csrf.proto

syntax = "proto3";

package envoy.config.filter.http.csrf.v2;

import "envoy/api/v2/core/base.proto";
import "envoy/type/matcher/string.proto";

import "udpa/annotations/migrate.proto";
import "udpa/annotations/status.proto";
import "validate/validate.proto";

option java_package = "io.envoyproxy.envoy.config.filter.http.csrf.v2";
option java_outer_classname = "CsrfProto";
option java_multiple_files = true;
option (udpa.annotations.file_migrate).move_to_package = "envoy.extensions.filters.http.csrf.v3";
option (udpa.annotations.file_status).package_version_status = FROZEN;

// [#protodoc-title: CSRF]
// Cross-Site Request Forgery :ref:`configuration overview <config_http_filters_csrf>`.
// [#extension: envoy.filters.http.csrf]

// CSRF filter config.
message CsrfPolicy {
  // Specifies the % of requests for which the CSRF filter is enabled.
  //
  // If :ref:`runtime_key <envoy_api_field_core.RuntimeFractionalPercent.runtime_key>` is specified,
  // Envoy will lookup the runtime key to get the percentage of requests to filter.
  //
  // .. note::
  //
  //   This field defaults to 100/:ref:`HUNDRED
  //   <envoy_api_enum_type.FractionalPercent.DenominatorType>`.
  api.v2.core.RuntimeFractionalPercent filter_enabled = 1
      [(validate.rules).message = {required: true}];

  // Specifies that CSRF policies will be evaluated and tracked, but not enforced.
  //
  // This is intended to be used when ``filter_enabled`` is off and will be ignored otherwise.
  //
  // If :ref:`runtime_key <envoy_api_field_core.RuntimeFractionalPercent.runtime_key>` is specified,
  // Envoy will lookup the runtime key to get the percentage of requests for which it will evaluate
  // and track the request's *Origin* and *Destination* to determine if it's valid, but will not
  // enforce any policies.
  api.v2.core.RuntimeFractionalPercent shadow_enabled = 2;

  // Specifies additional source origins that will be allowed in addition to
  // the destination origin.
  //
  // More information on how this can be configured via runtime can be found
  // :ref:`here <csrf-configuration>`.
  repeated type.matcher.StringMatcher additional_origins = 3;
}