For the complete documentation index, see llms.txt. Markdown versions of all docs pages are available by appending .md to any docs URL.
Security
Secure your gateway to prevent unauthenticated and unauthorized access to your apps.
Access logging
Send request, routing, and response data to the gateway proxy stdout stream, a file, or a gRPC …
Backend TLS
Use a BackendTLSPolicy so that the Gateway originates TLS to a backend that accepts only TLS …
CORS
Define which origins, methods, and headers a browser can use for cross-origin requests, then test …
CSRF
Block cross-site request forgery at the gateway, and monitor the filter with Envoy metrics.
Data loss prevention (DLP)
Ensure that sensitive data isn’t logged or leaked by masking data in response bodies and access …
Response header sanitization
Remove every response header that is not on an allowlist, so that only approved headers reach the …
External authentication and authorization
IP-based access control (ACL)
Allow or deny HTTP requests based on the client’s source IP address using an ACL policy.
JWT
Verify JWT tokens and enforce access control on your gateway routes.
Rate limiting
Web Application Firewall (WAF)
Protect your apps from web attacks by creating a WAFPolicy and applying it to your routes with an …