add AllowCredentials knob to CORS setting

Signed-off-by: huabing zhao <[email protected]>
envoyproxy · Dec 15, 2023 · 9801d1c · 9801d1c
1 parent 9aebfdc
commit 9801d1c
Show file tree

Hide file tree

Showing 9 changed files with 25 additions and 5 deletions.
diff --git a/api/v1alpha1/cors_types.go b/api/v1alpha1/cors_types.go
@@ -21,4 +21,7 @@ type CORS struct {
 	ExposeHeaders []string `json:"exposeHeaders,omitempty" yaml:"exposeHeaders,omitempty"`
 	// MaxAge defines how long the results of a preflight request can be cached.
 	MaxAge *metav1.Duration `json:"maxAge,omitempty" yaml:"maxAge,omitempty"`
+	// AllowCredentials indicates whether a request can include user credentials
+	// like cookies, authentication headers, or TLS client certificates.
+	AllowCredentials *bool `json:"allowCredentials,omitempty" yaml:"allowCredentials,omitempty"`
 }
diff --git a/api/v1alpha1/zz_generated.deepcopy.go b/api/v1alpha1/zz_generated.deepcopy.go
diff --git a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_securitypolicies.yaml b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_securitypolicies.yaml
@@ -101,6 +101,11 @@ spec:
                 description: CORS defines the configuration for Cross-Origin Resource
                   Sharing (CORS).
                 properties:
+                  allowCredentials:
+                    description: AllowCredentials indicates whether a request can
+                      include user credentials like cookies, authentication headers,
+                      or TLS client certificates.
+                    type: boolean
                   allowHeaders:
                     description: AllowHeaders defines the headers that are allowed
                       to be sent with requests.

diff --git a/internal/gatewayapi/securitypolicy.go b/internal/gatewayapi/securitypolicy.go
@@ -413,11 +413,12 @@ func (t *Translator) buildCORS(cors *egv1a1.CORS) (*ir.CORS, error) {
 	}
 
 	return &ir.CORS{
-		AllowOrigins:  allowOrigins,
-		AllowMethods:  cors.AllowMethods,
-		AllowHeaders:  cors.AllowHeaders,
-		ExposeHeaders: cors.ExposeHeaders,
-		MaxAge:        cors.MaxAge,
+		AllowOrigins:     allowOrigins,
+		AllowMethods:     cors.AllowMethods,
+		AllowHeaders:     cors.AllowHeaders,
+		ExposeHeaders:    cors.ExposeHeaders,
+		MaxAge:           cors.MaxAge,
+		AllowCredentials: cors.AllowCredentials != nil && *cors.AllowCredentials,
 	}, nil
 }
 

diff --git a/internal/ir/xds.go b/internal/ir/xds.go
@@ -328,6 +328,8 @@ type CORS struct {
 	ExposeHeaders []string `json:"exposeHeaders,omitempty" yaml:"exposeHeaders,omitempty"`
 	// MaxAge defines how long the results of a preflight request can be cached.
 	MaxAge *metav1.Duration `json:"maxAge,omitempty" yaml:"maxAge,omitempty"`
+	// AllowCredentials indicates whether a request can include user credentials.
+	AllowCredentials bool `json:"allowCredentials,omitempty" yaml:"allowCredentials,omitempty"`
 }
 
 // JWT defines the schema for authenticating HTTP requests using

diff --git a/internal/xds/translator/cors.go b/internal/xds/translator/cors.go
@@ -140,6 +140,7 @@ func (*cors) patchRoute(route *routev3.Route, irRoute *ir.HTTPRoute) error {
 	if irRoute.CORS.MaxAge != nil {
 		maxAge = strconv.Itoa(int(irRoute.CORS.MaxAge.Seconds()))
 	}
+	allowCredentials = &wrappers.BoolValue{Value: irRoute.CORS.AllowCredentials}
 
 	routeCfgProto := &corsv3.CorsPolicy{
 		AllowOriginStringMatch: allowOrigins,

diff --git a/internal/xds/translator/testdata/in/xds-ir/cors.yaml b/internal/xds/translator/testdata/in/xds-ir/cors.yaml
@@ -32,4 +32,5 @@ http:
       exposeHeaders:
       - "x-header-3"
       - "x-header-4"
+      allowCredentials: true
       maxAge: 1000s
diff --git a/internal/xds/translator/testdata/out/xds-ir/cors.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/cors.routes.yaml
@@ -13,6 +13,7 @@
       typedPerFilterConfig:
         envoy.filters.http.cors:
           '@type': type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy
+          allowCredentials: true
           allowHeaders: x-header-1, x-header-2
           allowMethods: GET, POST
           allowOriginStringMatch:

diff --git a/site/content/en/latest/api/extension_types.md b/site/content/en/latest/api/extension_types.md
@@ -123,6 +123,7 @@ _Appears in:_
 | `allowHeaders` _string array_ | AllowHeaders defines the headers that are allowed to be sent with requests. |
 | `exposeHeaders` _string array_ | ExposeHeaders defines the headers that can be exposed in the responses. |
 | `maxAge` _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.26/#duration-v1-meta)_ | MaxAge defines how long the results of a preflight request can be cached. |
+| `allowCredentials` _boolean_ | AllowCredentials indicates whether a request can include user credentials like cookies, authentication headers, or TLS client certificates. |
 
 
 #### ClaimToHeader