fix(translator): CSRF additional_origins must use host:port, not full URLs

Envoy CSRF filter calls hostAndPort() on the Origin header before matching
against additional_origins, stripping the scheme. Values must be specified as
host or host:port (e.g., "www.example.com" not "https://www.example.com").

This follows the same approach as kgateway: pass values directly to Envoy
without transformation, and document the expected format clearly.

Updated all test fixtures and documentation to use host-only values.

Signed-off-by: asalvador <asalvador@newrelic.com>

Author: albsga4

internal/gatewayapi/testdata/securitypolicy-with-csrf.in.yaml

@@ -12,13 +12,13 @@ securityPolicies:
     csrf:
       additionalOrigins:
       - type: Exact
-        value: https://www.example.com
+        value: www.example.com
       - type: Prefix
-        value: https://app.example
+        value: app.example
       - type: Suffix
         value: .trusted.com
       - type: RegularExpression
-        value: "https://.*\\.partner\\.com"
+        value: ".*\\.partner\\.com$"
 httpRoutes:
 - apiVersion: gateway.networking.k8s.io/v1
   kind: HTTPRoute

internal/gatewayapi/testdata/securitypolicy-with-csrf.out.yaml

@@ -105,13 +105,13 @@ securityPolicies:
     csrf:
       additionalOrigins:
       - type: Exact
-        value: https://www.example.com
+        value: www.example.com
       - type: Prefix
-        value: https://app.example
+        value: app.example
       - type: Suffix
         value: .trusted.com
       - type: RegularExpression
-        value: https://.*\.partner\.com
+        value: .*\.partner\.com$
     targetRef:
       group: gateway.networking.k8s.io
       kind: HTTPRoute
@@ -212,17 +212,17 @@ xdsIR:
           csrf:
             additionalOrigins:
             - distinct: false
-              exact: https://www.example.com
+              exact: www.example.com
               name: csrf
             - distinct: false
               name: csrf
-              prefix: https://app.example
+              prefix: app.example
             - distinct: false
               name: csrf
               suffix: .trusted.com
             - distinct: false
               name: csrf
-              safeRegex: https://.*\.partner\.com
+              safeRegex: .*\.partner\.com$
     readyListener:
       address: 0.0.0.0
       ipFamily: IPv4

internal/xds/translator/csrf.go

@@ -155,6 +155,9 @@ func (*csrf) patchResources(*types.ResourceVersionTable, []*ir.HTTPRoute) error
 }
 
 // buildXdsCSRFOrigins converts IR StringMatches to Envoy StringMatchers for CSRF origins.
+// Values are passed directly to Envoy without transformation. Users must provide
+// host:port values (not full URLs) because Envoy's CSRF filter strips the scheme
+// from the Origin header before matching.
 func buildXdsCSRFOrigins(csrf *ir.CSRF) []*matcherv3.StringMatcher {
 	if csrf == nil {
 		return nil

internal/xds/translator/testdata/in/xds-ir/csrf.yaml

@@ -22,8 +22,8 @@ http:
     security:
       csrf:
         additionalOrigins:
-        - exact: https://www.example.com
-        - prefix: https://app.example
+        - exact: www.example.com
+        - prefix: app.example
         - suffix: .trusted.com
-        - safeRegex: https://.*\.partner\.com
+        - safeRegex: .*\.partner\.com$
 

internal/xds/translator/testdata/out/xds-ir/csrf.routes.yaml

@@ -16,11 +16,11 @@
         envoy.filters.http.csrf:
           '@type': type.googleapis.com/envoy.extensions.filters.http.csrf.v3.CsrfPolicy
           additionalOrigins:
-          - exact: https://www.example.com
-          - prefix: https://app.example
+          - exact: www.example.com
+          - prefix: app.example
           - suffix: .trusted.com
           - safeRegex:
-              regex: https://.*\.partner\.com
+              regex: .*\.partner\.com$
           filterEnabled:
             defaultValue:
               numerator: 100

site/content/en/latest/tasks/security/csrf.md

@@ -19,6 +19,10 @@ When CSRF protection is enabled, the Envoy CSRF filter validates that the `Origi
 (POST, PUT, DELETE, PATCH) matches the destination or one of the configured additional origins.
 Non-mutating requests (GET, HEAD, OPTIONS) are not affected.
 
+Note: Envoy's CSRF filter compares against the host and port of the origin only (the scheme is stripped
+before matching). Additional origins must be specified as `host` or `host:port` values, not full URLs.
+For example, use `www.example.com` instead of `https://www.example.com`.
+
 The below example defines a SecurityPolicy that enables CSRF protection and allows additional origins
 matching `https://www.example.com` exactly and any subdomain of `trusted.com` via regex.
 
@@ -39,9 +43,9 @@ spec:
   csrf:
     additionalOrigins:
     - type: Exact
-      value: "https://www.example.com"
+      value: "www.example.com"
     - type: RegularExpression
-      value: "https://.*\\.trusted\\.com"
+      value: ".*\\.trusted\\.com$"
 EOF
 ```
 
@@ -63,18 +67,18 @@ spec:
   csrf:
     additionalOrigins:
     - type: Exact
-      value: "https://www.example.com"
+      value: "www.example.com"
     - type: RegularExpression
-      value: "https://.*\\.trusted\\.com"
+      value: ".*\\.trusted\\.com$"
 ```
 
 {{% /tab %}}
 {{< /tabpane >}}
 
 With this configuration:
 
-- A `POST` request with `Origin: https://www.example.com` will be **allowed**.
-- A `POST` request with `Origin: https://app.trusted.com` will be **allowed** (matches the regex).
+- A `POST` request with `Origin: https://www.example.com` will be **allowed** (Envoy extracts `www.example.com` and matches the exact origin).
+- A `POST` request with `Origin: https://app.trusted.com` will be **allowed** (Envoy extracts `app.trusted.com` which matches the regex).
 - A `POST` request with `Origin: https://www.malicious.com` will be **rejected** with a `403 Forbidden`.
 - A `GET` request from any origin will be **allowed** (non-mutating).
 

test/e2e/testdata/csrf-security-policy.yaml

@@ -28,10 +28,10 @@ spec:
   csrf:
     additionalOrigins:
     - type: Exact
-      value: "https://www.example.com"
+      value: "www.example.com"
     - type: Prefix
-      value: "https://app.example"
+      value: "app.example"
     - type: Suffix
       value: ".trusted.com"
     - type: RegularExpression
-      value: "https://.*\\.partner\\.com"
+      value: ".*\\.partner\\.com$"