From 7636080ec28d33c53faf19b89744d6223dc10151 Mon Sep 17 00:00:00 2001 From: Stojan Dimitrovski Date: Wed, 20 Nov 2024 10:54:33 +0100 Subject: [PATCH] feat: add origin protection key enforcement for envoy in `lds.supabase.yaml` --- ansible/files/envoy_config/lds.supabase.yaml | 21 ++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/ansible/files/envoy_config/lds.supabase.yaml b/ansible/files/envoy_config/lds.supabase.yaml index 2fc7cae13..999f6b7df 100644 --- a/ansible/files/envoy_config/lds.supabase.yaml +++ b/ansible/files/envoy_config/lds.supabase.yaml @@ -82,6 +82,27 @@ resources: name: ':path' string_match: contains: apikey=supabase_admin_key + origin_protection_key_missing: + permissions: + - any: true + principals: + - not_id: + or_ids: + ids: + - header: + name: sb-opk + present_match: true + origin_protection_key_not_valid: + permissions: + - any: true + principals: + - not_id: + or_ids: + ids: + - header: + name: sb-opk + string_match: + exact: supabase_origin_protection_key - name: envoy.filters.http.lua typed_config: '@type': >-