fix(csrf): allow to set trusted origins (#4347)

Author: erka

config/flipt.schema.cue

@@ -43,6 +43,7 @@ import "list"
 			csrf?: {
 				key: string
 				secure?:        bool
+				trusted_origins?: [...] | string | *[]
 			}
 		}
 

config/flipt.schema.json

@@ -85,7 +85,11 @@
               "type": "object",
               "properties": {
                 "key": { "type": "string" },
-                "secure": { "type": "boolean" }
+                "secure": { "type": "boolean" },
+                "trusted_origins": {
+                  "type": ["array", "null"],
+                  "default": []
+                }
               },
               "required": []
             }

internal/cmd/http.go

@@ -180,7 +180,12 @@ func NewHTTPServer(
 					handler.ServeHTTP(w, r)
 				})
 			})
-			r.Use(csrf.Protect([]byte(key), csrf.Path("/"), csrf.Secure(cfg.Authentication.Session.CSRF.Secure)))
+			r.Use(csrf.Protect(
+				[]byte(key),
+				csrf.Path("/"),
+				csrf.Secure(cfg.Authentication.Session.CSRF.Secure),
+				csrf.TrustedOrigins(cfg.Authentication.Session.CSRF.TrustedOrigins),
+			))
 		}
 
 		r.Mount("/api/v1", api)

internal/config/authentication.go

@@ -246,6 +246,8 @@ type AuthenticationSessionCSRF struct {
 	Key string `json:"-" mapstructure:"key"`
 	// Secure signals to the CSRF middleware that the request is being served over TLS or plaintext HTTP
 	Secure bool `json:"secure,omitempty" mapstructure:"secure" yaml:"secure,omitempty"`
+	// TrustedOrigins is a list of trusted origins that are allowed to send requests
+	TrustedOrigins []string `json:"trustedOrigins,omitempty" mapstructure:"trusted_origins" yaml:"trusted_origins,omitempty"`
 }
 
 // AuthenticationMethods is a set of configuration for each authentication