Repository: envoyproxy/envoy
File: api/envoy/extensions/filters/http/ext_authz/v3/ext_authz.proto (Protocol Buffers)

Code before:
  // * When set to ``true``, the filter will ``accept`` the client request even if communication with
  //   the authorization service has failed, or if the authorization service has returned an HTTP 5xx
  //   error.
  //
  // * When set to ``false``, the filter will ``reject`` client requests and return ``Forbidden``
  //   if communication with the authorization service has failed, or if the authorization service
  //   has returned an HTTP 5xx error.
  //
  // Errors can always be tracked in the :ref:`stats <config_http_filters_ext_authz_stats>`.
  //
  // Defaults to ``false``.
  bool failure_mode_allow = 2;

  // When ``failure_mode_allow`` and ``failure_mode_allow_header_add`` are both set to ``true``,
  // ``x-envoy-auth-failure-mode-allowed: true`` will be added to request headers if the communication
  // with the authorization service has failed, or if the authorization service has returned a
  // HTTP 5xx error.
  bool failure_mode_allow_header_add = 19;

  // Enables the filter to buffer the client request body and send it within the authorization request.
  // The ``x-envoy-auth-partial-body: false|true`` metadata header will be added to the authorization
  // request indicating whether the body data is partial.
  BufferSettings with_request_body = 5;

  // Clears the route cache in order to allow the external authorization service to correctly affect
  // routing decisions. The filter clears all cached routes when:
  //
  // * This field is set to ``true``.
  // * The status returned from the authorization service is an HTTP 200 or gRPC 0.
  // * At least one ``authorization response header`` is added to the client request, or is used to
  //   alter another client request header.
  //
  // Defaults to ``false``.
  bool clear_route_cache = 6;

  // Sets the HTTP status that is returned to the client when the authorization server returns an error
  // or cannot be reached.
  //
  // The default status is ``HTTP 403 Forbidden``.
  type.v3.HttpStatus status_on_error = 7;

  // When set to ``true``, the filter will check the :ref:`ext_authz response
  // <envoy_v3_api_msg_service.auth.v3.CheckResponse>` for invalid header and
  // query parameter mutations. If the response is invalid, the filter will send a local reply
  // to the downstream request with status ``HTTP 500 Internal Server Error``.
  //
  // .. note::
  //   Both ``headers_to_remove`` and ``query_parameters_to_remove`` are validated, but invalid elements in
  //   those fields should not affect any headers and thus will not cause the filter to send a local reply.
  //
  // When set to ``false``, any invalid mutations will be visible to the rest of Envoy and may cause

Review comment (performance):
Converting this to bullet points loses the implied "and" between the criteria (I assume this was the original intent, but fell free to validate this).
```suggestion
  // routing decisions. The filter clears all cached routes when all of the following holds:
```

Code after:
  // * When set to ``true``, the filter will ``accept`` the client request even if communication with
  //   the authorization service has failed, or if the authorization service has returned an HTTP 5xx
  //   error.
  //
  // * When set to ``false``, the filter will ``reject`` client requests and return ``Forbidden``
  //   if communication with the authorization service has failed, or if the authorization service
  //   has returned an HTTP 5xx error.
  //
  // Errors can always be tracked in the :ref:`stats <config_http_filters_ext_authz_stats>`.
  //
  // Defaults to ``false``.
  bool failure_mode_allow = 2;

  // When ``failure_mode_allow`` and ``failure_mode_allow_header_add`` are both set to ``true``,
  // ``x-envoy-auth-failure-mode-allowed: true`` will be added to request headers if the communication
  // with the authorization service has failed, or if the authorization service has returned a
  // HTTP 5xx error.
  bool failure_mode_allow_header_add = 19;

  // Enables the filter to buffer the client request body and send it within the authorization request.
  // The ``x-envoy-auth-partial-body: false|true`` metadata header will be added to the authorization
  // request indicating whether the body data is partial.
  BufferSettings with_request_body = 5;

  // Clears the route cache in order to allow the external authorization service to correctly affect
  // routing decisions. The filter clears all cached routes when all of the following holds:
  //
  // * This field is set to ``true``.
  // * The status returned from the authorization service is an HTTP 200 or gRPC 0.
  // * At least one ``authorization response header`` is added to the client request, or is used to
  //   alter another client request header.
  //
  // Defaults to ``false``.
  bool clear_route_cache = 6;

  // Sets the HTTP status that is returned to the client when the authorization server returns an error
  // or cannot be reached.
  //
  // The default status is ``HTTP 403 Forbidden``.
  type.v3.HttpStatus status_on_error = 7;

  // When set to ``true``, the filter will check the :ref:`ext_authz response
  // <envoy_v3_api_msg_service.auth.v3.CheckResponse>` for invalid header and
  // query parameter mutations. If the response is invalid, the filter will send a local reply
  // to the downstream request with status ``HTTP 500 Internal Server Error``.
  //
  // .. note::
  //   Both ``headers_to_remove`` and ``query_parameters_to_remove`` are validated, but invalid elements in
  //   those fields should not affect any headers and thus will not cause the filter to send a local reply.
  //
  // When set to ``false``, any invalid mutations will be visible to the rest of Envoy and may cause