feat: add CSRF origin validation to SecurityPolicy - #8836

Open

albsga4 wants to merge 14 commits into

envoyproxy:mainfrom

albsga4:feat/securitypolicy-csrf-filter

Commits on Jul 30, 2026

api: add CSRF origin validation to SecurityPolicy

albsga4
authored and
zhaohuabing
committed
test: cover all StringMatch types in CSRF tests

albsga4
authored and
zhaohuabing
committed
fix: correct yaml indentation in csrf test input

albsga4
authored and
zhaohuabing
committed
fix: set explicit filter order for CSRF filter

albsga4
authored and
zhaohuabing
committed
fix: add CSRF to EnvoyFilter validation enum and filter order docs

albsga4
authored and
zhaohuabing
committed
fix(translator): CSRF additional_origins must use host:port, not full URLs

albsga4
authored and
zhaohuabing
committed
feat(api): add filterEnabled and shadowEnabled to CSRF policy

albsga4
authored and
zhaohuabing
committed
docs: regenerate API reference for CSRF filterEnabled/shadowEnabled

albsga4
authored and
zhaohuabing
committed
address review comments: use gwapiv1.Fraction for CSRF rollout fields
zhaohuabing
committed
reject csrf additionalOrigins that carry a scheme or path
zhaohuabing
committed
api: drop csrf enforcedFraction in favour of shadowFraction
zhaohuabing
committed
api: reuse the CORS Origin type for csrf additionalOrigins
zhaohuabing
committed
xds: shadow the entire non-enforced CSRF remainder
zhaohuabing
committed
fix lint
zhaohuabing
committed