csrf filter: add support for additional source origins (#7297)

Signed-off-by: Derek Schaller <dschaller@lyft.com>

Mirrored from https://github.com/envoyproxy/envoy @ a4953ec7dc2c1658f38f756e325c40ea9457be6d

envoy/config/filter/http/csrf/v2/BUILD

@@ -5,5 +5,8 @@ licenses(["notice"])  # Apache 2
 api_proto_library_internal(
     name = "csrf",
     srcs = ["csrf.proto"],
-    deps = ["//envoy/api/v2/core:base"],
+    deps = [
+        "//envoy/api/v2/core:base",
+        "//envoy/type/matcher:string",
+    ],
 )

envoy/config/filter/http/csrf/v2/csrf.proto

@@ -8,6 +8,7 @@ option java_package = "io.envoyproxy.envoy.config.filter.http.csrf.v2";
 option go_package = "v2";
 
 import "envoy/api/v2/core/base.proto";
+import "envoy/type/matcher/string.proto";
 
 import "validate/validate.proto";
 import "gogoproto/gogo.proto";
@@ -17,7 +18,7 @@ import "gogoproto/gogo.proto";
 
 // CSRF filter config.
 message CsrfPolicy {
-  // Specify if CSRF is enabled.
+  // Specifies if CSRF is enabled.
   //
   // More information on how this can be controlled via runtime can be found
   // :ref:`here <csrf-runtime>`.
@@ -40,4 +41,11 @@ message CsrfPolicy {
   //   This field defaults to 100/:ref:`HUNDRED
   //   <envoy_api_enum_type.FractionalPercent.DenominatorType>`.
   envoy.api.v2.core.RuntimeFractionalPercent shadow_enabled = 2;
+
+  // Specifies additional source origins that will be allowed in addition to
+  // the destination origin.
+  //
+  // More information on how this can be configured via runtime can be found
+  // :ref:`here <csrf-configuration>`.
+  repeated envoy.type.matcher.StringMatcher additional_origins = 3;
 }