how is csrf filter work,where is the token

[13567436138]

If you are reporting any crash or any potential security issue, do not
open an issue in this repo. Please report the issue via emailing
envoy-security@googlegroups.com where the issue will be triaged appropriately.

Title: One line description

Description:

Describe the issue.
how is csrf filter work,where is the token optional Relevant Links:]
Any extra documentation required to understand the issue.

[antoniovicente]

cc @dschaller @mattklein123

You can find docs on the csrf filter at:
https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/http/csrf/v3/csrf.proto.html
https://www.envoyproxy.io/docs/envoy/latest/start/sandboxes/csrf

I don't see references to 'token' in the docs.

[dschaller]

Hi @13567436138 ,

The Envoy CSRF filter does not use a token pattern but instead uses an origin-based one. You can read more on the possible mitigation patterns and why we chose to rely on the origin as well as implementation details in the description of the original PR #6470 :)