, the Envoy CSRF filter validates that the `Origi
 (POST, PUT, DELETE, PATCH) matches the destination or one of the configured additional origins.
 Non-mutating requests (GET, HEAD, OPTIONS) are not affected.
 
+Note: Envoy's CSRF filter compares against the host and port of the origin, not the full URL.
+Envoy Gateway automatically strips the scheme (e.g., `https://`) from configured origins before
+passing them to Envoy, so you can write origins as full URLs for readability.
+
 The below example defines a SecurityPolicy that enables CSRF protection and allows additional origins
 matching `https://www.example.com` exactly and any subdomain of `trusted.com` via regex.