Repository: envoyproxy/envoy
File: api/envoy/extensions/filters/http/oauth2/v3/oauth.proto (Protocol Buffers)

Code before:
// OAuth :ref:`configuration overview <config_http_filters_oauth>`.
// [#extension: envoy.filters.http.oauth2]
//

// OAuth cookie configuration attributes.
//
message CookieConfig {
  enum SameSite {
    DISABLED = 0;
    STRICT = 1;
    LAX = 2;
    NONE = 3;
  }

  // The value used for the SameSite cookie attribute.
  SameSite same_site = 1 [(validate.rules).enum = {defined_only: true}];

  // The path attribute for the cookie.
  //
  // This controls the scope of the cookie and is useful for path-based routing scenarios
  // where different logical boundaries or applications may operate with different OAuth2 clients.
  // The CSRF cookie (nonce cookie) can be configured with a different path than session cookies
  // to support flows where the callback URL is on a different path.
  //
  // If not specified, defaults to ``/``.
  string path = 2;
}

// [#next-free-field: 8]
message CookieConfigs {
  // Configuration for the bearer token cookie.
  CookieConfig bearer_token_cookie_config = 1;

  // Configuration for the OAuth HMAC cookie.
  CookieConfig oauth_hmac_cookie_config = 2;

  // Configuration for the OAuth expires cookie.
  CookieConfig oauth_expires_cookie_config = 3;

  // Configuration for the ID token cookie.
  CookieConfig id_token_cookie_config = 4;

  // Configuration for the refresh token cookie.
  CookieConfig refresh_token_cookie_config = 5;

  // Configuration for the OAuth nonce cookie.
  CookieConfig oauth_nonce_cookie_config = 6;

  // Configuration for the code verifier cookie.
  CookieConfig code_verifier_cookie_config = 7;
}

Review comment (security):
Just one more comment-everything else looks good to me. 

Can we add a validation rule to disallow semicolons and control chars in the path? This would prevent both intentional and accidental header injection.

Code after:
// OAuth :ref:`configuration overview <config_http_filters_oauth>`.
// [#extension: envoy.filters.http.oauth2]
//

// OAuth cookie configuration attributes.
//
message CookieConfig {
  enum SameSite {
    DISABLED = 0;
    STRICT = 1;
    LAX = 2;
    NONE = 3;
  }

  // The value used for the SameSite cookie attribute.
  SameSite same_site = 1 [(validate.rules).enum = {defined_only: true}];

  // The path attribute for the cookie.
  //
  // This controls the scope of the cookie and is useful for path-based routing scenarios
  // where different logical boundaries or applications may operate with different OAuth2 clients.
  // The CSRF cookie (nonce cookie) can be configured with a different path than session cookies
  // to support flows where the callback URL is on a different path.
  //
  // If not specified, defaults to ``/``.
  string path = 2 [(validate.rules).string = {pattern: "^$|^/[^\\x00-\\x1f\\x7f \",;<>\\\\]*$"}];
}

// [#next-free-field: 8]
message CookieConfigs {
  // Configuration for the bearer token cookie.
  CookieConfig bearer_token_cookie_config = 1;

  // Configuration for the OAuth HMAC cookie.
  CookieConfig oauth_hmac_cookie_config = 2;

  // Configuration for the OAuth expires cookie.
  CookieConfig oauth_expires_cookie_config = 3;

  // Configuration for the ID token cookie.
  CookieConfig id_token_cookie_config = 4;

  // Configuration for the refresh token cookie.
  CookieConfig refresh_token_cookie_config = 5;

  // Configuration for the OAuth nonce cookie.
  CookieConfig oauth_nonce_cookie_config = 6;

  // Configuration for the code verifier cookie.
  CookieConfig code_verifier_cookie_config = 7;
}